Metadata-Version: 2.5
Name: yagami
Version: 0.8.3
Summary: Open-source AI context firewall for governed model, retrieval, memory, and tool access.
Project-URL: Homepage, https://github.com/MatthewTracy/yagami
Project-URL: Repository, https://github.com/MatthewTracy/yagami
Project-URL: Documentation, https://matthewtracy.github.io/yagami/
Project-URL: Issues, https://github.com/MatthewTracy/yagami/issues
Project-URL: Changelog, https://github.com/MatthewTracy/yagami/blob/main/CHANGELOG.md
Project-URL: Security, https://github.com/MatthewTracy/yagami/security/policy
Project-URL: Roadmap, https://github.com/MatthewTracy/yagami/blob/main/docs/roadmap.md
Author: Matthew Tracy
License-Expression: MIT
License-File: LICENSE
Keywords: ai-gateway,ai-guardrails,ai-security,context-firewall,data-governance,llm,llm-gateway,local-ai,mcp,openai,phi,pii-redaction,policy,privacy,prompt-injection,self-hosted-ai
Classifier: Development Status :: 3 - Alpha
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
Requires-Python: >=3.11
Requires-Dist: aiosqlite>=0.20
Requires-Dist: cryptography>=43
Requires-Dist: fastapi>=0.115
Requires-Dist: httpx>=0.27
Requires-Dist: jsonschema>=4.23
Requires-Dist: mcp<2,>=1.28
Requires-Dist: opentelemetry-api>=1.28
Requires-Dist: prometheus-client>=0.21
Requires-Dist: pydantic-settings>=2.6
Requires-Dist: pydantic>=2.9
Requires-Dist: pyjwt[crypto]>=2.10
Requires-Dist: python-dotenv>=1.0
Requires-Dist: python-multipart>=0.0.20
Requires-Dist: pyyaml>=6.0.2
Requires-Dist: sqlalchemy[asyncio]>=2.0.41
Requires-Dist: sqlite-vec>=0.1.6
Requires-Dist: uvicorn[standard]>=0.32
Provides-Extra: all
Requires-Dist: anthropic>=0.39; extra == 'all'
Requires-Dist: keyring>=25.4; extra == 'all'
Requires-Dist: openai>=2.0; extra == 'all'
Requires-Dist: pypdf>=5.0; extra == 'all'
Provides-Extra: desktop
Requires-Dist: keyring>=25.4; extra == 'desktop'
Provides-Extra: dev
Requires-Dist: anthropic>=0.39; extra == 'dev'
Requires-Dist: keyring>=25.4; extra == 'dev'
Requires-Dist: mypy<3,>=1.15; extra == 'dev'
Requires-Dist: openai>=2.0; extra == 'dev'
Requires-Dist: pypdf>=5.0; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
Requires-Dist: pytest-cov>=6.0; extra == 'dev'
Requires-Dist: pytest>=8.3; extra == 'dev'
Requires-Dist: ruff<0.17,>=0.7; extra == 'dev'
Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
Provides-Extra: ingest
Requires-Dist: pypdf>=5.0; extra == 'ingest'
Provides-Extra: observability
Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.28; extra == 'observability'
Requires-Dist: opentelemetry-sdk>=1.28; extra == 'observability'
Provides-Extra: production
Requires-Dist: alembic>=1.16; extra == 'production'
Requires-Dist: asyncpg>=0.30; extra == 'production'
Requires-Dist: redis>=5.2; extra == 'production'
Provides-Extra: providers
Requires-Dist: anthropic>=0.39; extra == 'providers'
Requires-Dist: openai>=2.0; extra == 'providers'
Description-Content-Type: text/markdown

# Yagami

<!-- mcp-name: io.github.MatthewTracy/yagami -->

**Open-source AI context firewall for governed model, retrieval, memory, and
tool access.**

[![CI](https://github.com/MatthewTracy/yagami/actions/workflows/ci.yml/badge.svg)](https://github.com/MatthewTracy/yagami/actions/workflows/ci.yml)
[![Python](https://img.shields.io/pypi/pyversions/yagami.svg)](https://pypi.org/project/yagami/)
[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/MatthewTracy/yagami/blob/main/LICENSE)

Yagami is a self-hosted LLM gateway and policy boundary for applications and
AI agents. It classifies context locally, maps destinations to trust zones,
applies versioned policy, governs tool execution, and records content-free
evidence. Existing OpenAI SDK applications can adopt it by changing one
`base_url`.

## Try it in 60 seconds

Choose one command:

```bash
uvx yagami demo
# or: python -m pip install yagami && yagami demo
# or: docker run --rm -p 127.0.0.1:8000:8000 ghcr.io/matthewtracy/yagami:latest yagami demo --host 0.0.0.0 --allow-remote
```

Open [http://127.0.0.1:8000](http://127.0.0.1:8000). The no-credential demo
uses the configured Ollama model when it is installed and otherwise presents a
clearly labeled policy-only fallback. It disables cloud routing while still
exercising classification, policy, lineage, storage, and audit behavior.

For local model-backed answers, install Ollama, run
`ollama pull llama3.2:3b-instruct-q4_K_M`, and restart the demo.

[Watch the two-minute demo](https://github.com/user-attachments/assets/a7be9449-eafc-4acb-99b6-ea39edc43cd2).

## Protect an application

```bash
yagami init
yagami doctor
yagami serve
```

```python
from openai import OpenAI

client = OpenAI(
    base_url="http://127.0.0.1:8000/v1",
    api_key="your-yagami-project-key",
)

response = client.chat.completions.create(
    model="yagami-auto",
    messages=[{"role": "user", "content": "Summarize this document."}],
    metadata={"sensitivity": "none", "purpose": "internal-documentation"},
)
print(response.choices[0].message.content)
```

Install `yagami[providers]` when the Yagami process or example client needs
Anthropic/OpenAI-compatible SDKs. PDF extraction uses `yagami[ingest]`, OS
keyring storage uses `yagami[desktop]`, and `yagami[all]` retains the previous
batteries-included behavior.

## What Yagami enforces

- **Sensitive-context containment.** Caller labels and local detectors can
  force PHI, clinical context, credentials, and inherited sensitive history to
  device/private-network backends.
- **Governed tools.** Function tools and MCP calls pass through policy, schema
  checks, risk controls, and optional identity-bound one-time approvals.
- **Retrieval and memory boundaries.** Namespaces, provenance, labels, TTLs,
  quarantine, and policy govern stored and retrieved context.
- **Content-free evidence.** Policy passports, audit chains, metrics, and traces
  carry labels, hashes, reason codes, counts, and timing rather than prompts,
  completions, retrieved text, or tool arguments/results.
- **Self-hosted operations.** Use SQLite locally or PostgreSQL plus distributed
  coordination for production. Containers, Compose, Helm, Prometheus,
  OpenTelemetry, backup/restore, and signed policy bundles are supported.

Yagami exposes OpenAI-compatible Chat Completions and core Responses APIs plus
Streamable HTTP MCP. It works with local Ollama, explicitly configured
llama.cpp, Foundry Local, direct cloud providers, and existing
OpenAI-compatible gateways. Frameworks can use the standard endpoint without
bypassing the same policy and evidence pipeline.

## Limits and trust

Yagami is alpha software and an enforcement component, not a compliance
certification. Detection can miss sensitive or malicious content. Strict
deployments should declare known sensitivity at the caller, fail closed, use a
local-only policy where appropriate, test organization-specific cases, and
review the threat model before production use. Telemetry is disabled by
default.

- [Documentation](https://matthewtracy.github.io/yagami/)
- [Five-minute security tour](https://matthewtracy.github.io/yagami/tour/)
- [Gateway API](https://matthewtracy.github.io/yagami/gateway/)
- [Comparison guide](https://matthewtracy.github.io/yagami/comparison/)
- [Deployment guide](https://matthewtracy.github.io/yagami/deployment/)
- [Threat model](https://matthewtracy.github.io/yagami/threat-model/)
- [Benchmark method and results](https://matthewtracy.github.io/yagami/benchmarks/)
- [Security policy](https://github.com/MatthewTracy/yagami/security/policy)
- [Roadmap](https://github.com/MatthewTracy/yagami/blob/main/docs/roadmap.md)

