Intaris 帮助检测 AI 代理是否偏离用户意图。它结合了对工具调用的意图感知评估与会话及跨会话的行为分析。支持 OpenCode、Claude Code、OpenClaw 及任何兼容 MCP 的客户端。

意图护栏。 Intaris 根据用户声明的意图评估工具使用情况，包括明确的限制。只读快速路径处理常规调用;其他调用可经过模型评估，必要时可升级。评估记录在审计轨迹中。

行为分析。 会话摘要和跨会话分析可以揭示单个工具调用可能无法显示的模式。

实时。 亚秒级评估，采用优先级排序的决策矩阵。只读通话在1毫秒内解决。LLM评估在5秒断路器内完成。WebSocket流式实时监控。

自托管。 单一Python进程，SQLite或PostgreSQL存储，除了LLM API密钥外无外部依赖。你的代码和审计记录由你掌控。

Intaris 不是一个沙盒，也不是杀毒软件，更不是智能体无法构建有害行为的证明。

intaris

Intaris helps detect when an AI agent may be drifting from the user’s intention. It combines intention-aware evaluation of tool calls with behavioral analysis over a session and across sessions. Works with OpenCode, Claude Code, OpenClaw, and any MCP-compatible client.

Intention guardrails. Intaris evaluates tool use against the user’s stated intention, including explicit restrictions. A read-only fast path handles routine calls; other calls can go through model evaluation and, when needed, escalation. Evaluations are recorded in an audit trail.

Behavior analytics. Session summaries and cross-session analysis can surface patterns that a single tool call may not show.

Real-time. Sub-second evaluation with a priority-ordered decision matrix. Read-only calls resolve in under 1ms. LLM evaluations complete within the 5-second circuit breaker. WebSocket streaming for live monitoring.

Self-hosted. Single Python process, SQLite or PostgreSQL storage, no external dependencies beyond an LLM API key. Your code and audit trail stay under your control.

Intaris is not a sandbox, an antivirus, or proof that an agent cannot construct harmful actions. Pair it with a sandbox that isolates filesystem and network access and limits available tools when working with untrusted agents.

See Intaris purpose and threat model for scope and deployment guidance.

Part of the Cognara platform (Cognis controller, Intaris guardrails, Mnemory memory).

Features

• Tool-call assessment – Jev or an OpenAI-compatible model assesses action facts. Assessment is not itself permission.
• Policy-controlled decisions – The hybrid pipeline combines controller evidence, policy obligations and bounded model assessments. The legacy pipeline remains available; identify the mode when comparing results.
• Source-aware review – Independent Judge review can consider original task instructions and scoped runtime evidence without treating generated summaries as user consent.
• Session management – Hierarchical parent/child sessions with intention tracking, lifecycle states, and idle sweep.
• Intention tracking – User-driven intention model with IntentionBarrier for real-time updates and AlignmentBarrier for parent/child enforcement.
• MCP proxy – Sits between clients and upstream MCP servers, applying Intaris evaluation with per-tool preference overrides.
• Audit trail – Every evaluation is logged with decision, reasoning, risk level, classification, latency, and redacted arguments.
• Secret redaction – API keys, passwords, tokens, and connection strings are automatically redacted before audit storage.