
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
dingdawg-loop
Advanced tools
Governance receipts for AI agents — DingDawg Loop Protocol (DDLP) for safe scheduled agents with governance gates, compliant with EU AI Act Art. 12, Colorado AI Act (SB 24-205), and NIST AI RMF. Every loop execution is verified, receipted, and fail-closed
DingDawg Loop Protocol (DDLP) — a framework for safe, scheduled, proactive AI agents with built-in governance gates. Agents declare what they WILL do, pass a governance check, and only then execute. If governance denies or errors, the loop skips that cycle. Fail-closed by default — no silent autonomous action.
AI agents running on a schedule without governance is a liability. An agent that sends emails every hour, syncs data nightly, or processes payments weekly needs a gate between "I want to act" and "I acted." DDLP puts that gate in place: every scheduled execution is governed, audited, and reversible. Proactive agents become safe by default.
# Add to Claude Code
claude mcp add dingdawg-loop npx dingdawg-loop
# Or run directly
npx dingdawg-loop
{
"tool": "register_loop",
"arguments": {
"name": "daily-report-sender",
"schedule": "0 9 * * *",
"action_type": "generate_report",
"risk_tier": "low",
"description": "Generate and save a daily analytics summary report to the reports directory every morning at 9am."
}
}
Returns a loop_id you use for all subsequent operations.
{
"tool": "execute_loop",
"arguments": {
"loop_id": "loop_abc123",
"execution_notes": "Manual trigger for Monday report"
}
}
The governance gate evaluates the loop's action type, description, and risk tier. Three possible outcomes:
{
"tool": "loop_audit",
"arguments": {
"loop_id": "loop_abc123",
"limit": 10
}
}
Returns every execution with its governance decision, risk score, and outcome.
register_loopRegister a new scheduled agent loop.
| Parameter | Type | Required | Description |
|---|---|---|---|
name | string | yes | Unique human-readable name for this loop |
schedule | string | yes | Cron expression (0 9 * * *) or shorthand (@hourly, @daily) |
action_type | string | yes | What the loop does (send_email, generate_report, sync_data) |
risk_tier | enum | yes | low, medium, high, or critical |
description | string | yes | Detailed description (min 10 chars) — governance evaluates this |
metadata | object | no | Key-value pairs (owner, team, target_system) |
execute_loopManually trigger a loop. Governance gate runs BEFORE execution.
| Parameter | Type | Required | Description |
|---|---|---|---|
loop_id | string | yes | The loop_id from register_loop |
execution_notes | string | no | Why this manual execution was triggered |
list_loopsList all registered loops with status and last execution.
| Parameter | Type | Required | Description |
|---|---|---|---|
status_filter | enum | no | all, active, or paused (default: all) |
pause_loopPause a loop so it cannot be executed.
| Parameter | Type | Required | Description |
|---|---|---|---|
loop_id | string | yes | The loop_id to pause |
reason | string | no | Why this loop is being paused |
resume_loopResume a paused loop.
| Parameter | Type | Required | Description |
|---|---|---|---|
loop_id | string | yes | The loop_id to resume |
loop_auditGet execution history and governance decisions for a loop.
| Parameter | Type | Required | Description |
|---|---|---|---|
loop_id | string | yes | The loop_id to audit |
limit | number | no | Max records to return (default: 20) |
~/.dingdawg/loops/executions/ as JSON.execute_loop calls in v1. No background daemon.DDLP requires dingdawg-governance as a peer dependency. In v1, the governance logic runs locally inside the loop server. In v2+, it will call the governance server directly via MCP-to-MCP transport.
npm install dingdawg-governance dingdawg-loop
Loop definitions and execution records are stored locally:
~/.dingdawg/loops/
loop_abc123.json # loop definition
executions/
exec_xyz789.json # execution record with governance receipt
execute_loop. Schedule stored but not auto-executed.MIT
FAQs
Governance receipts for AI agents — DingDawg Loop Protocol (DDLP) for safe scheduled agents with governance gates, compliant with EU AI Act Art. 12, Colorado AI Act (SB 24-205), and NIST AI RMF. Every loop execution is verified, receipted, and fail-closed
We found that dingdawg-loop demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.