Summary

The tool call is checked against what you said you were doing.

Most guardrails match patterns; this one evaluates alignment with a stated session intention, which is what catches a technically-permitted call that has nothing to do with the task. Two practical consequences: every write costs an LLM evaluation, and escalations need somewhere to go — the notification channels with approve/deny links are what stop that becoming a blocked agent. Read the licence before putting it in a product.

What it is

Intaris sits between an agent and its tools. Every call is classified; read-only operations are fast-pathed, everything else goes through an LLM safety evaluation against the session's stated intention, and unknown tools are never auto-approved. It works as an MCP proxy in front of your other servers, or through client plugins and hooks.

What you get

A default-deny classifier with an explicit read-only allowlist and critical-pattern detection — critical patterns auto-deny, read-only auto-approves, everything else is evaluated
A priority-ordered decision matrix: critical risk always denies, aligned low or medium risk approves, high risk and misalignment escalate for human review
MCP proxy mode — configure one server at `http://localhost:8060/mcp` and add your real MCP servers behind it, with per-tool preference overrides
An audit trail carrying decision, reasoning, risk level, classification, latency and redacted arguments; API keys, passwords, tokens and connection strings are redacted before storage
Filesystem path protection with working-directory enforcement, session recording with live tailing and playback, per-session rate limiting, and HMAC-signed webhooks plus Pushover/Slack notifications with one-click approve or deny
A built-in web dashboard at `/ui` with the session tree, audit log, approval queue and behavioural analysis
Published benchmark over a 41-scenario run: precision 100%, F1 93.7%, false positive rate 0.0%, zero critical misses, average latency 1.1s

Requirements

An OpenAI-compatible API key for the safety evaluation, picked up from `LLM_API_KEY`. Start it with `LLM_API_KEY=sk-your-key uvx intaris` and it serves on `http://localhost:8060`. Storage is SQLite or PostgreSQL in a single Python process; Docker and pip paths are documented too. Ready-made integrations exist for OpenCode, Claude Code (hooks), OpenClaw and Hermes; any other MCP client uses the proxy endpoint. Package version 0.9.0. Business Source License 1.1 — free for your own internal business operations, commercial use needs a separate licence, converting to Apache 2.0 on 2030-03-15.

Setup effort

One command plus a key — LLM_API_KEY=sk-your-key uvx intaris, then supply credentials