apirun — Secure Execution Bridge for AI Agents: a fork of curl from apilabs.ai

AI coding agents such as Cursor™ and Claude Code™ can directly execute APIs, MCP tools, CLIs, SDKs, and shell commands. The problem is that standard execution tools such as curl have no concept of an organization's policies or agent governance.

Problem Statement

AI Agent
   │
   ├── curl ──────────→ API
   ├── MCP ───────────→ MCP Server
   ├── SDK ───────────→ SaaS
   └── CLI ───────────→ Infrastructure

This creates several problems:

• No centralized guardrails — agents can execute actions without SuperContracts™ Guardrails.
• Credential exposure — API tokens and secrets can end up in agent context or local environments.
• No consistent API/MCP governance — REST APIs and MCP tools are governed separately.
• No mandatory approval — sensitive actions can execute autonomously.
• No execution history — organizations cannot reliably answer what an agent did, why it was allowed, or what happened.
• Guardrail bypass — developers can potentially bypass an application-level policy by calling the underlying API or MCP directly.

The fundamental problem

AI agents can make decisions faster than organizations can control their execution.

curl is excellent at making requests, but it was never designed to answer: Should this agent be allowed to make this request?

Solution: apirun — The Secure Execution Bridge

apirun is the secure execution bridge between AI coding agents and the apilabs.ai Request Engine. It is a curl-derived, C-based CLI designed specifically for governed API and MCP execution.

Instead of:

AI Agent
   │
   ▼
curl / MCP / SDK
   │
   ▼
API / MCP Server

the execution path becomes:

AI Agent
   │
   ▼
┌──────────────┐
│   apirun     │
│ Secure CLI   │
└──────┬───────┘
       │
       ▼
┌─────────────────────────┐
│     apilabs.ai          │
│   Request Engine        │
│                         │
│  Skills Registry        │
│  SuperContracts         │
│  Guardrails             │
│  Credential Resolution  │
│  Approval               │
│  Execution History      │
└───────────┬─────────────┘
            │
       ┌────┴────┐
       ▼         ▼
     REST       MCP
      API      Server

Core capabilities

• Secure execution path — API and MCP calls execute through apilabs.ai.
• SuperContracts™ Guardrails — requests are evaluated before execution.
• Skills-based governance — capabilities are associated with mandatory guardrails.
• Credential protection — agents use credential ARNs rather than raw secrets.
• Human approval — sensitive operations can require approval before execution.
• Unified API + MCP governance — both execution models use the same control plane.
• Execution history — every action produces a record for future Evidence and Audit.

The core principle

Agents decide. apirun executes. apilabs.ai governs.

Read the full spec at Super Contracts API spec, or check out https://apilabs.ai — Make APIs Agent-Ready