Generate agents proven to follow your rules.
Most agents fail silently: fabricated results, skipped confirmations, data crossing between customers. From one sentence and your tools, looprun turns your rules into guards — deterministic checks in code. Each agent ships measured, safe to leave alone with your customers.
✓ Zero rule violations with guards on
A demo that works is not an agent you can trust.
The failures that hurt are not crashes. They are confident answers that are wrong. We ran NN models on the same tasks. Without guards, the agents:
These failures are not rare. They are the default when nothing enforces the rules.
Two commands. Then one sentence.
Install the looprun engine and add the looprun skill to your coding agent. Then describe your agent's business in one sentence. The skill does the rest.
looprun on GitHub$ npm i looprun $ npx skills add looprun-ai/looprun -g # inside your coding agent: /looprun Support agent for Atlas, an equipment-rental company: orders, refunds and exchanges.
What comes out is a LoopRunAgent — not a general-purpose agent that can do anything. It acts only on the tools you approved, and on nothing else. The guards also control how each tool may be called: amounts, order, ownership, confirmation.
// the generated agent — yours, in your repo import { LoopRunAgent } from 'looprun/mastra' // or /vercel, /langchain const agent = new LoopRunAgent({ spec: atlasSpec, // persona, guards, rules world: () => new AtlasWorld(), toolDefs: tools, // only the tools you approved model: 'any-certified-model', // one-line swap }) const reply = await agent.generate('My drill never arrived. Refund me.', { loopRun: { sessionId: 'customer-42' }, })
Need help? Tell us what you need: contact@looprun.ai
You describe it and review it. The skill builds, tests and certifies.
The looprun skill runs six steps, one letter each: A·G·E·N·T·S.
Ask.
You describe the business in one sentence and list the tools the agent may use. If you have no list, the skill proposes one.
Gen.
The skill builds the simulated backend — a safe copy of your systems. Every test runs against the copy and repeats exactly.
Exam.
The skill writes the exam before the guards exist. Nothing about the guards can shape the questions.
Norms.
Your rules become guards: checks in code that run on every call.
Test.
Reviewers attack the agent on purpose. Then every exam case runs twice — with guards and without — on every target model. The skill fixes what fails and measures again.
Ship.
The skill certifies each agent and seals the files. You receive a governed LoopRunAgent per target model — governed means the engine enforces the guards, instead of the prompt asking for them. You also get the unguarded twin: the same agent without the guards.
You sign off twice. Nothing ships without both signatures.
The finished agent is not a script: the model — the AI that reads and writes the replies — decides every step, and guards can only block. When a guard blocks a call, the model is told why and chooses another path. The agent must also state what it did. Code checks that against what really ran. Anything it cannot back is never sent. The guards run unchanged in production: the same checks, against your real tools.
Not a prompt. A governed agent, with everything that proves it.
Rules change. Edit the spec and run the skill again — it retests, recertifies and reseals. The seal protects a version. It does not freeze your project.
Everything is yours. Everything is measured.
Six properties that hold under attack.
They see the whole conversation, the tool call, the state and the record. To a guard, text is evidence — never an instruction. A prompt injection can fool the model. It still cannot move the guard. The check is plain code — microseconds on every call. Only a block costs more: one extra model turn to choose another path.
The looprun skill writes the system prompt, runs the exam, and rewrites until the agent passes. Nobody on your team edits prompts by hand.
Every exam case also runs on the unguarded twin — the same agent without the guards. One case where a guard makes the agent worse blocks the release.
At startup the agent compares its tools to the certified fingerprint. If anything changed, the agent refuses to run. Editing any certified file voids the seal.
The agent must state what it did — a refund, an amount, an order. Code checks that against what really ran. Anything it cannot back is never sent.
You keep one set of guards. The skill tunes and certifies one variant per target model. Switching models is a one-line change.
Same models. Same tasks. looprun is the only difference.
Score = exam pass rate, 0–100.
With guards on, a failed case is a task the agent refused or could not finish. It is never a broken rule. The score measures completion. Violations are counted separately — and that count is zero. When the agent cannot finish, it stops and says what it did and did not do. Where those cases go next is yours to decide: a person, a queue, or a retry.
| Model | ✕ Unguarded | ✓ Guarded | Gain | worst run of 3 · shared scale |
|---|---|---|---|---|
| Model A | 62.4 | 91.2 | +28.8 | |
| Model B | 71.0 | 93.5 | +22.5 | |
| Model C | 66.8 | 90.1 | +23.3 | |
| Model D ▲ weakest model | 58.9 | 89.4 | +30.5 | |
| Model E | 60.2 | 92.0 | +31.8 |
Averages hide bad runs — we never use them. There is no combined row: each model must pass on its own.
How we ran it: 61 test cases, three runs per model, at Atlas — a fictional equipment-rental company with 5 agents and 54 tools.
- Zero rule violations with guards on — without guards, the agents broke rules in NN kinds of tasks.
- Zero cases where a guard made the agent worse. We measure that too, and it must be zero.
- The gap is widest on the cheapest models — exactly where the worst failures happen.
The exam was written before the guards existed. The judge never sees which agent answered. Every run — and its cost — is public. Rerun it yourself: see the public benchmark → looprun-bench. One honest note: the judge is a model; the guards are not.
Every score is a band. The guards narrow it — and raise the floor.
Run the same agent three times without guards, changing nothing, and the score swings up to ±NN points. With guards, the swing is ±NN. We certify at the worst of the three runs, never at the best. You can't certify what you can't reproduce.
One agent, many certified models. Even on your own hardware.
Model contingency. The AgentSpec names no model. Every row in the evidence table is a model you can switch to. If a provider retires a model, raises prices, or has an outage, you switch. You cannot see a provider change a model from the outside. That is what the exam is for: it ships with the agent, so you rerun it whenever you want and see if anything moved.
The running agent: fully on-prem. With a local model, the whole agent runs on your machines: model, guards, tools, state. Nothing leaves your network. That matters where data can't leave: health, legal, finance, government.
Who this is for
✓ For
Teams putting agents into production where a wrong action costs money. Support that moves money, operations, anything serving several customers. The agent may serve your staff or your customers. Building agents for clients? The exam and the benchmark ship under your name.
Not for everyone
One-off automations, coding agents, and processes you can write out step by step — a plain workflow beats us there.