Guardrails for every surface an agent can act through.
Not just a local file guardrail. One policy engine covering filesystem, APIs, browsers, custom-built agents, and the OS itself.
Blocks dangerous actions, everywhere an agent can act
Every action, a file delete, an API call, a browser click, a custom agent's tool call, runs through the same decision cascade. Resolve the principal, classify the risk tier, apply the policy matrix, execute fail-closed. On-device, APIs, browsers, and the OS itself all run on one engine.
API & tool protection, in-path and unbypassable
For Stripe, GitHub, databases, or any MCP server, Praxis runs as a gateway proxy, so agents never talk to the real service directly. This covers custom-built agents automatically. Anything that speaks MCP is already governed, regardless of which framework built it.
Refuses your secrets, categorically
SSH keys, cloud credentials, browser keychains, and .env files are treated as the highest risk tier. This is not a per-agent setting you can loosen. The matcher checks the actual action and path, not the wording of the prompt.
A tamper-proof audit trail
Every decision, allowed, blocked, or escalated, is SHA-256 hash-chained to the one before it. If any past entry is edited, every hash after it breaks. You can always answer what this agent actually did, and when.
Works fully offline
Risk classification runs on a local embedding model, policy decisions evaluate on-device, and natural-language search can run through a local model via Ollama. Nothing depends on a server we operate, since there isn't one in the free edition.
Built for distributed and custom agents
The same policy engine that governs one laptop governs a fleet. Team plans add central policy management and a fleet-wide audit dashboard across every agent and service, custom-built or off-the-shelf.