LABSCO SUMMARY

The tool call is checked against what you said you were doing.

Most guardrails match patterns; this one evaluates alignment with a stated session intention, which is what catches a technically-permitted call that has nothing to do with the task. Two practical consequences: every write costs an LLM evaluation, and escalations need somewhere to go — the notification channels with approve/deny links are what stop that becoming a blocked agent. Read the licence before putting it in a product.

What it is

Intaris sits between an agent and its tools. Every call is classified; read-only operations are fast-pathed, everything else goes through an LLM safety evaluation against the session's stated intention, and unknown tools are never auto-approved. It works as an MCP proxy in front of your other servers, or through client plugins and hooks.

What you get

A default-deny classifier with an explicit read-only allowlist and critical-pattern detection — critical patterns auto-deny, read-only auto-approves, everything else is evaluated
A priority-ordered decision matrix: critical risk always denies, aligned low or medium risk approves, high risk and misalignment escalate for human review
MCP proxy mode — configure one server at http://localhost:8060/mcp and add your real MCP servers behind it, with per-tool preference overrides
An audit trail carrying decision, reasoning, risk level, classification, latency and redacted arguments; API keys, passwords, tokens and connection strings are redacted before storage
Filesystem path protection with working-directory enforcement, session recording with live tailing and playback, per-session rate limiting, and HMAC-signed webhooks plus Pushover/Slack notifications with one-click approve or deny
A built-in web dashboard at /ui with the session tree, audit log, approval queue and behavioural analysis
Published benchmark over a 41-scenario run: precision 100%, F1 93.7%, false positive rate 0.0%, zero critical misses, average latency 1.1s

Requirements

An OpenAI-compatible API key for the safety evaluation, picked up from LLM_API_KEY. Start it with LLM_API_KEY=<YOUR_LLM_API_KEY> uvx intaris and it serves on http://localhost:8060. Storage is SQLite or PostgreSQL in a single Python process; Docker and pip paths are documented too. Ready-made integrations exist for OpenCode, Claude Code (hooks), OpenClaw and Hermes; any other MCP client uses the proxy endpoint. Package version 0.9.0. Business Source License 1.1 — free for your own internal business operations, commercial use needs a separate licence, converting to Apache 2.0 on 2030-03-15.

Setup effort

One command plus a key — LLM_API_KEY=<YOUR_LLM_API_KEY> uvx intaris

See installation options

USE CASES

01

Putting a review step in front of a write

Let read-only calls through instantly while anything that changes state is evaluated and, when risky, escalated to you.

02

Getting an audit trail of what an agent tried

Review every evaluated call with its decision, reasoning and risk level, with secrets already redacted.

03

Guarding several MCP servers at once

Point the client at the proxy endpoint and register the real servers behind it, so one policy covers all of them.

04

Approving a blocked action from your phone

Receive the escalation as a push with approve and deny links instead of finding the agent stuck later.

BEFORE YOU INSTALL

What to know first

Requires

LLM_API_KEY in your environment

INSTALLATION

Connect your client

Server setup

TERMINAL

LLM_API_KEY=<YOUR_LLM_API_KEY> uvx intaris

MCP Clients

OpenCode

<YOUR_KEY> is the INTARIS_API_KEY you set when starting Intaris. If you set no key, the server accepts unauthenticated requests: remove the Authorization line.

OPENCODE · JSON

{
  "mcp": {
    "intaris": {
      "type": "remote",
      "url": "http://localhost:8060/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_KEY>",
        "X-Agent-Id": "opencode",
        "X-Intaris-Intention": "OpenCode coding session"
      }
    }
  }
}

Claude Code

<YOUR_KEY> is the INTARIS_API_KEY you set when starting Intaris. If you set no key, the server accepts unauthenticated requests: remove the Authorization line.

CLAUDE CODE · JSON

{
  "mcpServers": {
    "intaris": {
      "type": "http",
      "url": "http://localhost:8060/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_KEY>",
        "X-Agent-Id": "claude-code",
        "X-Intaris-Intention": "Claude Code coding session"
      }
    }
  }
}

OpenClaw

OPENCLAW · JSON

{
  "plugins": {
    "entries": {
      "intaris": {
        "enabled": true,
        "config": {
          "url": "http://localhost:8060",
          "apiKey": "${INTARIS_API_KEY}",
          "allowPaths": "~/",
          "recording": true
        }
      }
    }
  }
}

Hermes Agent

HERMES AGENT · TERMINAL

pip install hermes-intaris

Any MCP client

ANY MCP CLIENT · JSON

{
  "mcpServers": {
    "intaris": {
      "type": "streamable-http",
      "url": "http://localhost:8060/mcp"
    }
  }
}

Clients spell the "type" value differently: Claude Code and VS Code use "http", Cline uses "streamableHttp", and Roo Code uses "streamable-http". Claude Desktop does not accept a URL entry in its config file.

Intaris