Siphrix in one paragraph

Siphrix is an AI Action Firewall & Policy Runtime. It sits between what an AI agent wants to do and what it is allowed to do: every action is evaluated against a policy before it executes, an auditable decision trail is emitted, and the system fails closed when in doubt.

Under the hood it is four coordinated layers — a policy decision layer, a runtime enforcement layer, a trust / audit / governance layer, and an operator readiness surface — but externally it is one product: the boundary between agent intent and real-world action.

Quickstart

The canonical first-run path is three commands — fully offline.

pip install siphrix
siphrix demo      # the block / allow / audit walkthrough
siphrix doctor    # human-readable launch-readiness report

siphrix demo is the golden path: it prints a blocked unsafe action, an allowed safe action under the shipped safe_defaults pack, and an auditable decision-trail recap.

Core concepts

Verdicts

Every evaluation returns exactly one outcome, a machine-readable reason code, and the material for an audit record.

Fail-closed

When policy is missing, ambiguous, or evaluation cannot complete, Siphrix denies. An empty allowlist blocks everything (policy_empty_allowlist). Safety is the default state, not a configuration you must remember to switch on.

Policy packs

Policies ship as packs — versioned, optionally ED25519-signed bundles of rules. The shipped safe_defaults pack allows ordinary read/inert actions and blocks destructive, financial and exfiltration categories. You layer your own rules on top.

Policy schema

A policy is a declarative document of rules matched against an action and its context. Each rule yields an effect; the engine resolves them deterministically and fails closed.

# _demo_policy.yaml — minimal example
version: "4"
rules:
  - match: { category: read }
    effect: allow
    reason_code: safe_defaults_allow
  - match: { category: destructive }
    effect: block
    reason_code: policy_block_destructive
  - match: { category: exfiltration }
    effect: block
    reason_code: policy_block_exfiltration

CLI

The siphrix command is the front door to everything local.

Run siphrix --help to discover every subcommand and its flags.

Python SDK

Evaluate any action from your own code in two lines. The public surface is small and stable.

from siphrix import ActionEvaluator, PolicyManager

evaluator = ActionEvaluator()                  # loads active policy
verdict = evaluator.evaluate(action, context)  # → outcome, reason_code, …

if verdict.outcome != "ALLOW":
    raise Blocked(verdict.reason_code)        # do not run the action

For a full pipeline (normalize → evaluate → record), use run_pipeline(user_text). The repo walkthrough at examples/example_agent.py is a deeper integration tour.

Daemon API

The local loopback daemon (siphrix serve --foreground) exposes 20+ bearer-authed routes. The console, extensions and editors all talk to it. Highlights:

MCP server

A verdict-only Model Context Protocol server over stdio lets any MCP client ask Siphrix for a decision before acting.

python -m siphrix.mcp                         # start the stdio server
python -m siphrix.mcp.client_config --client codex   # wire into a client

Editors & agents

VS Code extension

Health, evaluate and audit with Allow / Block / Pause control over /rules, in the editor. Marketplace id siphrix.siphrix-vscode.

Claude Code plugin

A PreToolUse hook, block-only and fail-closed — every tool call is gated before it runs. Repo Ghengeaua/siphrix-claude-plugin.

Codex / generic agent bridge

Verdict tools via MCP plus a client-config generator: siphrix.console.ai_tool_bridge.

Browser extension

An MV3 extension and JS SDK gate uploads and secret-pastes into AI sites via the local daemon. It supports account login and a per-platform restriction choice (Off / Basic / Strict) from the popup. Dev-load today; store publishing is an operator step.

Service tier

A real, persistent local service: SQLite storage, hashed API keys (PBKDF2), RBAC, tenant isolation, a decision API, audit ingestion and approvals — loopback only.

python -m siphrix.service        # start the service tier

Console & dashboard

Siphrix ships three operator surfaces, all unified in the web console on this site:

• Account console — pick a protection level (Off / Basic / Strict) per AI app in plain language; power users add scoped block-rules.
• Operator dashboard — Overview, Readiness, Release state, Runtime, Policy Packs, Policy Check, Demo and Audit.
• Web console — Simulator, Audit, Rules and Approvals against the local daemon.

The console talks only to the local daemon / service. The session token stays in page memory; nothing is persisted to browser storage.

Audit & replay

Every decision produces an audit record. Records are redactable and can be exported (JSON/CSV) or bundled into a portable evidence bundle. The trust layer adds ED25519 policy signing and an integrity-chained ledger.

Replay re-decides historic actions under a candidate policy, so you can measure the impact of a change before shipping it.

Capabilities — the honest table

Every surface is labelled by maturity, on purpose. See the interactive matrix on the home page. The three levels:

Nothing is overclaimed. Where a surface is contract-only or external, the code and the table say so plainly.

Security posture

• Fail-closed on missing/ambiguous policy and on evaluation failure.
• No silent execution — /evaluate is decision-only; the broker is record-only by default and real backends are opt-in in code.
• Token hygiene — bearer/session tokens stay in memory; never written to storage or logs.
• Signed policy — ED25519 signing + verification and an integrity-chained ledger.
• Tenant isolation in the service tier; hashed API keys (PBKDF2); RBAC.

External handoffs

Some capabilities cannot be made real inside the repository — they need credentials, hosting, store accounts or platform signing that live with the operator. Siphrix builds everything up to that boundary as real, tested code, then stops. It never simulates these as if done.

Roadmap

Siphrix is at v1.0.2, a private-beta candidate. Direction of travel: hardening the enforcement bridges, expanding signed-policy distribution, deepening the governance models from contract toward shipping, and the operator-credentialed steps above. See ROADMAP.md in the repository for the ordered list.