Phinq Review 2026: Can It Stop AI Agents Before They Break Something?
This is a launch-day assessment: Phinq scores 6.8/10 based on its open-source code, documentation, and Product Hunt launch thread from this week — a free governance layer that holds risky AI agent actions for human approval, built solo by a 21-year-old first-time founder.
Launch-day assessment based on the project's open-source repository, official documentation, and its Product Hunt launch thread — not yet an extended, hands-on review.
Phinq's founder, Hitham Hassham, is 21, a fresh graduate in London who couldn't find a job after school. He built this instead. The premise is blunt: an AI agent shouldn't be able to delete a production database, drain a company's credentials, or send a thousand emails without a human getting a chance to say no first — and right now, most agent setups let exactly that happen.
Phinq is a free, open-source (MIT) governance layer that sits between an AI agent and the tools it calls. Every action gets classified into one of five risk levels; safe, reversible actions pass through automatically, while irreversible ones — deletions, credential access, bulk sends, billing changes — get held and pushed to a human's phone via Telegram for an approve-or-deny decision, with every call logged in a tamper-evident, hash-chained audit trail. It launched on Product Hunt this week. This is a launch-day assessment based on the project's code, documentation, and a genuinely substantive public technical exchange between the founder and early commenters — not a verdict backed by months of production use, because that history doesn't exist yet for anyone outside the founder's own testing.
What Is Phinq?
Phinq is a runtime governance layer for AI agents, available two ways: as a proxy that drops in front of any agent speaking the OpenAI or Anthropic APIs with no code change, or as a TypeScript SDK (@phinq/governance) for gating tool calls in-process. Both share one decision engine: every tool call an agent tries to make gets classified by risk, safe actions pass through untouched, and irreversible ones are held for a human to approve or deny — from a phone, the CLI, or a programmatic handler — with an automatic deny if nobody responds within 240 seconds. The founder cites two real-world incidents as the motivation: a coding agent that deleted a company's entire production database and its backups in nine seconds, and a separate case where an agent wiped 1,206 executive records during a freeze a user had explicitly declared. Those are the founder's stated examples, not independently verified by ToolRadar, but they match a pattern of real, reported agent-autonomy incidents circulating in the AI safety community this year.
Key Features
Five-Tier Risk Classification
Every tool call is sorted into one of five levels: RISK_REDUCING and REVERSIBLE actions always pass (cancelling a task, reading a file), IRREVERSIBLE_LOW passes too (a single email, a single file write), while IRREVERSIBLE_MEDIUM (deletions, config changes, comms volume) and IRREVERSIBLE_HIGH (credential access, billing, disabling the governance layer itself) both trigger a hold. A set of structural triggers escalates automatically regardless of the base classification — more than 5 deletions in a session, reading a .env file, more than 3 outbound messages, sudo or IAM changes, bulk operations right after an error. Thresholds are configurable per project through a YAML file, and individual tools can be manually overridden to a different risk class than their default.
Telegram-Based Human Approval
When an action gets held, Phinq sends an approve/deny prompt directly to Telegram, showing exactly what the agent is trying to do. Tap approve, and the original response releases byte-identical to what the agent would have gotten; tap deny, and the agent receives a synthetic denial and continues safely rather than crashing. If nobody responds within 240 seconds, it auto-denies by default — a fail-closed design, which is the right default for a tool whose entire purpose is stopping unreviewed damage.
Tamper-Evident, Hash-Chained Audit Log
Every classification decision, hold, approval, and denial gets appended to a JSONL audit log where each entry carries the hash of the entry before it (RFC 8785 JCS canonicalization, SHA-256) — editing, reordering, or deleting any single entry breaks the chain and is immediately detectable by a built-in verification command. For a category where "trust us, we logged it" is normally an unverifiable claim, a chain that can actually be checked for tampering is a meaningfully stronger guarantee, and it directly supports the kind of audit trail the EU AI Act's human-oversight requirements are starting to demand.
Replay and Calibration Before Enforcement
Before flipping enforcement on, Phinq can run in observe-only mode, logging what it would have classified without actually holding anything, and a replay command lets a team reclassify that captured corpus against tuned thresholds until routine operations stop generating false holds. This calibrate-before-enforce workflow matters in practice: a governance layer that interrupts an agent's normal, safe operations constantly will get disabled or bypassed by a frustrated team, which defeats the entire point.
Phinq Pricing
| Tier | Price | What's Included |
|---|---|---|
| Open Source | Free (MIT) | Full proxy or SDK, self-hosted, all classification and audit features |
| Advisory Skill | Free | Lighter-weight version with no infrastructure to run |
| Hosted (phinq.co) | Not yet published | Dashboards, anomaly detection, team approvals, compliance-grade audit |
ToolRadar has no affiliate relationship with Phinq — the link above goes directly to the official GitHub repository.
Pros and Cons
✓ What Works
- ✅ Genuinely sophisticated, inspectable engineering for a week-old solo project — a real five-tier classifier, structural triggers, and a verifiably tamper-evident audit log, not just a landing page
- ✅ Fail-closed by default (auto-deny on timeout) and a calibrate-before-enforce replay workflow that reduces the risk of a governance tool getting disabled out of frustration
- ✅ Free and MIT-licensed with no vendor lock-in, working with a wide range of agent frameworks (OpenAI, Anthropic, LangChain, CrewAI, AutoGen, and more)
- ✅ The founder responded to hard technical questions in the launch thread with specific, honest answers rather than deflecting or over-promising
✗ What to Watch For
- ❌ Zero GitHub stars and zero independent reviews as of this review — every claim here comes from the project's own code, docs, and founder statements, not outside validation
- ❌ The classifier currently sorts risk primarily by tool name/verb rather than the actual argument or state of the world — the founder directly confirmed a delete on a temp file and a delete on the only production backup are classified the same way today
- ❌ Single solo founder with no team, company, or funding disclosed — a real continuity risk for a tool a team might come to depend on for safety-critical gating
💡 A Real Technical Exchange From Launch Week
Phinq vs. Competitors
| Tool | Best For | Pricing | Maturity |
|---|---|---|---|
| Phinq | Open-source, self-hosted approval gating with an auditable log | Free (MIT), hosted tier TBA | Launch week, 0 GitHub stars |
| Lyzr | Private agent SDKs for building governed generative AI apps | Custom / enterprise | PH 5.0 (13 reviews) |
| Helicone AI | Open-source LLM observability, not action-gating specifically | Free tier, paid plans scale up | PH 5.0 (13 reviews), established |
Setup and Learning Curve
Setup for the proxy path is a git clone, npm install, and pointing an agent's base_url at a local port — no changes to agent code required, since the agent just talks to the proxy instead of the model provider directly. Turning on real enforcement requires a Telegram bot token and chat ID, a five-minute task via BotFather. The documentation explicitly recommends running in observe-only mode first and using the replay tool to tune thresholds against real traffic before enabling holds, which is a sensible, safety-conscious default rather than shipping a tool that immediately starts interrupting a live agent's normal operations.
Who Should Use Phinq?
Best For: Developers and small teams running agents with real write access — file systems, databases, billing, external comms — who want a free, self-hosted, inspectable safety layer and are comfortable being an early adopter of a solo-built, week-old open-source project.
Look Elsewhere If: You need argument-level risk awareness today (the classifier is currently tool-name-based, a limitation the founder has confirmed directly), you need a vendor with a support contract and an established track record for a compliance-critical deployment, or you're not comfortable running self-hosted infrastructure for something as important as agent action-gating.
Expert Editorial Opinion
The problem statement here is sharper than most funded companies in this exact space have managed to write down: agents don't need to be smarter, they need a bouncer, and "classify by risk" is the load-bearing step where the hard engineering actually lives. That's not a marketing line — it's a genuinely correct read of where agent-safety failures actually happen.
What's most unusual for a week-old, solo-built project is the technical maturity of the actual implementation. A tamper-evident, hash-chained audit log with a real verification command, a five-tier classifier with configurable structural triggers, and a replay/calibration workflow before enforcement are the kind of details a team builds when they've thought hard about the failure modes of governance tooling itself, not just the agents it's meant to govern.
The most valuable thing in this entire review isn't a feature — it's the founder's direct, unhedged answer to the hardest question asked in the launch thread. Told that "delete_file is a verb, not a risk level," and that the same call is trivial on a temp file and catastrophic on a production backup, Hassham didn't dispute it. He confirmed the classifier currently sorts by tool name first, called it "the cautious default," and said argument-aware "precious path" rules don't exist yet but are the obvious next direction. That's the correct way to handle a real, unsolved limitation in a security tool — named plainly, in public, during launch week, rather than glossed over.
There's effectively no pricing story to critique yet, and that's consistent with everything else here: the open-source core is genuinely free with no artificial gating, and the hosted tier (dashboards, anomaly detection, team approvals) has no published price at all. A free, MIT-licensed safety layer with no cost gate to even test is about as low-friction an adoption decision as this category offers, provided you're willing to run the infrastructure yourself.
Since the whole thing is free, the real question isn't cost — it's trust in a single, first-time, 21-year-old founder's solo project for something as consequential as gating what an autonomous agent is allowed to do to production systems. For low-stakes experimentation or a personal project, that's an easy yes. For anything touching real customer data, billing, or infrastructure a business depends on, the honest answer is to run it in observe-only mode first, watch how the classifier actually behaves on your own traffic, and treat the current tool-name-based risk sorting as a real, acknowledged limitation rather than a solved problem.
Final Verdict
Phinq is a genuinely well-engineered answer to a real and increasingly urgent problem — autonomous agents taking irreversible actions with nobody in the loop — built in public, in one week, by a 21-year-old who couldn't find a job and built one instead. The tamper-evident audit log, five-tier classification, and calibrate-before-enforce workflow are real, inspectable engineering, not landing-page promises, and the founder's direct, honest handling of the hardest technical criticism raised at launch is a better signal about this project's trajectory than any marketing copy could be. What keeps the score modest is simply timing: zero GitHub stars, zero independent reviews, a solo founder with no team or funding, and a classifier that, by the founder's own admission, still sorts risk by tool name rather than the state of the world it's acting on. Worth trying in observe-only mode on a real project this week; not yet something to bet a production safety posture on without watching it work first.
Technical Quality: 8.0/10 · Price-to-Value: 9.2/10 · Maturity & Documentation: 3.0/10
🔗 Related ToolRadar Reviews
More tools from AI Agent Security
- The $180M AI Security Platform Making Headlines
- Your AI Agents Have Security Holes
- I Gave an AI Agent Full Control of My Inbox
- Can an AI Agent Really Replace Your Job?
- I Built a Production AI Agent in 10 Minutes
- This AI Agent Replaced My Entire Team's Workflow
- Beyond the Hype: Google ADK 2026 AI Agent Framework
- Devin AI 2026: The End of Junior Developers?
❓ Frequently Asked Questions
Letting an AI agent touch real files, credentials, or customer data without anyone reviewing what it does?
Phinq is free to try in observe-only mode — run it against real traffic for a week and see what it would have held before deciding whether to turn on enforcement.
Comments
Post a Comment