intaris

Intaris helps detect when an AI agent may be drifting from the user’s intention. It combines intention-aware evaluation of tool calls with behavioral analysis over a session and across sessions. Works with OpenCode, Claude Code, OpenClaw, and any MCP-compatible client.

Intention guardrails. Intaris evaluates tool use against the user’s stated intention, including explicit restrictions. A read-only fast path handles routine calls; other calls can go through model evaluation and, when needed, escalation. Evaluations are recorded in an audit trail.

Behavior analytics. Session summaries and cross-session analysis can surface patterns that a single tool call may not show.

Real-time. Sub-second evaluation with a priority-ordered decision matrix. Read-only calls resolve in under 1ms. LLM evaluations complete within the 5-second circuit breaker. WebSocket streaming for live monitoring.

Self-hosted. Single Python process, SQLite or PostgreSQL storage, no external dependencies beyond an LLM API key. Your code and audit trail stay under your control.

Intaris is not a sandbox, an antivirus, or proof that an agent cannot construct harmful actions. Pair it with a sandbox that isolates filesystem and network access and limits available tools when working with untrusted agents.

See Intaris purpose and threat model for scope and deployment guidance.

Part of the Cognara platform (Cognis controller, Intaris guardrails, Mnemory memory).

Features

• Tool-call assessment – Jev or an OpenAI-compatible model assesses action facts. Assessment is not itself permission.
• Policy-controlled decisions – The hybrid pipeline combines controller evidence, policy obligations and bounded model assessments. The legacy pipeline remains available; identify the mode when comparing results.
• Source-aware review – Independent Judge review can consider original task instructions and scoped runtime evidence without treating generated summaries as user consent.
• Session management – Hierarchical parent/child sessions with intention tracking, lifecycle states, and idle sweep.
• Intention tracking – User-driven intention model with IntentionBarrier for real-time updates and AlignmentBarrier for parent/child enforcement.
• MCP proxy – Sits between clients and upstream MCP servers, applying Intaris evaluation with per-tool preference overrides.
• Audit trail – Every evaluation is logged with decision, reasoning, risk level, classification, latency, and redacted arguments.
• Secret redaction – API keys, passwords, tokens, and connection strings are automatically redacted before audit storage.