developers

Your agent stays your agent.

Verundo is an MCP server. Point the agent you already have at it, and every action it takes becomes a planned, policed, recorded and recoverable step. No SDK to adopt, no provider credentials in the agent.

HubSpotSalesforceStripeZendeskShopifyGmailSlackGoogle Calendar

01 · integration

Connect over MCP

One config change for Claude Desktop, Claude Code, Cursor, LangChain or your own loop.

mcp client config

{
  "mcpServers": {
    "verundo": {
      "url": "https://app.verundo.io/mcp",
      "headers": { "Authorization": "Bearer $VERUNDO_API_KEY" }
    }
  }
}

a run, as the agent experiences it

# what the agent sees: ordinary tools, one per protected action
verundo_begin_run            name="Cancel subscription for Anna"
stripe__subscription__cancel subscriptionId="sub_9f2…"
  → awaiting_approval  compensatable · needs a human under the current policy
zendesk__ticket__update      ticketId=3 fields={ status: "solved" }
  → executed  reversible · before-state captured
verundo_complete_run
  → 1 executed · 1 awaiting approval · rollback available

Tool names follow the systems they protect. A held tool call returns a clear reason instead of an error, so the agent can wait, adapt or move on. When a run is contained, further calls are refused with the reason, and the agent is told to stop.

02 · protected actions

What a protected action is

Each tool corresponds to one operation in one system, with a known recoverability.

Reversible: Field updates and creations that can be restored or removed, with the before-state captured first.
Compensatable: Operations with a compensating action rather than an inverse, such as cancellations and inventory adjustments.
Irreversible: Sends, refunds, captures. Recorded and policed; never pretended to be undoable.
Identity and idempotency: Every call carries an idempotency key, and agents may pass their own, so a retried call never repeats a mutation.

03 · policy

Policy, approvals, containment

The organisation sets what runs on its own. The agent never decides that for itself.

Policies are expressed by reversibility class and refined per action: refunds above an amount need approval, sends to customers always do, notes never do. Guards catch anomalies against the organisation’s own history. Containment rules stop a run on repeated rejections, repeated anomalies, action rate or cumulative exposure. Every decision, human or automatic, is on the run’s record.

04 · agent lab

Build and test agents in a sandbox

Agent Lab runs real models against protected tools, with sandbox systems when you do not want to touch production.

Define an agent (system prompt, model, tool access, policy), give it a task, and watch each tool call become a step: held, approved, executed, rolled back. Scenarios with deliberate faults show how a wrong amount or a runaway loop is held and contained before it lands. Move the same agent to live systems when you are ready; nothing about its tools changes.

05 · runs and recovery

Runs are the unit

Everything Verundo does is attached to a run: a named sequence of actions by one agent with one intent.

Run record: Every action with its inputs, what it changed, who approved what, and every external change observed since.
Rollback plan: Before recovery, a plan states per action what will be restored, compensated or left, with a confidence per action.
Verification: After recovery, each system is re-read. Verified means the state matches, not that a request returned OK.
Realtime and polling: Verundo watches touched objects while runs are open and, where systems can notify, in realtime.

Protect your first agent.

Request pilot Read about the lifecycle