Give Claude Code, Cursor or Copilot free rein and they'll happily make five decisions in a row without checking in once — fine for a side project, less fine when one of those decisions touches production or a regulated dataset. A small category of tools now sits on top of the agent itself to add structure and a paper trail, and DMX names Conduct AI directly as its own alternative — a useful signal that these two, despite very different scopes, are genuinely being weighed against each other.
DMX: a five-phase workflow with a human in the loop
DMX is an open-source MCP server that adds a structured, human-gated workflow on top of AI coding agents: Spec, Plan, Build, Validate, Release, each with a validation checkpoint before moving to the next. It works over MCP with Claude Code, Cursor, GitHub Copilot and Antigravity, keeps a versioned persistent memory, and lets you resume a session without losing context. It's free and open source under AGPL-3.0.
Points forts: five-phase workflow with human validation at each step, works across Claude Code, Cursor, Copilot and Antigravity via MCP, versioned persistent memory, clean session resume, free and open source.
Points faibles: AGPL-3.0 is a more restrictive license than MIT for some companies' legal teams, it adds real process friction — not built for teams that want zero ceremony, and it's a very young project (2 stars).
Conduct AI: compliance packs and audit trails for regulated teams
Conduct AI is an open-source governance platform that enforces compliance policies on AI coding agents with full audit trails, aimed squarely at teams operating under regulatory pressure. It ships more than 20 ready-made compliance packs (SOC 2, HIPAA, PCI DSS, EU AI Act), a hash-chained audit trail built to serve as regulatory proof, and a 14-day read-only discovery mode that observes agent behavior before any policy actually blocks something. It works with Claude, Cursor, Copilot and other SDK-based agents, and is self-hostable with a managed SaaS option.
Points forts: 20+ pre-built compliance packs covering major frameworks, hash-chained audit trail for regulatory evidence, 14-day read-only discovery mode before enforcement, open source and self-hostable, works across the major SDK-based agents.
Points faibles: built for large or regulated organizations — overkill for a solo developer, a young project (23 stars) still maturing, and it takes real investment to configure the policies well.
| DMX | Conduct AI | |
|---|---|---|
| Core idea | Five-phase gated workflow (Spec→Release) | Policy enforcement + compliance packs |
| Best fit | A team wanting structure without heavy process | Regulated teams needing audit-ready proof |
| Compliance frameworks | Not the focus | SOC 2, HIPAA, PCI DSS, EU AI Act (20+ packs) |
| Rollout approach | Workflow gates from day one | 14-day read-only discovery before enforcement |
| License | AGPL-3.0 | Apache 2.0 (self-hosted) + managed SaaS option |
| Price | Free, open source | Free self-hosted; paid managed SaaS |
Verdict
Pick DMX if what you actually want is a lightweight process — spec, plan, build, validate, release — that keeps a human checking in at each phase, without needing to map anything to SOC 2 or HIPAA. It's the better fit for a product team that just wants less chaos from its coding agents.
Pick Conduct AI if you're an engineering leader or security/compliance team that needs to prove, after the fact, that AI agents operated within a specific regulatory framework. The compliance packs and hash-chained audit trail are built for exactly that conversation with an auditor — and would be overkill for a small team that doesn't have one.
Both are young, open source, and free to start — the real decision isn't cost, it's whether your actual problem is process discipline (DMX) or regulatory proof (Conduct AI).