MADE

MADE does not run your agents. Claude Code, Codex or your own workers do the work. MADE decides who may act next, records every accepted result in a hash-chained journal, and holds the places where a person must decide. It runs on your machine: one plugin, one MCP process, one SQLite file. No account, no service, no model provider.

What one review leaves behind

An agent reviewed a change under a three-seat procedure: the author proposes, the reviewer challenges, the tech lead approves. This is the record MADE kept, read back with made_read_ceremony_events:

made_verify_ceremony_journal answers intact: true, record_count: 9. Every record carries the authorization decision that admitted it, the actor's declared kind and the SHA-256 of the record before it. The agent asked to approve on the person's behalf and was refused; the person ran scripts/made-approve.sh and the approval is the only human-kind fact in the chain.

Hand the record to someone without the store:

plugins/made/scripts/made-export-evidence.sh --ceremony pr-1 --out pr-1.evidence.json
made-mcp verify-evidence pr-1.evidence.json --public-key <the key setup printed>
# chain: intact · head: matches · signature: valid · verdict: sound

Terminal approvals, terminal grants, tool profiles and evidence bundles are in main and unreleased; the published releases below record relayed approvals, grant through MCP and list the full catalog. See Unreleased.

Related MCP server: MEMGRAPH-MCP

Start locally

These guides describe 0.9.0. Install the plugin from the published tag so its skills, setup scripts and executable use the same release:

codex plugin marketplace add underpass-ai/made --ref v0.9.0
codex plugin add made@made

Run made-setup, then start a new task. Setup downloads and verifies the release binary, configures authorization and a persistent search cursor key, and bootstraps the local SQLite store. Cargo is not required. The plugin guide covers Claude Code, Windows and updates. The rolling marketplace branch also serves 0.9.0, so an existing registration on that branch updates by refreshing it.

Bootstrap grants nothing: the agent's session holds no authority until you give it some, from your own terminal, and it cannot grant itself (in main, unreleased; the published releases grant through MCP instead):

plugins/made/scripts/made-grant.sh --profile core   # the ordinary route, 22 actions, shown and confirmed

Discovery then lists what the host holds under authorization, and a refused call names the action, the principal and how a grant is issued rather than a bare decision id.

For manual MCP registration, install the matching binary:

cargo install made-mcp --version 0.9.0 --locked
made-mcp --version

Then follow the local setup guide to bootstrap authorization and register the command with all required configuration. Checksummed release binaries avoid the Rust toolchain. To embed the engine in Rust, start with the complete library example.

Give the host a procedure

Design a change review: an author proposes a solution, a reviewer challenges it, and I approve the final result.

Design produces a draft. Publish its reviewed definition, then start a session from that published name and version so it can resume after restart. For each delegated step, the host claims the work, performs it and submits its output with the claim's fence. A claim alone performs nothing; MADE never turns an agent's statement into a human decision.

Ceremonies declare sequential or concurrent work, role eligibility, human guards, retry policies, bounded repetition, transition budgets and context writes. Eight coordination shapes ship as patterns (broadcast and collect, group chat, maker and checker, handoff, magentic, advisor, sequential, concurrent). Several published ceremonies compose into an agentic system with roles, participants and bounded loops.

What MADE is not

• Not an agent framework. It creates no agents and calls no model in the local edition. Hosts fan work out; MADE arbitrates claims through durable leases and records what came back.

• Not a workflow engine that trusts its caller. Authorization is explicit per action and per scope, idempotency keys and fences are on every mutation, and a human guard waits for a channel the agent does not control.

• Not an audit log you have to believe. The journal verifies itself, and a signed export verifies on a machine that has never seen the store. What it cannot prove it declares: a completed step is still the host's claim, and a terminal approval proves the terminal, not who sat at it.

Pick your path

MADE is pre-1.0. Upgrades from older releases can require client and store changes, including completion fences and compatible snapshot/event readers. Use the running server's tools/list and made_discover_capabilities to check the installed surface, the active tool profile and where human approvals are accepted. See migrations, release history and documentation home.

Apache-2.0. Copyright © 2026 Tirso García Ibáñez. Part of Underpass AI.