Pistra

pistra is the AI enforcement layer. Every model, tool and agent call is checked against your policy in line. Every decision leaves a signed record you can prove to anyone.

It is one Go binary on the path between your applications and AI providers. OpenAI and Anthropic SDKs, MCP clients, agent-to-agent traffic and realtime WebSocket sessions all point at it. Each request is checked against a gateway-issued virtual key, access rules and token budgets, then inspected by the guardrail detectors you configure. pistra swaps in the real provider credential and forwards the request. A request that needed no change is forwarded byte for byte.

What it enforces:

• Personal data and secrets: 83 identifier types, 51 of them

checksum-validated, and 19 credential kinds, found and redacted in prompts and in streamed responses.

• Prompt injection and jailbreaks: a classifier or an LLM judge, on the

user's turn and on tool results.

• Access and spend: per-team profiles, model allowlists, access rules

and token budgets.

• Silent degradation: a body it could not inspect is counted, and a

translation that would drop a capability the request uses is refused.

Each decision is signed by the node that made it and chained to the one before, in a store you hold. A third party can verify the chain without trusting the node that wrote it. AI governance platforms draw on that record as their evidence source.

pistra is self-hosted, on Kubernetes with a Helm chart or on VMs, as a raft-backed cluster with no external database. It also runs as an inspector behind a gateway you already have, over Envoy ext_proc, enforcing policy on traffic it does not route.