withHuman

About withHuman

withHuman is an open-source approval layer that intercepts AI agent tool calls before execution. It applies user-defined rules to automatically approve or deny routine actions, routing higher-risk calls to designated team members for manual review. The tool works with Claude Code, Codex, and agents built using LangGraph, Pydantic AI, and other frameworks through an open specification called the Agent Approval Protocol (AAP).

Review

withHuman addresses a practical gap that teams encounter when moving AI agents from development to production: controlling what actions agents can take without building separate approval flows for each one. The tool sits between an agent and its tools, intercepting calls and enforcing rules before anything runs. A hosted version is available alongside the open-source codebase, and the makers have published the AAP as an open spec so others can build integrations against it.

Key Features

• Agent Approval Protocol (AAP) - An open specification with prebuilt hooks for Claude Code and Codex, plus SDKs for Python and TypeScript. Agents communicate through this protocol, and the team states that agents cannot bypass the approval step.
• Rule-based automated decisions - Users write rules that approve or deny tool calls based on conditions like tool name, parameters, or thresholds. For example, a rule can auto-approve Stripe refunds under $5 while escalating larger amounts.
• Human approval routing - When a call doesn't match an automated rule, it goes to a human reviewer. The system shows the full tool call arguments, and the agent can supply additional context.
• LLM Judge - An optional component backed by OpenAI and Claude models that can assist with approval decisions. The makers describe this as a feature within the hosted version.
• Cross-agent rule set - A single set of rules governs every agent connected to withHuman, rather than configuring approvals separately for each one.

Pricing and Value

The hosted version includes a free plan. A paid tier called Scale exists, and the makers are offering three months of Scale free with the code PRODUCTHUNT, valid through the Friday of launch week. Exact pricing for the Scale plan beyond the promotion period is not detailed in the available materials. The open-source version can be self-hosted, and the makers note that if withHuman becomes unreachable, tool calls fail by design - they chose a conservative default rather than allowing calls to proceed unapproved.

Pros

• Prebuilt hooks for Claude Code and Codex mean existing coding agents can connect in minutes via the Quickstart flow.
• Rules use straightforward conditional logic, so teams don't need to learn a specialized DSL to configure automated approvals.
• Open-sourcing the AAP invites third-party integrations and alternative implementations, reducing lock-in risk.
• Self-hosting is possible for teams with strict data residency or uptime requirements.
• The makers openly discuss what isn't finished yet - reviewer context enrichment and gating for non-MCP calls are documented as active work.

Cons

• Reviewer context is still limited. A tool call containing opaque identifiers like user UUIDs won't yet resolve to human-readable labels, which the makers acknowledge they are working to improve.
• If the withHuman service goes down, tool calls fail rather than falling back to a permissive state. This is a deliberate security choice, but it means the service becomes a hard dependency for agent operations.
• Teams running agents that don't use MCP-based tool calls will find gating unsupported for those paths right now - this is on the roadmap, not available today.

withHuman fits teams that already have AI agents performing consequential actions and want a centralized approval layer without rewriting their existing setups. It's less suited for teams whose agents handle only read-only or low-risk operations where the overhead of intercepting every tool call outweighs the control gained. The open protocol and self-hosting option make it adaptable, though anyone adopting it now should plan around the context limitations and the hard-fail behavior when the service is unreachable.