GraphARC

Community

The admission gate for agent graphs, built on LangGraph

★ 69 Stars Category · Dev Tools Popular

61FMRS · C

GraphARC (version 0.1.7, MIT licence) is a governed multi-node graph runtime built on LangGraph whose core claim is the admission gate: graphs are proposed at runtime and a deterministic checker admits or refuses them with reasons based on registry, policy, remaining budget, depth and acyclicity, and only admitted graphs execute. It emphasizes worst-case pricing before a run plus per-node billing after, a single replayable JSONL trace, and a supervised Slack flow where execution starts only after a human approves. The default backend drives the claude CLI on your PATH with no API key, with openrouter, openai, ollama and server backends as extras. The README documents its edges: arguments are validated only when a kind declares an args_schema, the in-process sandbox is defense in depth with unconfined run_command children, the HTTP API lacks the durable session layer, agent nodes on the Claude CLI backend are delegated rather than governed, the tool plane still reads CLI flags, and the MCP gate binds the MCP surface rather than the host. It suits teams needing deterministic admission and auditable cost control, and is not for those treating it as a general personal assistant or expecting undeclared full sandboxing and argument governance.

Reliability

10/20

Security and permissions

10/20

Maintenance

14/20

Documentation

15/20

Setup experience

12/20

Read the FMRS scoring method →

GraphARC is a governed multi-node graph runtime built on LangGraph. A model proposes a graph of work at runtime; a deterministic checker covering the registry, policy, remaining budget, depth and acyclicity admits it or refuses it with reasons; only admitted graphs execute, under budgets, onto one replayable JSONL trace. No step runs unadmitted, the worst case is priced before a run and billed per node after, and the dashboard cannot disagree with the audit trail because they are the same file. It ships CLI commands (start, init, plan, go, serve, replay, demo), a Python API for building graphs directly with typed state, declared writes and a required budget, and a supervised Claude Code workflow from Slack where the bot replies with the proposed graph plus Approve/Deny buttons and nothing executes until a human presses one. The default backend drives the claude CLI on your PATH (a Claude subscription, no API key), with openrouter, openai, ollama and server backends as extras.

Setup

Requires Python 3.12 or newer.

Install with pip install grapharc.
Verify with grapharc demo stage0: it costs nothing and needs no key.
Run grapharc start for the guided tour.
Run grapharc init to scaffold registry.py and grapharc.toml.
Optional: install backend extras grapharc[openrouter], grapharc[openai], grapharc[ollama], grapharc[server] or grapharc[all]; the default backend drives the claude CLI on your PATH.
Propose and save a plan with grapharc plan "..." --model ollama/qwen3:8b, then execute with grapharc go; grapharc plan "..." --scripted is a free rehearsal with no AI involved.
Watch runs live with grapharc serve --live-root .grapharc/runs, and reconstruct a run with grapharc replay <trace> <run-id>.

Fit and risk

Best for

Teams that need agent workflows under deterministic admission and policy constraints
Scenarios requiring worst-case pricing before execution and per-node cost attribution after
Compliance or investigation workflows needing one replayable audit trace where the dashboard and the audit trail are the same file
Organizations that want a human to press a button before execution starts, for example from Slack
Developers who want deterministic, reproducible demos and tests on any checkout via `--scripted`

Not for

Those who only need an interactive single-agent loop without pre-execution authorization
Anyone looking for a general personal AI assistant gateway or a tool configured by allowlists
Users expecting node arguments to be fully validated: admission authorises a node's kind, arguments are checked only where the kind declares an args_schema, and a schema bounds their shape, not what a factory lets them reach
Scenarios requiring the HTTP API to use a durable session layer, or the tool plane to be governed by policy documents instead of CLI flags
Users who need agent nodes on the Claude CLI backend to be fully governed: by default they run under an allowlist mapped from the node's own tools, but enforcement there is Claude Code's, and the explicit bypass tier has no checks at all

Required permissions

The default backend drives the claude CLI on your PATH (a Claude subscription, no API key)
Node bodies come from the registry, never from a proposal; the registry is the source of the kinds a planner may propose
Policy decides what the planner is able to propose: a denied edge changes the shape of the graph rather than producing a refusal to retry
The MCP gate binds the MCP surface, not the host: an agent with its own file tools in the run directory could forge the approval decision, and the trust boundary is the working directory
run_command children are unconfined
ContainerExecutor is the real boundary; the in-process sandbox is defense in depth

Risks and side effects

Admission authorises a node's kind; arguments are validated only where the kind declares an args_schema, and a schema bounds their shape rather than what a factory lets them reach
The in-process sandbox is defense in depth, run_command children are unconfined, and ContainerExecutor is the real boundary when explicitly used
The HTTP API does not yet use the durable session layer
On the Claude CLI backend an agent node is delegated, not governed: by default it runs under an allowlist mapped from the node's own tools, but enforcement is Claude Code's, and the bypass tier has no checks at all
Policy documents govern planning while the tool plane still reads CLI flags
The MCP gate binds the MCP surface, not the host: an agent with its own file tools in the run directory could forge the approval decision; the trust boundary is the working directory, as it is for the Slack workspace

Troubleshooting

Confirm Python is 3.12 or newer, otherwise the pip install will fail
Verify first with `grapharc demo stage0` and `grapharc plan "..." --scripted`: both are free and need no key, which rules out model and credential problems
If planning is repeatedly rejected, read the structured rejection feedback codes (for example edge_denied); the planner replans against them
The default backend needs the claude CLI on your PATH; install the matching extra (openrouter, openai, ollama, server, all) to use another backend
Check configuration from the run output: it prints goal, model, registry, kinds, policy and config (whether grapharc.toml was read)
To review a run, use `grapharc replay <trace> <run-id>` to reconstruct it from its trace; the dashboard and the audit trail are the same file
Examples on the page are executed by tests/test_readme.py against every commit, so use that to locate drift if the docs and code disagree

Use cases

Propose a graph of work at runtime and have a deterministic admission checker admit it or refuse it with reasons

Price the worst case before a run and bill per node after, with fail-closed cost control

Keep one replayable JSONL trace per run and reconstruct runs from it

Ask for work from Slack, get the proposed graph plus Approve/Deny buttons, and let a human start execution

Rehearse planning and admission for free and deterministically with `--scripted`, no AI or key needed

Compare success, cost, wall time and policy violations against third-party agents on the same tasks

Related MCP servers

Compare with other MCP servers