More tools ≠ more chaos. Liminal combines lazy families, resource locks, human approval, and an optional single-token safety judge so autonomy scales without reckless shell access.
Lazy tool families
On startup the model sees a baseline profile (balanced, knowledge_first, or max_autonomy). Everything else — git, browser, document engine, vault — loads via activate_tool_family.
Danger levels
| Level | Examples | Behavior |
|---|---|---|
| Normal | read_file, recall | Runs when model calls |
| Destructive | run_shell, run_background | Approval unless YOLO / judge |
Locks serialize access to paths and shell so parallel tool calls don't corrupt state.
Safety judge (optional)
AGENT_SAFETY_JUDGE=1 runs the fast model with a 0/1 verdict before showing you the approval modal. Cached briefly per (tool, args) — advisory only; when in doubt the harness still asks.
Critics and verification
Optional verify_result / critics run when answers are code-heavy — another fast-model pass before you trust a "done" message.
Try Liminal on your machine
Free, MIT licensed, one-command install. No account required.
— The Vireon Dynamics team