Pistra

pistra is the AI enforcement layer. Every model, tool and agent call is checked against your policy in line. Every decision leaves a signed record you can prove to anyone. It is one Go binary on the path between your applications and AI providers. OpenAI and Anthropic SDKs, MCP clients, agent-to-agent traffic and realtime WebSocket sessions all point at it. Each request is checked against a gateway-issued virtual key, access rules and token budgets, then inspected by the guardrail detectors you configure. pistra swaps in the real provider credential and forwards the request. A request that needed no change is forwarded byte for byte. What it enforces: - Personal data and secrets: 83 identifier types, 51 of them checksum-validated, and 19 credential kinds, found and redacted in prompts and in streamed responses. - Prompt injection and jailbreaks: a classifier or an LLM judge, on the user's turn and on tool results. - Access and spend: per-team profiles, model allowlists, access rules and token budgets. - Silent degradation: a body it could not inspect is counted, and a translation that would drop a capability the request uses is refused. Each decision is signed by the node that made it and chained to the one before, in a store you hold. A third party can verify the chain without trusting the node that wrote it. AI governance platforms draw on that record as their evidence source. pistra is self-hosted, on Kubernetes with a Helm chart or on VMs, as a raft-backed cluster with no external database. It also runs as an inspector behind a gateway you already have, over Envoy ext_proc, enforcing policy on traffic it does not route.