Phinq put a bouncer in front of every AI action. The bouncer has no ID check.

"Phinq records the approval identifier, but does not currently verify the real-world identity behind it." 1

That sentence is the whole product in miniature. Phinq puts a checkpoint between an AI agent and the tool it wants to call. It can stop a delete, credential read, payment, or bulk send before execution. Then it asks a human to approve the action through a CLI, Telegram, or Slack button. The safety boundary is structural. The person behind the button is still mostly a username. Product Hunt currently labels Phinq's listing "Launching today," making this a launch-day product rather than a recycled agent wrapper. 2

Phinq is an open-source runtime governance layer. It intercepts an agent's tool call, looks at the tool name, arguments, and session velocity, classifies the action, and returns ALLOW or HOLD. A held action waits in a queue. Approval releases it. Denial or timeout blocks it. 3

The pitch is easy to understand because the mechanism is easy to draw:

That is a better design than telling the model to "be careful." A prompt is advice. A proxy can refuse to forward the request. Phinq's claim that governance should be structural is one of the few pieces of agent marketing that survives contact with the architecture. 1

Product Hunt lists Phinq as free, and both the product site and repository describe it as MIT-licensed open source. 25 There is no public hosted-plan price to compare because the hosted layer is still described as future functionality. The site asks interested teams to join a list for hosted policy controls and team workflows. 1

The current cost is therefore paid in setup and operations. The quick start is npx @phinq/phinq; the wizard detects agents such as Claude Code, Codex, Gemini CLI, Hermes, and MCP, then starts in watch-only mode. Enforcement requires configuration. A proxy from source listens on 127.0.0.1:5100, and the existing provider API key passes through the Authorization header without being stored or logged by the proxy. 5

That is a reasonable developer experience for a single operator. A team has more homework. Telegram approval needs a bot token and chat ID. Slack approval needs bot and app tokens, a channel, Socket Mode, interactivity, and optional operator IDs. The default hold timeout is 240 seconds. 5 The software is free; the approval channel, token handling, policy calibration, and on-call attention are not.

Phinq's audit chain records intent, classification, decisions, hold transitions, and usage metadata. Each entry is canonicalized with JCS and chained using SHA-256. Editing, reordering, or deleting an entry breaks verification. 4

Then comes the small sentence that matters more than the cryptography: arguments and message payloads are not in the audit chain. A separate phinq-toolcalls.jsonl corpus may contain tool-call arguments, and that corpus is not hash-chained. 4

So the product gives you a verifiable record that an action was classified and held. It does not automatically give you a verifiable record of every byte the agent wanted to send. That is a sensible privacy boundary, but it means an incident review still depends on how the operator stores, protects, and correlates the second file.

The same split appears in identity. Phinq records an approval identifier, but its homepage says it does not currently verify the real-world identity behind that identifier. 1 In a personal setup, that may mean "the owner tapped approve." In a company, it means the approval channel and its account controls become part of the security model. The gate can stop the agent. It cannot, by itself, prove that the right human opened it.

The ingredients are old and sensible: inspect a request before execution, hold high-impact actions, fail closed on timeout, and retain an audit trail. Phinq's useful idea is to package those controls around the tool-call boundary that agent systems keep trying to blur. It supports proxy, SDK, and plain HTTP paths, plus OpenAI, Anthropic, Gemini, MCP, and common agent frameworks. 15

The catch is that a checkpoint creates work exactly where the demo wants autonomy. Someone must decide which actions are safe. Someone must tune thresholds so routine work does not produce false holds. Someone must respond within the timeout. Someone must secure the Telegram or Slack account. And someone must review the tool-call corpus when the audit chain says an action happened but does not preserve its arguments.

Phinq tries to reduce that burden with velocity rules, token budgets, replay, and precedent. A session that exceeds its token budget can be checkpointed. Repeated human decisions can become cited policy proposals. The product may get quieter as it observes more evidence. But that improvement depends on the organization generating enough good decisions to teach the policy, and on a human still deciding when a proposed relaxation is safe. 5

Phinq is one of the more honest agent products because it admits that autonomy needs a bouncer. Its local, MIT-licensed core can make dangerous tool calls pause before they reach a payment API, filesystem, credential store, or outbound messaging system, and its audit chain gives teams a way to verify the decision history. 15 But the product's free price hides an operator bill: you supply the proxy deployment, approval accounts, identity controls, policy tuning, and storage for the unchained call corpus. Use it for personal agents or small teams that can own that plumbing. For a larger organization, Phinq is a useful enforcement layer waiting for the boring parts of governance to become product features. The checkpoint is real. The person pressing the button is still an unverified API client.