Runtime governance and
observability for agents.
Policy enforcement and real-time observability for every agent you run. Every tool call governed, every session recorded, every action traceable.
One policy, every agent.
Write one policy. Latch enforces it across every agent. Per-session scoping lets you lock down production repos while keeping prototyping permissive. Tool-level control. Glob-based file blocking. A local authorization server evaluates every call before it runs.
See everything.
Every tool call classified by risk and recorded with its policy decision. Real-time activity feed. Full conversation replay with inline code diffs and token cost breakdowns. Z-score anomaly detection flags volume spikes and novel tool usage.
Isolation by default.
Each session gets its own git worktree and branch. Ten agents, one repo, zero conflicts. A local egress proxy gates all network traffic with domain allowlists and credential injection. Docker, macOS Seatbelt, or Linux Bubblewrap sandboxes.
Your agent calls a tool.
Latch decides if it runs.
Your agents run in real PTY shells. When one calls a tool, the request hits a local authorization server first. Eight evaluation layers. Rate limiting, permission flags, tool rules, MCP rules, command rules, blocked globs, destructive action confirmation, and an LLM evaluator for ambiguous cases.
First deny wins. Millisecond latency. The agent gets faster, safer answers without knowing the difference.
Egress proxy and process sandbox.
A local HTTP proxy becomes the agent's only network exit. Every request logged. Unknown domains blocked. Credentials injected at the proxy layer, never in the environment. Data tier enforcement classifies services as public, internal, confidential, or restricted.
The agent shell runs in a kernel-enforced sandbox. Three backends auto-detected: Docker, macOS Seatbelt, or Linux Bubblewrap. Add service credentials mid-session without restarting.
Service catalog and secret injection.
Configure services in the catalog. Latch injects the right credentials into each session as environment variables. The agent gets GITHUB_TOKEN and ANTHROPIC_API_KEY without seeing raw values in prompts or logs.
14 pre-configured integrations. 1Password references resolved at runtime via the CLI. Local secrets encrypted with Electron's safeStorage (OS keychain). Per-session scoping controls which services each agent can access.
Full playback.
Every turn, every diff.
Structured conversations with tool calls, file diffs, and policy decisions inline. Click any turn to see exactly what changed and what it cost.
Git-based checkpoints after every file write. Fork or rewind to any point. Token usage and cost breakdowns per turn. Export to JSON for external analysis.
Z-score anomaly detection.
Radar runs z-score analysis against a rolling window of your agent's behavior. Traffic volume spikes 4x. An agent touches a tool it's never used. Deny rate jumps from 2% to 23%. Checks run every 30 seconds and after every 10 events.
The baseline adapts as patterns change. Five signal types: volume spikes, novel tool access, error rate surges, denial rate changes, and high-risk activity bursts.
{
"session_id": "sess_a3f8b2c1",
"policy_hash": "sha256:e4d909c290b0fb...",
"harness": "claude-code",
"branch": "latch/auth-flow-a3f8",
"services": ["github.com", "registry.npmjs.org"],
"tool_calls": 142,
"denied": 3,
"merkle_root": "sha256:7f1a92d4e8...",
"signature": "ed25519:Kx9mP2qRvN...",
"pr": "#847"
}Ed25519-signed session receipts.
When a session ends, Latch generates an Ed25519-signed receipt. Policy hash, Merkle root of the audit log, full activity summary, sandbox type, and a cryptographic signature over all of it.
Paste a GitHub PR URL and Latch posts the receipt as a PR comment. Inclusion proofs let you verify individual events against the Merkle tree.
Register once, sync everywhere.
Register your MCP servers and skills once. When a session starts, Latch writes the right config for your harness. Claude Code, Codex, Cursor, Amp, Gemini, Kiro, Windsurf. Secrets resolved at runtime. Credentials never touch disk.
Target specific harnesses or broadcast to all. Introspect tools from any registered MCP server. Skill files tell the agent what services are available and under what constraints.
Everything else.
Session isolation
Dedicated git worktree per session on its own branch. Ten agents in parallel, separate policies, independent logs, zero conflicts. Name sessions, set goals, pause and resume.
Conversation replay
Turn-by-turn timeline with inline code diffs. Git checkpoints after every file write. Fork or rollback to any point. Token usage and cost breakdowns per turn.
Budget enforcement
Per-session token and cost limits. Daily project budgets. Real-time tracking in the topbar. Warnings at 80%, hard stops at 100%.
Issue tracking
Pull GitHub and Linear issues into Latch. Start a session from an issue. Update status when the agent finishes.
Service catalog
14 pre-configured integrations: GitHub, npm, OpenAI, Anthropic, Vercel, Slack, Linear, Groq, and more. Per-session scoping.
1Password
Reference op://vault/item/field URIs. Resolved at runtime via the 1Password CLI. Keys never touch the database. Local secrets use OS keychain.
Multi-harness
Claude Code, Codex, OpenCode in one app. Unified sessions. Consistent policy enforcement. Tab-based multi-agent.
Real PTY shells
Native pseudo-terminals. Your agent runs in the same environment as your normal terminal. Governance layered on top.
Leak detection
Entropy analysis and pattern matching catch AWS keys, GitHub tokens, and private keys before they leave the session.