#Start Here

AI and automation now move money, trigger workflows, and change real systems on their own. Anvil is the safety layer in front of those actions — it _prevents costly damage, enforces your rules, and proves what happened._

Put it in front of a payment, a refund, an agent's tool call — any action where "oops" has a real cost. It watches first; the day you flip it on, the worst version of that call stops before it lands.

#The problem

Software has always been able to do irreversible things. Now it does them on its own — and when it goes wrong, it goes wrong in the real world, not a staging table. Three things are suddenly at stake, and every one is expensive:

• Money you can't get back. One bad action drains real dollars before anyone notices.
• Rules that don't actually hold. The limits, approvals, and data boundaries you're accountable for live in prompts, docs, and people's heads — nowhere near the moment the action fires.
• Damage you can't explain. Something happens, and you can't prove what it was, whether a rule was followed, or that it's handled — not to a customer, an auditor, or your own board.

#What Anvil does

Wrap a risky action and Anvil does three things — automatically, every time.

#Prevent costly damage

Bad actions stop before they land. A runaway process, a mistaken charge, a payout that never should have gone out — caught the instant it tries to happen, not found in the postmortem. The expensive mistake never reaches the real world.

#Enforce your rules

Your limits and approvals, applied to every call — not sitting in a policy doc nobody runs. Spending caps, human sign-off on the big and irreversible moves, where data is allowed to go: the controls you're accountable for hold on their own.

#Prove what happened

A receipt for every action — what happened, and that your rules were followed. When a customer, an auditor, or your board asks, you show the log instead of scrambling. Turn on signing and it's tamper-evident: proof, not a promise.

#Try it before you trust it

You never bolt a blocker onto production and hope. anvil protect starts you in ghost mode — it watches every real call and shows you exactly what it _would_ have caught, while changing nothing. A week of _"here's what we'd have stopped"_ against live traffic, then you flip it on, one action at a time, when the proof is obvious. (Wiring the SDK by hand on your own plane instead? A fresh self-hosted install enforces — see Default mode.)

Watch, then enforce. That's how a guardrail earns its place in front of your money.

#Why teams put it in

• You can finally ship it. The automation you've been too nervous to put in production — agents touching real systems, money moving without a human in the loop — becomes something you can actually deploy.
• You're covered when it's questioned. A security review, an audit, a customer asking "what happened here" — you answer with receipts instead of a scramble.
• It costs an afternoon. One line around a call, observing first. Nothing to rearchitect, nothing at risk while you watch.
• And it costs nothing yet. Anvil is free during the beta — every tier, no paywall. Paid tiers come later; pricing is where that lands when it does.

#How it fits (when you're ready)

You don't rearchitect anything. Anvil drops into the JavaScript or TypeScript service you already run, on Node 20 or newer. Most teams wrap the risky call with one function; for the common money calls you can add a single flag to your start command instead and skip the edit entirely. Either way nothing else about your app moves, and both paths land in the same dashboard.

Those two together are what makes a retry safe: coordination stops a second attempt starting while the first is in flight, and the durable record is what a retry reads after a restart. The precise promise — and the one case where Anvil answers "I don't know" instead of "already done" — is the guarantee. It is worth two minutes before you put this in front of money.

What it adds to your call. Ghost can never delay your real call: the observation runs on a 50 ms budget, alongside the call rather than in front of it, and blowing that budget degrades the observation instead of your call. Enforce is two round trips at five seconds each — claim the key before, record the outcome after. The three fears has the full accounting.

What crosses the wire. The facts a decision needs: the action name, the mode your process declares, the dedup key, the amount and currency, the service and workflow, and any metadata you choose to pass. Not your arguments, and not your return values — your execute() runs inside your process, and only the verdict comes back. Anvil decides whether a call may happen without seeing what the call contains.

What happens if Anvil is down? An enforcing call is held, not quietly let through. The fail mode defaults to closed, so a call Anvil cannot evaluate is refused rather than run unprotected — the right default for money, and the wrong one if you would rather take the risk than the downtime. So it is yours to change: graceful holds only the money calls and lets everything else through, open lets everything through. Whichever you pick, a degraded call is never silently unprotected — each one is recorded as exactly that, so "how many calls ran unguarded today?" has an answer. Fail mode has the table.

The dashboard is your control plane: the SDK reads it on the hot path of every guarded call, so you flip an action to enforce — or hit the kill switch — without redeploying. Budget about eight seconds for a flip to reach every process — the plane's own snapshot cache, then each SDK process's. No deploy, no restart, no coordination. It's also where your team reviews and approves the actions Anvil holds for a human. You get one workspace, created the moment you sign in, and each machine joins it with anvil login — so your laptop, your editor, and your dashboard are all looking at the same actions.

#Where to go next

• Quickstart — wrap your first call, run it in ghost, and see the receipt. Five minutes, one real win, zero risk to your system.
• Ways to protect an action — the four routes in, including the one that needs no code edit at all, and which to reach for.
• Languages — JavaScript and TypeScript today, and the honest answer for Python, Go, Ruby and Java before you install anything.
• Core Concepts — the shared vocabulary the rest of the docs assume.
• Going from ghost to enforce safely — the guide everything builds toward: earn confidence in ghost, then turn enforcement on without surprises.