Remy

• 

  Homepage

• 

  Agent Activity

Inspiration

AI agents are becoming capable of changing real application state, but the current trust model feels broken. Users either approve every small action, making the agent slow and irritating, or grant broad autonomy and inspect the damage afterwards.

Remy explores a middle ground: let reversible work happen automatically, pause consequential actions for explicit approval, and give users a clear record of what happened and a way back when possible.

What it does

Remy is a protocol-neutral action layer for applications that allow AI agents to take real actions.

Developers define an action once, including what it changes, its risk, and how it can be recovered. Remy then provides:

• Runtime validation and action previews
• Developer policies and user-selected autonomy
• Explicit approval for consequential actions
• Human-readable receipts and diffs
• Append-only action history
• Exact undo, compensation, or an honest irreversible state

The demo is a fictional headphone shop using WebMCP. An agent can add headphones, select delivery, and apply a discount automatically. Placing the order spends money, so Remy pauses and presents the exact item, price, address, and payment method for the user to approve.

How we built it

Remy’s core is a TypeScript action engine that does not depend on React or WebMCP. Every semantic action passes through the same validation, preview, policy, execution, receipt, and recovery pipeline.

A WebMCP adapter exposes those actions as page-scoped tools. The shop’s normal interface and its WebMCP tools use the same underlying engine, keeping policy enforcement beside the application’s business logic.

The demo uses Next.js, React, TypeScript, Zod, Tailwind CSS, Motion, and Vitest. State and receipts are persisted locally for the challenge demonstrator. I also built an alpha initializer that scaffolds Remy into a Next.js application.

Challenges we ran into

The hardest problem was making approval a real enforcement boundary rather than an instruction in a prompt. If an agent is merely told to wait, it may continue through another interaction path. The restriction therefore has to be enforced where the final state change occurs.

Approval is also asynchronous, while agent tool calls may be short-lived. Remy represents approval as pending application state and revalidates the authoritative data before execution.

Recovery introduced another challenge. Some changes can be undone exactly, some require a new compensating action, and others are genuinely irreversible. Remy needed to represent each case honestly without pretending that every action has an undo button.

Accomplishments that we're proud of

The working demo shows useful autonomy rather than simply approving or blocking everything. Reversible shopping actions can execute automatically, while the irreversible purchase stops for explicit approval.

An agent cannot grant itself greater autonomy. Every attempt produces a readable receipt, duplicate effects are prevented with idempotency keys, stale approvals are invalidated, and reversals remain linked to the original action instead of erasing history.

The same semantic action definitions power the normal website, the WebMCP tools, the policy engine, receipts, and recovery.

What we learned

Action history by itself is only observability. A receipt written after an unsafe mutation cannot protect the user. The action layer must make its decision before execution and remain on the path to the real state change.

We also learned that reversibility is a useful basis for autonomy. Users should not need to approve harmless work that can be safely reversed, but consequential or irreversible actions deserve a clear checkpoint.

Finally, WebMCP works well as an adapter, but the underlying action contract should remain protocol-neutral so the same guarantees can follow an action across different agent environments.

What's next for Remy

The next steps are publishing the core SDK and initializer, adding MCP and agent SDK adapters, and moving histories from local storage to a durable hosted journal.

Future versions could add authenticated agent identity, approval routing, shared policies, monitoring, alerts, signed receipts, and evidence exports while allowing applications to keep their own interface and business logic.

Built With

• nextjs
• typescript