™
Menu

Straza governs what your AI agents do.

Your identity governance system decides who. Straza enforces what their agents may do, at every action. A shell command, a file write, a network fetch, or an MCP tool call is decided against signed policy before it runs. Gated calls wait for a person. Every decision is written to a hash chain you can re-verify. Straza is one self-hosted binary.

Open source, launching September

Straza hooks into Claude Code, Codex, and Gemini CLI, and fronts every MCP server you run.

One recorded run against production. A governed Claude Code session calls an MCP tool, the call holds under policy, an approver decides on a phone, and the call completes with its result.

Straza sits between your agents and their tools

Straza sits on the path between your agents and everything they call. It takes identity from the identity governance system (IGA) you already run, and every MCP server sits behind its gateway.

FIG 1 · Agents are hooked, or restricted so that straza exec is the only shell they get. Identity comes from your IGA, every MCP server sits behind the gateway, and audit events stream one way to your SIEM.

Your IGA grants the roles that expose tools.

You create roles in Straza and bind tools to them; your IGA imports the roles and decides who holds each one. The catalog is default deny, so an unbound tool does not exist for the session. Every agent identity carries a sponsor: the human your IGA names as accountable for it.

  1. The IGA creates the agent with a sponsor.

  2. A role in Straza binds the tools.

  3. Your IGA imports the role at its next sync.

  4. An operator assigns the role to the agent.

  5. Straza receives the membership over SCIM/REST.

  6. The session picks it up at its check-in.

  7. The agent's catalog lists the new tools.

FIG 3 · A role created in Straza, imported by your IGA at its next sync, assigned to the agent, and picked up by the running session at its next check-in. With midPoint as the IGA, about ten seconds to the import and about thirty to the running session with the daemon connected.

Approvals are signed on the device

Every decision is signed on the device by a hardware key that is generated there and never leaves it. If the phone is lost, an administrator revokes it server-side, its token stops working, and the pairing is gone.

Available nowApp Store Available nowGoogle Play Coming soonF‑Droid

On iPhone and Android today. The console, Slack, and the CLI stay approver channels alongside the phone.

FIG 2 · The approver app decides two requests, a call held now and a day-scale ticket, each signed after the device PIN. The film ends on the decision history and an enrollment scan stopped by the key-protection dialog.

One gateway, one policy, one audit chain

Every MCP server behind one endpoint

strazad fronts your MCP servers as one governed endpoint. Drop a server in and its tools are cataloged, but nothing is exposed until a role binds to it. Hooks cover Claude Code, Codex, and Gemini CLI. A stdlib-only Python agentkit covers tool loops. Same signed policy on all of them.

A decision at every action

The same policy engine runs at every entry point, against the same signed policy: on the machine for shell, file, and network actions, and in the gateway for MCP calls. A deny carries a reason the model can read. Obfuscated shells like base64 | sh are normalized and classified before the decision, not passed through as opaque strings.

Upstream credentials stay at the gateway

Secrets and OAuth grants for your MCP upstreams are injected gateway-side, so a prompt-injected model cannot exfiltrate what never entered its context.

Human approval, resolved by role

A mode: approve rule names which approver roles may decide; a rule that names nobody falls to the agent's sponsor. Membership is resolved at decision time, not baked into the policy snapshot. Decide from any approver channel. An approval nobody answers is a deny.

Tamper-evident audit

Every decision is written to a SHA-256 hash chain you can re-verify yourself. Writing is asynchronous, so audit never blocks a tool call. Conversation capture, verbatim or redacted per policy, joins the same chain, and events stream to your SIEM over signed webhooks or a file sink. Hunt a leaked secret across captured transcripts by hashing it locally; the plaintext never travels.

Identity from your IGA

Agents log in through your OIDC provider and are provisioned over SCIM 2.0 from your IGA (midPoint is the reference), including non-human identities, each carrying its sponsor. Disable the identity in your IGA and its sessions die, p99 under 2 seconds with the daemon connected.

Your IGA decides who holds a role

You create roles in strazad and bind tools to them; the catalog is default deny, so without a binding a tool does not exist for the session. Your IGA imports the roles and manages membership over SCIM 2.0.

How it runs

Self-hosted

No vendor in the path

No managed cloud, no callout to us at decision time. The binary runs on your infrastructure.

Fail-closed

Deny on unknown

If the platform is unreachable, an approval-gated call denies within two seconds, and local decisions continue only inside the signed snapshot's bounded grace window: zero by default in the enterprise profile.

Scales

One binary, laptop to Kubernetes

No database reads on the request path, and tokens that verify themselves.

Open source

AGPL-3.0 core

Core under AGPL-3.0, SDKs and spec under Apache-2.0. Built in Slovakia.

No AI runs inside the product: enforcement is deterministic policy evaluation.

Run it yourself at launch

Straza is open source and self-hosts from a single binary. Launch ships the code, the docs, and a one-command eval stack that boots an IGA, an OIDC provider, a governed MCP gateway, and a live approval gate on one machine. Launch is September 2026.