A
licenseA
qualityC
maintenanceLocal zero-trust permission gateway for AI agents. Enforces policy-based tool authorization, human approvals, scoped permissions, and cryptographically verifiable audit logs.
4
58 PyPI
5
Apache 2.0
Dvarapala
Dvarapala
为 AI 智能体和 MCP 服务器提供权限门禁 + 防篡改审计日志。只需 3 行即可接入。
智能体会执行工具、运行命令、转移资金。一旦出现问题，你需要回答两个问题：这件事本应被允许吗？ 以及 运行究竟在哪里出了错？ Dvarapala 两者都能回答——事前（gating）与事后（audit）——且零依赖。
import dvarapala
gate = dvarapala.Gate(policy="policy.json", audit="audit.jsonl")
@gate(risk="critical")
def refund(customer_id: str, amount_cents: int):
... # nothing runs unless policy + consent approve; every decision is hash-chained为什么
Gate（事前）： 声明式策略（
allow/warn/confirm/deny）、启发式风险评分、同意阶梯（一次 / 会话 / 始终）、紧急停止开关、速率限制器。Audit（事中 → 事后）： 只追加的 JSONL，每条记录带 SHA-256 哈希链。编辑或删除历史记录都会破坏校验：
dvarapala verify audit.jsonl。从一开始就内置因果字段： 每条记录都携带
run_id、step、parent_step、context_refs、alternatives_considered、state_delta——因此，无需重新插桩任何东西，就能在此基础上构建“智能体为什么会那样做？”的归因。
Related MCP server: enterprise-agent-lab
30 秒快速上手
gate = dvarapala.Gate(
policy={
"rules": [
{"id": "reads-free", "match": {"tool": "read_*"}, "effect": "allow"},
{"id": "refunds-human","match": {"tool": "refund"}, "effect": "confirm"},
{"id": "no-drop", "match": {"keywords": ["drop table"]}, "effect": "deny"},
]
},
audit=".dvara/audit.jsonl",
)在智能体循环中，标注调用发生在何处：
with dvarapala.step(run_id="r1", step_no=17,
alternatives_considered=["cancel_order"]):
refund("c1", 5000) # audited with step=17, alternatives recorded被拒绝的调用会抛出 dvarapala.Denied（一种 PermissionError）——捕获它，让模型重试其他操作。
接入方式
接入方式 | 导入方式 |
适用于任意同步/异步函数的装饰器 |
|
用于 HTTP 工具端点的 ASGI 中间件 |
|
MCP 服务器工具处理器 |
|
CLI |
|
设计规则
纯标准库核心。 零依赖；YAML 策略是可选的额外功能。
默认拒绝，确保安全。 非交互式会话直接拒绝而非提示；未知的 shell 命令评估为 MEDIUM；破坏性令牌评估为 CRITICAL。
日志即证据。 链式校验只需一条命令，无需服务器。
状态
v0.1.0（alpha）。gate 与 audit 核心已稳定；适配器与失败归因层（why did step 24 fail because of step 6?）已列入路线图。采用 MIT 许可证。欢迎贡献。
安装
pip install dvarapala # core, stdlib-only
pip install dvarapala[yaml] # + YAML policy support
pip install dvarapala[dev] # + pytest/ruff许可证
MIT — 参见 LICENSE。
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo recent community issues
Related MCP Connectors
Runtime permission, approval, and audit layer for AI agent tool execution.
Context and control for any AI. Agent identity, scoped access, and proof across tools.
See, price, and control every tool call your AI agents make: policy checks, cost, and audit tools.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceEnables controlled AI-agent access to enterprise-shaped tools with a deny-by-default gated write path, human approval, dry-run execution, and append-only audit logging.1-
- AlicenseNot gradedqualityAmaintenanceTamper-evident audit trail for AI agent tool calls. Cryptographically signed, hash-chained records that prove what your agents did.319 npmMIT
- AlicenseAqualityAmaintenanceGates every AI agent tool call against your policy before it runs, then writes a hash-chained, tamper-evident record of what was decided and what happened. Anyone can verify that record offline, without your software, your systems or any key you hold.4220 PyPI15AGPL 3.0
