{"id":"c02529c4-8fa9-45fa-9103-fc05480926d8","slug":"ephorate-ai-governance-and-monitoring","kind":"mcp","name":"ephorate-ai-governance-and-monitoring","summary":"Open-source control plane for AI agent security & governance — runtime policy enforcement, tamper-evident audit, prompt-injection detection (SIEM/EDR) and compliance mapping (NIST AI RMF, EU AI Act, O","owner":"smerphy","repoUrl":"https://github.com/smerphy/ephorate-ai-governance-and-monitoring","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"mcp","createdAt":"2024-12-01T19:20:18.000Z","addedAt":"2026-10-21T05:30:51.160Z","logoUrl":"https://avatars.githubusercontent.com/u/32769362?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","memory-knowledge"],"tags":["agentic-ai","ai-agents","ai-governance","ai-observability","ai-safety","ai-security","anthropic-claude","audit-log"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-23T06:30:11.790Z","sample":false,"url":"https://conduits.dev/tools/ephorate-ai-governance-and-monitoring","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# Ephorate\n\n**The control plane for autonomous AI agents.** Runtime policy enforcement,\ntamper-evident audit, and detection &amp; response for your **Claude** and\n**MCP** agents — so you can ship autonomy without ceding control.\n\n_Agents act. Ephorate decides._\n\n[![Control plane CI](https://github.com/smerphy/Ephorate-AI-Governance-and-Monitoring/actions/workflows/control-plane.yml/badge.svg)](https://github.com/smerphy/Ephorate-AI-Governance-and-Monitoring/actions/workflows/control-plane.yml)\n[![Engine CI](https://github.com/smerphy/Ephorate-AI-Governance-and-Monitoring/actions/workflows/engine.yml/badge.svg)](https://github.com/smerphy/Ephorate-AI-Governance-and-Monitoring/actions/workflows/engine.yml)\n[![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)\n[![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776ab.svg)](https://www.python.org/)\n[![TypeScript](https://img.shields.io/badge/TypeScript-ready-3178c6.svg)](sdk-typescript/)\n[![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)\n\n![Ephorate control-plane console — security overview with the EDR kill-switch, open-findings stats, and severity breakdown](docs/assets/console.png)\n\nEphorate is an open-source **AI agent security** platform. It sits between your\nagents and their tools and decides — in milliseconds — whether each action is\n**allowed, denied, transformed, or sent for human approval**, recording every\ndecision to a hash-chained audit log. When an agent misbehaves, Ephorate\n**detects, contains, and helps you prove** what happened — and maps your posture\nto the frameworks your auditors ask for.\n\nPut it in front of your agents two ways: the **Python / TypeScript SDKs**, or a\n**drop-in MCP proxy** that governs any MCP client with no code changes.\n\n## Features\n\n- 🛡️ **Runtime policy enforcement** — `allow` · `deny` · `transform` ·\n  `require_approval` on every tool call, evaluated inline in milliseconds.\n- 🧾 **Tamper-evident audit** — a hash-chained log of every decision, verifiable\n  across languages.\n- 🔬 **Detection &amp; response (SIEM / EDR)** — findings from prompt-injection,\n  data-exfil kill-chains, repeated-denial bursts, UEBA anomalies, and threat\n  intel, mapped to MITRE ATLAS / OWASP LLM.\n- ⛔ **Containment** — per-entity **quarantine** plus an org-wide **kill-switch**\n  with time-boxed **break-glass** grants.\n- ⚙️ **SOAR playbooks** — match a finding, run the response (quarantine, notify,\n  forward to your SIEM) in priority order; every run recorded.\n- ✅ **AI compliance** — live control-posture mapping to **NIST AI RMF**, the\n  **EU AI Act**, and the **OWASP LLM Top 10**, plus evidence reports with PDF\n  export.\n- 💸 **Cost governance (FinOps)** — meter agent LLM spend; enforce per-agent\n  quotas and org budgets inline.\n- 🔌 **Drop-in MCP proxy** — govern any Model Context Protocol client without\n  touching its code.\n- 🐍 **Python &amp; TypeScript SDKs** — Anthropic and OpenAI middleware with\n  feature parity on the runtime path.\n\n## Use cases\n\n- **Guardrail LLM agents in production** — put a policy-as-code firewall in front\n  of Claude, OpenAI, and MCP tool calls so autonomous agents can't take unsafe or\n  out-of-scope actions.\n- **Detect & block prompt injection and data exfiltration** — catch indirect\n  prompt-injection, jailbreaks, and exfil kill-chains (OWASP LLM01/LLM02/LLM06)\n  and quarantine the offending agent inline.\n- **Human-in-the-loop approvals** — route high-risk tool calls for review instead\n  of denying outright, keeping a full approval trail.\n- **AI agent observability & LLM cost control (FinOps)** — meter per-agent token\n  spend and latency, alert on cost spikes, and enforce budgets before the next call.\n- **Prove AI compliance to auditors** — live control-posture mapping and evidence\n  reports for the **NIST AI RMF**, **EU AI Act**, **ISO/IEC 42001**, and the\n  **OWASP LLM Top 10**.\n- **AI SIEM / EDR** — correlate agent activity into security findings mapped to\n  **MITRE ATLAS**, with SOAR playbooks and an org-wide kill-switch for incident response.\n\n## How it fits together\n\nFour capabilities share one control plane:\n\n1. **Monitoring &amp; alerting** — `AnthropicMonitor` wraps your\n   `anthropic.Anthropic` client and ships a metric event per Claude API call\n   (model, tokens, cache tokens, latency, cost, stop reason, tools used,\n   errors). The control plane stores them, exposes a dashboard, and evaluates\n   threshold **alert rules** (cost spikes, p99 latency, error rate, per-model\n   breakdowns) routed to Slack, PagerDuty, and generic webhooks.\n2. **Runtime policy enforcement** — a declarative policy is evaluated on every\n   tool call, returning `allow` · `deny` · `transform` · `require_approval` with\n   a tamper-evident audit log. Ships starter compliance bundles for NIST AI RMF,\n   ISO/IEC 42001, and the EU AI Act, an `agent_abuse_patterns` hardening bundle\n   (36 rules), and a `prompt_injection` bundle (18 rules) covering\n   prompt-injection, jailbreak, and indirect-injection / data-exfil patterns\n   (OWASP LLM01/LLM02/LLM06). Candidate bundles can be **backtested** against\n   recorded audit history before rollout.\n3. **Detection &amp; response (SIEM / EDR)** — a detection engine correlates the\n   audit + metric stream into **security findings**, each mapped to MITRE ATLAS\n   / OWASP LLM with a triage lifecycle (open → triaging → resolved /\n   false-positive). Findings drive **response**:\n   - **per-entity quarantine** isolates an agent or session (the SDK denies its\n     tool calls inline via `QuarantineGuard`), manually or automatically on a\n     CRITICAL finding;\n   - a **global kill-switch** halts every agent org-wide in one click, with\n     time-boxed **break-glass** for the remediation agent you trust;\n   - **SOAR response playbooks** run a matched finding's actions in priority\n     order — every run recorded and auditable;\n   - findings above a per-org severity threshold are **forwarded** to external\n     SIEM / SOAR systems as OCSF-flavored events.\n\n   Orgs also author their own **detection-as-code** rules — a bounded,\n   structured match (no code/regex, never a ReDoS/RCE vector) run alongside the\n   built-ins.\n4. **Governance** — **live compliance posture** grades the org's controls\n   against NIST AI RMF, the EU AI Act, and the OWASP LLM Top 10\n   (satisfied / partial / gap, with remediation), alongside point-in-time\n   evidence reports with PDF export. **Cost governance** meters agent LLM spend\n   and enforces per-agent quotas and org budgets inline — over budget, the next\n   call is denied.\n\nThese layers feed the same audit + reports surface so security, SRE, and\ncompliance teams work off one source of truth.\n\n## Quickstart\n\nGate an Anthropic agent with the Python SDK:\n\n```bash\npip install ephorate anthropic\n```\n\n```python\nfrom ephorate import EphorateClient, load_bundle  # noqa\nfrom ephorate.middleware.anthropic import gate_response\n\nclient = EphorateClient(\n    bundle_path=\"policy.yaml\",\n    audit_log_path=\"audit.jsonl\",\n    control_plane_url=\"https://ephorate.example.com\",  # optional\n    api_key=\"cp-xxx\",\n    org_slug=\"acme\",\n    default_agent_id=\"research-bot\",\n)\n\n# In your agent loop:\ngated_response = gate_response(\n    anthropic_response, client=client, session_id=session_id\n)\n```\n\nOr govern an MCP server with **no code changes** — point your MCP client at the\nEphorate proxy instead of the upstream server:\n\n```bash\npip install ephorate-mcp\nephorate-mcp --config ephorate-mcp.example.yaml\n```\n\nThe full Quickstart, DSL reference, audit-log spec, and framework-mapping guide\nlive in [`docs/`](docs/).\n\n## Repository layout\n\n```\nengine/          policy engine (Python): types, predicate AST, evaluator,\n                 parser, CLI, JSON-schema export, starter compliance bundles\nsdk-python/      ephorate: Anthropic/OpenAI middleware, audit log, approval flow,\n                 quarantine guard, control-plane shipping\nsdk-typescript/  @ephorate/sdk: TS port with feature parity for the runtime path\nmcp-proxy/       ephorate-mcp: MCP gateway (stdio + streamable-HTTP) wrapping the\n                 policy gate — bearer auth, per-session identity, health probes,\n                 Prometheus metrics, tool-output DLP\ncontrol-plane/   FastAPI + SQLAlchemy + Alembic + Celery: ingestion, search,\n                 approvals, findings, quarantine/kill-switch, SOAR, compliance,\n                 FinOps, compliance reports (with PDF), OAuth\nweb/             Next.js 15 control-plane console (light + dark themes)\ndocs/            Nextra docs site\nexamples/        end-to-end demo agents\n```\n\n## Development\n\nPython workspace via [uv](https://docs.astral.sh/uv/):\n\n```bash\nuv sync --all-packages --all-extras\nuv run pytest engine sdk-python control-plane mcp-proxy\n```\n\nTypeScript workspace via pnpm:\n\n```bash\npnpm install\npnpm --filter @ephorate/sdk test\npnpm --filter ephorate-web build\npnpm --filter ephorate-docs build\n```\n\n## Testing\n\n- **engine** — pytest + Hypothesis property tests + p99 evaluation budget gate\n- **sdk-python** — pytest, including cross-language chain interop with the TS SDK\n- **control-plane** — pytest with FastAPI TestClient against in-memory SQLite\n- **mcp-proxy** — pytest against the policy gate + transport plumbing\n- **sdk-typescript** — Vitest\n\n## Contributing\n\nContributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). Report security\nissues via [SECURITY.md](SECURITY.md).\n\n## License\n\n[Apache 2.0](LICENSE).\n\n---\n\n<sub>Keywords: AI agent security · agentic AI security · LLM guardrails · AI agent\nfirewall · LLM firewall · runtime policy enforcement · policy-as-code for AI ·\ntool-call governance · MCP proxy · Model Context Protocol security ·\nprompt-injection detection · jailbreak & data-exfiltration defense · AI\ngovernance · AI agent observability · LLMOps · LLM cost control / FinOps ·\nhuman-in-the-loop approvals · SIEM / EDR for AI agents · MITRE ATLAS · NIST AI\nRMF · EU AI Act · ISO/IEC 42001 · OWASP LLM Top 10 · tamper-evident agent audit\nlog · Claude & OpenAI middleware.</sub>\n"}