Open source · self-hosted · identity, policy, human approval, audit

Govern what your AI agents actually do.

Straza is identity, policy enforcement, human approval, and tamper-evident audit for every action an agent takes: a shell command, a file write, a network fetch, an MCP tool call. Each one becomes a single event, decided against signed policy before it runs. Self-hosted, one static binary, fail-closed by design.

Email the maintainer Open source, launching soon

Drops in beside Claude Code, Codex, and MCP tools: one signed policy, every agent.

Where Straza sits

Claude Code Codex Gemini CLI Python AgentKit LangChainOpenAI Agents SDK

Your IdM / IGA SCIM 2.0 · OIDC · both ways Straza policy · approval · audit

Any MCP serverone governed /mcp endpoint

Agents in from the left, identity from the IdM you already run, every MCP server behind one gateway: the same signed policy on every lane.

Why Straza exists

The model isn't the risk. The shell is.

Every serious agent setup ends in the same place: a process that can execute things, and no answer to who allowed it.

It acts, today

An agent with tool access runs commands, edits files, calls APIs. Not hypothetically. On your machines, right now.

Filters stop at the words

Prompt firewalls and output scanners read the conversation and stop there. The action layer is uncovered: a proxy on the model wire never sees the tool call.

Nobody signs off

No identity behind the agent, no policy at the action, no human on the risky calls. "Was that allowed?" has no owner.

What exists is hardcoded

Where a control exists at all, it's an allowlist in a config file: per repo, per machine, frozen at setup. Straza's policy is one signed document, managed centrally, and a change reaches every agent live.

How it works

Four steps, one boundary.

Point an agent at Straza and every action it takes passes a policy decision before it runs.

Enroll the agent

OIDC device-flow login binds the agent to an identity and device; it receives a short-lived (300 s) session token and the current signed policy snapshot.
Policy decides, before the action runs

Every action becomes one event, decided locally against the signed snapshot in microseconds: allow, deny-with-reason, or escalate. No server round-trip on the hot path.
A human approves the calls that need it

A mode: approve rule holds the call open until the person holding the approver role decides, from the console, Slack, or a phone.
Every decision seals into an audit trail

Allow, deny, or approval: each is written asynchronously into a tamper-evident hash chain you can re-verify yourself.

What you get

Enforcement you can reason about.

The controls a security team expects, shaped for how agents actually work.

One gateway, every MCP server governed

strazad fronts your MCP servers as a single governed endpoint: drop a server in and its tools are cataloged, role bindings decide who sees which tools, and nothing is exposed by default. Harness hooks cover Claude Code, Codex, and Gemini; a stdlib-only Python agentkit covers tool loops; the same signed policy rules every lane.

any MCP server · drop one in

strazad · MCP manager one governed /mcp

github-mcp38 tools cataloged · 0 exposed
db-mcp14 tools cataloged · 0 exposed
slack-mcp9 tools cataloged · 0 exposed
payments-mcp21 tools cataloged · 0 exposed

4 servers wrapped · 82 tools cataloged · 0 exposed until a role binds

A decision at every action

One policy engine sits at every entrance and decides locally against a signed snapshot; a deny carries a reason the model can read, and interpreter tricks like base64 | sh are classified, not waved through.

Credentials never reach the agent

Upstream secrets and OAuth grants are injected gateway-side, so a prompt-injected model cannot exfiltrate what never entered its context.

Human approval, resolved by role

A mode: approve rule blocks a call until whoever holds the approver role (resolved from your IGA, not Straza's own config) approves it at runtime, from console, Slack, or phone.

Tamper-evident audit

Every decision flows through an async spool into a SHA-256 hash chain that proves nothing was rewritten, and audit never blocks a tool call. Conversation capture, verbatim or redacted per policy, seals into the same trail, and events ship to your SIEM over an HMAC-signed webhook or JSONL sink, delivered at-least-once.

Identity from your IdM

Agents log in through your OIDC provider and are provisioned over SCIM 2.0 from the IGA you already run (midPoint is the reference), including non-human identities. Disable the identity and its sessions die in under 2 seconds.

Human approval

When it matters, a human decides.

An agent hits a mode: approve rule and the call blocks. Whoever holds the approver role (resolved from your IGA) decides from the console, Slack, CLI, or phone. A timeout is a deny.

Terminal replay: a gated call is held, approved from the console and CLI, and the hook lane retries. Open in a browser if the frame is empty.

Mobile approver

A signed approval, from your phone.

The phone is another approver channel alongside the console and Slack. Enrolling scans a QR that provisions a hardware key inside the phone's secure element: the push carries only an opaque reference, the app fetches the request over a pinned channel, and every decision is signed on the device by a key that never leaves it. Lose the phone and an admin revokes it server-side, so its token dies immediately and the pairing is gone.

Coming soonApp Store Coming soonGoogle Play Coming soonF‑Droid

In development. You can approve from the console, Slack, or CLI today; the native apps are coming.

Replay of the Straza approver app for Android: screens, strings, and colors mirror the app source; runtime values are sample data. The apps are in development; approve today from the console, Slack, or CLI.

Identity governance

Assign a role. The tools follow.

Straza speaks SCIM 2.0 and OIDC, so the IdM or IGA you already run drives it; midPoint is the reference shown here, and anything that provisions over SCIM works the same way. The tool catalog is default deny: no role binding, no tool. Assign a role and it provisions to the gateway; a live session picks it up at its next check-in, its catalog grows, and every new call is decided and audited like any other.

Assign

An operator grants the role in your IdM; midPoint recomputes its projections.
Provision

Membership lands over SCIM 2.0: PATCH /scim/v2/Groups.
Flush

Straza maps the group to a role and flushes its role cache instantly.
Check-in

The live session lands the role at its next check-in and its catalog grows.
Allow + audit

The new call passes policy and seals into the tamper-evident chain.

Assign a role in your IdM and the agent's tool catalog follows: default deny, provisioned over SCIM, every call audited.

Built to be trusted

Boring where it counts.

Self-hosted

You run it

No managed cloud, no vendor in the request path. You run the one binary on your own infrastructure.

One binary

Laptop to Kubernetes

One Go binary (CGO_ENABLED=0) runs a zero-config laptop mode and scales to Kubernetes.

Fail-closed

Deny on unknown

Unknown state is a deny with an actionable reason, never a silent allow.

Scales sideways

Stateless data plane

No database reads on the request path and tokens that verify themselves. The same binary serves one laptop or an autoscaled Kubernetes fleet; add replicas, not ceremony.

Built in the EU

Open source

Open source under AGPL-3.0 (core) and Apache-2.0 (SDKs and spec), developed in Slovakia.

See it decide, deny, and hold for a human.

Straza is open source and self-hosts from a single binary. It's launching soon with the code, the docs, and a one-command eval stack that boots the whole story: an IdM, a governed MCP gateway, and a live human-approval gate. Email the maintainer to get in early, or follow the launch.

Email hello@straza.ai Open source, launching soon