https://github.com/danieljustus/symaira-guard
A local-first security gateway for AI agents, MCP servers, and Symaira toolchains.
https://github.com/danieljustus/symaira-guard
ai-security go llm mcp policy-engine
Last synced: 7 days ago
JSON representation
A local-first security gateway for AI agents, MCP servers, and Symaira toolchains.
- Host: GitHub
- URL: https://github.com/danieljustus/symaira-guard
- Owner: danieljustus
- License: mit
- Created: 2026-06-26T15:44:24.000Z (28 days ago)
- Default Branch: main
- Last Pushed: 2026-06-26T18:03:29.000Z (28 days ago)
- Last Synced: 2026-06-26T18:09:08.563Z (28 days ago)
- Topics: ai-security, go, llm, mcp, policy-engine
- Language: Go
- Homepage: https://symaira.com/
- Size: 40 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
- Security: .github/SECURITY.md
- Agents: AGENTS.md
Awesome Lists containing this project
README
# Symaira Guard (`symguard`)
> A local-first security gateway for AI agents, MCP servers, and Symaira toolchains.
**Human control for agent autonomy.**
[](https://github.com/danieljustus/symaira-guard/actions/workflows/ci.yml)
[](https://go.dev/)
[](https://github.com/danieljustus/symaira-guard/blob/main/LICENSE)
---
## What
`symguard` sits between AI clients and the tools they call. It inspects every MCP tool call, classifies risk, enforces local policy, asks for human approval when needed, and records tamper-evident audit trails.
```
AI client / agent → symguard → MCP servers / CLIs / APIs / Symaira tools
```
The agent still gets useful tools. The human keeps enforceable boundaries.
## Why
MCP solved interoperability between AI clients and tool servers. It did not solve:
- Tool poisoning and rug-pull attacks (changed tool descriptions)
- Prompt injection escalating into tool calls
- Unbounded shell / filesystem / network / secret access
- Missing human approval for risky operations
- Secret exfiltration through tool output
- Cross-agent delegation risk
`symguard` is the missing local control layer.
## Quick demo
```bash
$ symguard version
symguard v0.1.0 (commit abc1234, built with Go 1.26)
$ symguard doctor
✓ CLI config found at ~/.config/symguard/config.toml
✓ XDG paths OK
✓ Go runtime 1.26+ detected
✓ MCP clients found: hermes, claude, cursor
→ For more detail: symguard scan
$ symguard scan --client hermes
✓ Scanned Hermes (3 MCP servers, 17 tools)
symmemory memory_search, memory_set, entity_list 1 tool changed
symvault get, set, search, health 4 tools, stable
filesystem read, write, grep, glob, ... 7 new tools
Policy summary: 12 tools allow, 4 tools ask, 1 tool deny
```
## What it does
### 1. Scan
Discover MCP servers configured across local AI clients and classify their tools by risk.
```bash
symguard scan # scan all clients
symguard scan --client hermes # scan one client
symguard scan --format json # machine-readable output
```
### 2. Policy
Define local rules that decide what gets through:
```toml
[defaults]
shell = "ask"
read_secret = "deny"
write_file = "ask"
[[rules]]
match.server = "symmemory"
match.tool = "memory_search"
decision = "allow"
[[rules]]
match.command_contains = ["rm -rf", "curl | sh"]
decision = "deny"
```
Decisions: `allow`, `ask`, `deny`, `redact`, `readonly`, `sandbox`.
### 3. Proxy
Run as an MCP proxy that enforces policy per tool call:
```bash
symguard proxy --config ~/.config/symguard/config.toml
```
Each tool call is classified, policy-checked, optionally approved by a human, then forwarded upstream. Sensitive output can be redacted before it reaches the agent.
### 4. Pin
Store hashes of MCP tool descriptions and schemas. If a tool's description changes (hidden instructions, scope expansion), `symguard` flags it:
```
WARNING: Tool schema changed for server "filesystem" tool "read_file".
Policy: require re-approval
```
### 5. Audit
Append-only local audit log with hash chaining. Records what was requested, which policy matched, who approved, what executed, and what came back.
### 6. Remote access
Later phases add agent-aware remote MCP access over existing transports (SSH, Tailscale, LAN/mDNS) — not a new VPN, but policy and audit on top of tools you already trust.
## Risk classes
| Risk | Examples | Default |
|------|----------|---------|
| `read_public` | docs, README, public web | allow |
| `read_private` | repo files, notes, local docs | allow or ask |
| `read_secret` | `.env`, SSH keys, vault entries | ask / deny |
| `write_file` | patch, overwrite, create file | ask |
| `shell` | command execution | ask |
| `network` | outbound API / web requests | ask |
| `browser` | cookies, sessions, web automation | ask |
| `credential_use` | using secrets without revealing them | ask once / scoped |
| `deploy` | release, push, infra mutation | ask every time |
| `destructive` | delete, wipe, reset, revoke | ask / deny |
## Symaira ecosystem position
`symguard` is a **public, self-hosted core** tool. No Pro, tenant, or billing code.
```
┌─────────────────────────────────────────┐
│ AI clients / agents │
│ Hermes · Claude · Cursor · OpenCode ... │
└───────────────────┬─────────────────────┘
▼
┌──────────────┐
│ symguard │ ← trust boundary
└──────┬───────┘
▼
symvault · symmemory · symscope · symseek · ...
```
Optional runtime integrations, no compile-time dependencies on siblings.
## Principles
- **Local-first.** Policy decisions happen on your machine. No mandatory cloud account.
- **Boring is good.** No custom VPN, no NAT traversal, no WireGuard daemon. Reuse existing transports.
- **Discovery ≠ trust.** Finding a remote MCP server never auto-implies permission.
- **Agent identities.** Agents and runs are first-class identities with TTL and scoped grants.
- **Explainable.** Every decision has a reason. Simulate before acting. Diagnose after failing.
## Non-goals
Not a chat frontend, not a SIEM, not a cloud-only SaaS, not a VPN replacement, not a full endpoint protection platform.
> Classify agent tool calls, enforce local policy, ask the human when needed, and record what happened.
---
## Build
Requires Go 1.26+. No external dependencies — only the Go standard library.
```bash
# Build the binary
make build
# Run tests
make test
# Lint (golangci-lint or go vet fallback)
make lint
# Set a version string at build time
make build VERSION=v1.0.0
```
Or directly with `go`:
```bash
go build -ldflags "-X main.version=dev" -o symguard ./cmd/symguard
go vet ./...
go test ./...
```
### Quick start
```bash
./symguard version # print version and build info
./symguard doctor # check system health
```
## Status
Early development. See [docs/intern/IDEA.md](docs/intern/IDEA.md) for the full design document.