Secure MCP gateway
for AI agents
One daemon. Every tool call authenticated,
filtered, and audited. Zero trust by default.
How it works
navra sits between AI agents and local resources. It aggregates built-in tool modules and upstream MCP servers behind a unified security layer.
file · git · exec · RAG · voice · vision · GitHub · GitLab
Security
138 Kani proofs. 6 TLA+ specs. Bell-LaPadula verified.
OWASP ASI 10/10. This is not a checklist — it is a proof.
IFC labels track data sensitivity across tool calls. Bell-LaPadula no-read-up verified with Kani.
Deny rules always beat allow rules. Path canonicalization before every ACL check prevents traversal.
Regex + ML + NER pipeline. PII redaction, pseudonymization, and GDPR compliance tools built in.
Hash-chained SQLite log. Every tool call recorded. Always on, no opt-in required.
OWASP ASI: 10/10 controls · EU AI Act Art 12+14 ready · Cedar policy engine
Capabilities
Security at the infrastructure layer, not the application. Orchestration belongs in the agent.
Safety classifiers and embeddings run in-process on CPU. No GPU required, no external dependencies.
DAG execution, handoff routing, mesh communication. Mandate validation and hop limits.
Pull and cache models from OCI, HuggingFace, and Ollama registries with content-addressed storage.
FTS5 + sqlite-vec vector search with RRF fusion. Cross-encoder reranking and confidence gating.
YAML-defined personas, directives, and heuristics woven into system prompts at runtime.
ASR, TTS, and screen understanding via ONNX models. CPU and GPU tiers.
Agents run in Podman containers with a shared GPU model server. Falls back to in-process.
GitHub and GitLab tools: PRs, issues, comments, MR review. Via gh and glab CLI.
Get Started
$ git clone https://github.com/smgglrs-ai/navra
$ cd navra
$ export ORT_LIB_PATH=/usr/lib64
$ export ORT_PREFER_DYNAMIC_LINK=1
$ cargo build && cargo run -- serve
# Generate an agent token
$ cargo run -- token generate --name claudeRequires: Rust 1.75+, ONNX Runtime,
Linux (systemd + D-Bus)