Intaris

Default-deny.Every tool call is classified and evaluated. Read-only operations are fast-pathed; everything else goes through LLM safety evaluation. Unknown tools are never auto-approved.

Real-time.Sub-second evaluation with a priority-ordered decision matrix. Read-only calls resolve in under 1ms. LLM evaluations complete within the 5-second circuit breaker. WebSocket streaming for live monitoring.

Self-hosted.Single Python process, SQLite or PostgreSQL storage, no external dependencies beyond an LLM API key. Your code and audit trail stay under your control.

- Default-deny classifier-- Explicit read-only allowlist with critical pattern detection. Everything not allowlisted goes through LLM evaluation.
- LLM safety evaluation-- OpenAI-compatible structured output for alignment checking, risk assessment, and decision reasoning.
- Priority-ordered decision matrix-- Critical risk auto-denies, aligned low/medium approves, high risk and misalignment escalate for human review.
- Session management-- Hierarchical parent/child sessions with intention tracking, lifecycle states, and idle sweep.
- Intention tracking-- User-driven intention model with IntentionBarrier for real-time updates and AlignmentBarrier for parent/child enforcement.
- MCP proxy-- Sits between clients and upstream MCP servers, evaluating every tool call with per-tool preference overrides.
- Audit trail-- Every evaluation is logged with decision, reasoning, risk level, classification, latency, and redacted arguments.
- Secret redaction-- API keys, passwords, tokens, and connection strings are automatically redacted before audit storage.
- Filesystem path protection-- Working directory enforcement with approved path prefix learning from LLM approvals.
- Session recording-- Full-fidelity event logs with live tailing, playback, chunked ndjson storage (filesystem or S3), and a bounded local cache for immutable S3 chunks.
- Cognis-ready auth-- Accepts Cognis-issued ES256 JWTs for service-to-service calls while keeping standalone API key auth for direct clients.
- Behavioral analysis-- Three-layer system: per-call data collection, session summaries, and cross-session behavioral profiling.
- Management UI-- Built-in web dashboard with session tree view, audit log, approval queue, MCP server management, and real-time charts.
- Judge auto-resolution-- Escalated tool calls can be automatically reviewed by a more capable LLM (gpt-5.4), reducing human intervention while maintaining safety. Three modes: disabled, auto, advisory.
- Webhook callbacks-- HMAC-signed escalation notifications for external approval systems.
- Notification channels-- Per-user push notifications (Pushover, Slack, webhook) with one-click approve/deny action links.
- Rate limiting-- Per-session sliding window rate limiter to prevent runaway agents.

Intaris needs an OpenAI-compatible API key for safety evaluation. It picks upLLM_API_KEYfrom your environment automatically.

That's it. Intaris starts onhttp://localhost:8060, management UI athttp://localhost:8060/ui.

Now integrate with your agent. We already ship extensions for some clients. For example forOpenCode, install the plugin:

export INTARIS_URL=http://localhost:8060 cp integrations/opencode/intaris.ts ~/.config/opencode/plugins/

Intaris can also serve as MCP proxy with audit trail and guardrails for tool calls. To use that, configureany MCP clientto use intaris as a single MCP server:

{ "mcpServers": { "intaris": { "type": "streamable-http", "url": "http://localhost:8060/mcp" } } }

And add MCP servers via Intaris UI or config.

Dashboard -- evaluation metrics, decision distribution, performance stats, and activity timeline

Sessions -- hierarchical tree view with expandable session details and recent evaluations

Approvals -- pending escalations with reasoning, arguments, and one-click approve/deny

Analysis -- behavioral risk profile with per-agent risk indicators and trends

Analysis -- cross-session behavioral trend tracking over time

Sessions -- suspicious session detail with evaluation reasoning and risk assessment

Audit -- critical tool execution denied with detailed reasoning

Plugin/Hooksgive fine-grained control: custom error messages, fail-open/fail-closed behavior, session lifecycle management, and behavioral analysis.MCP proxyis zero-code configuration but with less UX control.

Intercept.The client integration (plugin, hooks, or MCP proxy) captures every tool call before execution and sends it to Intaris for evaluation.

Classify.The classifier checks the tool against a priority chain: session policy denies, tool preference overrides, critical patterns, the read-only allowlist, and filesystem path policy. Read-only tools are auto-approved. Critical patterns are auto-denied.

Evaluate.Tool calls classified as WRITE go through LLM safety evaluation. The LLM assesses alignment with the session intention, risk level (low/medium/high/critical), and recommends a decision -- all within a 4-second timeout.

Decide.The decision matrix applies priority-ordered rules: critical risk always denies, aligned low/medium risk approves, high risk and misalignment escalate for human review. The decision, reasoning, and full context are recorded in the audit trail.

Intaris catches 100% of critical threats (destructive commands, data exfiltration, RCE) with zero false positives. Across the last published 41-scenario benchmark run including adversarial attacks, social engineering, and cross-session patterns, Intaris achieves 94% F1 with 100% precision -- it never blocks legitimate developer work. The current scenario catalog also includes a new sensitive project-file access regression scenario that will be included in the next full benchmark run.

The Licensed Work is (c) 2026 Filip Pytloun. You may use the Software for your own internal business operations free of charge. Commercial use (SaaS, managed services, or as a component of a commercial product) requires a separate license. On the Change Date (2030-03-15), the license converts to Apache License 2.0.

Comprehensive audit logging for agent-to-agent interactions — immutable event trails, tamper-evident hashing, structured log export (SIEM-compatible), and compliance-grade retention for regulated industries.

Enforces organisational AI usage policies at the agent layer — blocks prohibited model calls, enforces data residency rules, logs policy violations, and ensures AI governance policies are machine-executable.

AI-powered security operations with Wazuh SIEM + Claude Desktop. Natural language threat detection, automated incident response & compliance.

Trust and safety layer for AI agents — scores MCP servers for security risk, capability flags, and prompt injection.

Security gateway that blocks prompt-injection-driven tool calls (poisoned payments, fabricated results) using cryptographic receipts, value-provenance enforcement, and multi-model consensus. Sits in front of any MCP server.

Vaara is the tamper-evident runtime evidence layer for AI systems. It covers EU AI Act compliance, and any other case where you need to prove what an agent actually did. Open source, no SaaS, no telemetry.

KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server that runs on your metal — with the World's First DoD PQC STIG built in. PQC-01-STIG-V1R1 — Full Whitepaper → 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory. The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments.

Cryptographic runtime governance for AI agents. 20 tools. Sealed policy artifacts, continuous measurement, tamper-evident proof. Ed25519 + SHA-256.

AI Agent Supply Chain Security - Intercepts and validates every package installation, git clone, and script download triggered by AI coding agents before it executes.