{
  "markdown": "# Yagami\n\n<!-- mcp-name: io.github.MatthewTracy/yagami -->\n\n**Open-source AI context firewall for governed model, retrieval, memory, and tool access.**\n\n[![CI](https://github.com/MatthewTracy/yagami/actions/workflows/ci.yml/badge.svg)](https://github.com/MatthewTracy/yagami/actions/workflows/ci.yml)\n[![PyPI](https://img.shields.io/pypi/v/yagami.svg)](https://pypi.org/project/yagami/)\n[![Python](https://img.shields.io/pypi/pyversions/yagami.svg)](https://pypi.org/project/yagami/)\n[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/MatthewTracy/yagami/blob/main/LICENSE)\n\n[Documentation](https://matthewtracy.github.io/yagami/) | [Gateway API](https://matthewtracy.github.io/yagami/gateway/) | [Deployment](https://matthewtracy.github.io/yagami/deployment/) | [Security](https://github.com/MatthewTracy/yagami/security/policy) | [Roadmap](https://github.com/MatthewTracy/yagami/blob/main/docs/roadmap.md)\n\n## Try it in 60 seconds\n\nThe no-credential demo uses your configured Ollama model when it is installed;\notherwise it opens a clearly labeled policy-only fallback. Choose one command:\n\n```bash\nuvx yagami demo\n# or: python -m pip install yagami && yagami demo\n# or: docker run --rm -p 127.0.0.1:8000:8000 ghcr.io/matthewtracy/yagami:latest yagami demo --host 0.0.0.0 --allow-remote\n```\n\nOpen [http://127.0.0.1:8000](http://127.0.0.1:8000), or use\n`docker compose -f compose.demo.yaml up` from a clone. Demo mode blocks cloud\nrouting while exercising the UI, policy, lineage, storage, and audit path. For\nlocal AI answers, install Ollama and run\n`ollama pull llama3.2:3b-instruct-q4_K_M` before starting the demo.\n\nhttps://github.com/user-attachments/assets/a7be9449-eafc-4acb-99b6-ea39edc43cd2\n\nYagami is for developers and platform/security teams that need to control\nwhere agent context goes and which tools it may execute. For example: a coding\nagent can keep repository secrets on-device and require an identity-bound,\none-time approval before a dangerous tool call.\n\nYagami sits between software and local models, cloud LLMs, retrieval systems,\nmemory, and tools. Existing OpenAI SDK applications can adopt it by changing\none `base_url`; Yagami then classifies context locally, applies versioned\npolicy, and records content-free evidence for each decision.\n\n[Take the no-data security tour](https://matthewtracy.github.io/yagami/tour/) or\nrun the [flagship security demos](https://github.com/MatthewTracy/yagami/tree/main/examples/flagship)\nfor secret containment, poisoned retrieval, and identity-bound tool approval.\n\n## Protect an application\n\nInitialize persistent user configuration, check the host, and start Yagami:\n\n```bash\nyagami init\nyagami doctor\nyagami serve\n```\n\nInstall `yagami[providers]` when the Yagami process or the example client uses\nAnthropic/OpenAI-compatible SDKs. PDF ingestion and OS key storage are separate\n`ingest` and `desktop` extras; see [configuration](https://matthewtracy.github.io/yagami/configuration/).\n\nThen point an OpenAI client at the gateway:\n\n```python\nfrom openai import OpenAI\n\nclient = OpenAI(\n    base_url=\"http://127.0.0.1:8000/v1\",\n    api_key=\"your-yagami-project-key\",\n)\n\nresponse = client.chat.completions.create(\n    model=\"yagami-auto\",\n    messages=[{\"role\": \"user\", \"content\": \"Summarize this document.\"}],\n    metadata={\n        \"purpose\": \"internal-documentation\",\n        \"sensitivity\": \"none\",\n        \"session_id\": \"example-session\",\n    },\n)\nprint(response.choices[0].message.content)\n```\n\nSupported caller sensitivity values are `none`, `phi`, `phi_medical`, and\n`secret`. A caller hint can make the policy stricter; it cannot lower a\nsensitivity detected by Yagami.\n\nFor production authentication, policy, and deployment settings, follow the\n[deployment guide](https://matthewtracy.github.io/yagami/deployment/).\n\n## Why teams use Yagami\n\n- **Deterministic containment after classification.** Once context is labeled\n  as PHI or secret, default policy permits local backends only. Sensitive\n  history and tool results inherit the same restriction.\n- **One governed data plane.** Chat Completions, Responses, the browser chat,\n  and MCP use the same policy, lineage, transformation, output-DLP, budget,\n  and audit pipeline.\n- **Policy as code.** Preview and replay decisions, run regression cases in\n  CI, and promote deterministic Ed25519-signed policy bundles.\n- **Evidence without prompt logging.** Policy passports, hash-chained audit\n  records, Prometheus metrics, and OpenTelemetry spans carry labels, hashes,\n  IDs, and counts rather than prompt or completion content.\n- **Model choice without policy duplication.** Route to local engines, direct\n  cloud providers, or an existing OpenAI-compatible gateway behind one\n  enforcement point.\n- **Governed tools.** Evaluate function tools and MCP calls before execution,\n  require short-lived one-time approvals, and keep inbound credentials from\n  being forwarded to downstream servers.\n\n## Core capabilities\n\n| Area | Included |\n|---|---|\n| Compatible APIs | OpenAI Chat Completions, core Responses API, Streamable HTTP MCP |\n| Identity | Scoped project API keys and OIDC/JWT workload identity |\n| Policy | Versioned YAML/JSON rules, restrictive merging, preview, replay, shadow mode, regression tests, signed bundles |\n| Privacy | Local classification, caller sensitivity, context lineage, AES-GCM tokenization, rehydration, output DLP, optional Presidio |\n| Tools | Function calling, governed built-in skills, stdio and remote MCP, one-time approvals |\n| Operations | Spend/rate/concurrency/context limits, health checks, Prometheus, OpenTelemetry, SIEM export, approval webhooks |\n| Packaging | Python 3.11-3.14, PyPI, non-root container, Docker Compose, Helm, SBOMs, checksums, and build provenance |\n\n## Models and integrations\n\nLocal generation works with [Ollama](https://ollama.com/), llama.cpp through\nthe optional `llama-cpp-python` runtime, and Microsoft Foundry Local through\nits loopback OpenAI-compatible service. Direct cloud adapters cover Anthropic,\nOpenAI, Mistral, Groq, OpenRouter, Google Gemini, and Stability AI image\ngeneration.\n\nYagami also works with LangChain/LangGraph, the Vercel AI SDK, Microsoft\nPresidio, Splunk HEC and generic SIEM webhooks, Slack and Teams approval\nnotifications, and upstream gateways such as LiteLLM, Portkey, Kong, or Envoy.\nSee the [integration recipes](https://matthewtracy.github.io/yagami/integrations/).\n\n## How it compares\n\nYagami is not trying to replace every gateway, validator, or security scanner.\nIts focus is deterministic post-classification containment, governed tool\nexecution, and content-free decision evidence. See the honest\n[comparison guide](https://matthewtracy.github.io/yagami/comparison/) for when\nLiteLLM, Guardrails AI, NeMo Guardrails, Presidio, LlamaFirewall, or a direct\nprovider SDK is the better choice—and how to combine them with Yagami.\n\n## How enforcement works\n\n```mermaid\nflowchart LR\n    A[\"Application or agent\"] --> B[\"Authentication and project limits\"]\n    B --> C[\"Local classification and context lineage\"]\n    C --> D[\"Versioned policy\"]\n    D --> E{\"Allowed destination or capability\"}\n    E --> F[\"Local or approved model\"]\n    E --> G[\"Retrieval, memory, or tool\"]\n    F --> H[\"Output inspection\"]\n    G --> H\n    H --> I[\"Response\"]\n    D --> J[\"Content-free policy passport and audit chain\"]\n    H --> J\n```\n\nPolicy is the final authority. Slash commands and explicit backend selection\ncannot override a sensitive-data restriction. Classifier failures fail local\nby default, and cloud routes can be blocked entirely or stopped at a daily\nspend cap.\n\n## Important limitations\n\nYagami is an enforcement component, not a compliance certification. Automated\ndetection can miss sensitive data. Strict deployments should declare\nsensitivity at the caller, use a local-only policy, test organization-specific\ncases, encrypt storage at the host or volume layer, and review the\n[threat model](https://matthewtracy.github.io/yagami/threat-model/).\n\nThe project is alpha. Validate policy and failure behavior against your own\nrequirements before production use.\n\n## Documentation\n\n- [Start here](https://matthewtracy.github.io/yagami/)\n- [Gateway API](https://matthewtracy.github.io/yagami/gateway/)\n- [Integrations](https://matthewtracy.github.io/yagami/integrations/)\n- [Deployment](https://matthewtracy.github.io/yagami/deployment/)\n- [Security and threat model](https://matthewtracy.github.io/yagami/threat-model/)\n\n## Contributing\n\nFocused issues and pull requests are welcome. Read\n[CONTRIBUTING.md](https://github.com/MatthewTracy/yagami/blob/main/CONTRIBUTING.md),\nthe [security policy](https://github.com/MatthewTracy/yagami/blob/main/SECURITY.md),\nand the [code of conduct](https://github.com/MatthewTracy/yagami/blob/main/CODE_OF_CONDUCT.md).\n\n## License\n\n[MIT](https://github.com/MatthewTracy/yagami/blob/main/LICENSE) - Copyright\n(c) 2026 Matthew Tracy and Yagami contributors.\n",
  "bytes": 8955,
  "sha": "b9e43aa4a96595cecb28f42997ea9110acb7acfc4d580832e78ed96846df352f",
  "repo_slug": "matthewtracy/yagami",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_matthewtracy_yagami_54ef8d0a/readme"
}