CTRLRun: execution safety for consequential GitHub MCP actions

[arpanghoshal]

I've been building CTRLRun, an open-source execution safety layer for AI agents, and GitHub MCP feels like a good example of why I built it.

Once an agent can merge PRs, push files, modify repositories, or trigger other write actions, I think the question goes beyond:

"Is this tool allowed?"

It becomes:

• Was this exact action approved?
• Did this effect already happen?
• Is it safe to retry?
• Can we prove what actually executed?

CTRLRun can sit in front of an MCP server as a gateway without requiring changes to the agent or the MCP server.

It focuses on things like:

• exact approval binding
• duplicate-effect protection
• ambiguous execution handling
• execution receipts
• runtime policy enforcement

I'd really like feedback from people using GitHub MCP:

Which GitHub write actions would you put behind controls like this first?

Also, if anyone is interested in MCP security, agent runtime safety, or contributing to this problem space, contributions and ideas are very welcome.

https://github.com/CTRLRun/ctrlrun