ApprovalLens

• 

Inspiration

Your AI coding agent says it fixed the bug. What else did it change?

AI coding agents can modify a project in seconds. Reviewing those changes—and understanding their consequences—takes longer. An approval prompt may ask for permission without giving developers enough context to make an informed decision.

A proposed fix could restore functionality while weakening authentication or changing where data is sent. A convincing explanation is not enough.

ApprovalLens started with a simple idea: developers should see evidence before giving permission.

What it does

ApprovalLens is a Cursor extension that helps developers review sensitive AI coding-agent actions before they execute.

It combines three layers:

• Developer-owned rules define which supported operations are permitted and which boundaries must be preserved.
• File evidence helps explain the effects of a proposed action.
• NVIDIA Nemotron on Nebius Token Factory provides an advisory review for eligible actions.

Hard policy violations are blocked locally. Eligible sensitive actions pause while the developer reviews the findings and approves or rejects the operation.

Your rules set the boundaries. AI provides a second opinion. You decide.

ApprovalLens can also use Nemotron to suggest file-permission rules from a previewed project inventory. These suggestions remain drafts until the developer reviews and explicitly applies them.

What the demo shows

The demo uses a local Security Lab with synthetic data to illustrate two approval scenarios:

• Protecting authentication through a locally enforced rule.
• Reviewing a proposed upload-destination change before deciding whether it should proceed.

These scenarios demonstrate why a successful “fix” should be judged by its consequences, not just whether an error disappears.

How it was built

ApprovalLens is built with TypeScript, a Cursor extension, a bundled local companion, and Model Context Protocol services.

Cursor hooks connect supported agent operations to the local companion. The companion checks the applied rules and collects evidence before deciding whether an action can proceed, must be blocked, or needs review.

For eligible hosted reviews, an authenticated service calls NVIDIA Nemotron through Nebius Token Factory using the model identifier nvidia/nemotron-3-super-120b-a12b. Task-specific prompts and structured JSON responses make the findings usable within the approval workflow.

Model responses are validated before they are presented. Before allowing an approved operation to continue, ApprovalLens rechecks relevant file state.

Nebius Token Factory provided managed model inference, allowing development to focus on the review workflow without operating GPU infrastructure. Next.js and React power the website, with the hosted MCP route deployed on Vercel.

Challenges

The central challenge was keeping policy enforcement, model advice, and human approval separate. A model recommendation must never become an execution grant or override a developer’s rules.

Another challenge was making sure the reviewed evidence still matched the operation at approval time. File-state checks help prevent approval from relying on an outdated view.

Handling incomplete evidence, unsupported operations, timeouts, and invalid model responses also required explicit behavior. A security-focused tool must communicate when it cannot confidently review an action.

Accomplishments

ApprovalLens brings local policy checks, hosted model reviews, and human decisions into an installable editor extension.

The project includes bundled setup, editable permissions, approval dialogs, activity grouped by chat, and a reproducible Security Lab. It also includes open-source code, setup instructions, and a judge walkthrough.

Most importantly, the workflow preserves a clear boundary: the model advises; it does not authorize.

What I learned

Building ApprovalLens showed me that useful AI oversight requires more than asking another model whether an action is safe. It requires relevant evidence, enforceable rules, understandable findings, and a clear decision point.

I gained practical experience connecting editor hooks, local services, MCP, structured model responses, and hosted inference. I also learned to distinguish functional test coverage from demonstrated security accuracy.

What's next

Next steps include broader operation coverage, easier onboarding, clearer evidence displays, and independent evaluation of false positives and missed risks.

The current beta focuses on supported operations in single-folder local projects on macOS and Linux. It does not claim to intercept every agent tool or act as an operating-system sandbox.

The goal is to make informed approval a natural part of working with AI coding agents.

ApprovalLens — Proof before permission.

Built With

• cursor
• model-context-protocol
• nebius-token-factory
• next.js
• node.js
• nvidia-nemotron
• react
• typescript
• vercel
• vitest
• zod