What is Suvra?

Suvra stops your AI agents from destroying things.

Autonomous coding and ops agents are now routinely given real shell, database, and cloud access — and they occasionally use it to catastrophic effect: a widely-reported incident where a coding agent wiped a production database during a code freeze, agents that have deleted files and entire inboxes while "cleaning up," and runaway tool-call loops that fire the same destructive command hundreds of times before anyone notices. Suvra sits between your agent and the real world so the first time it tries something like that, it gets blocked instead of executed.

It takes zero configuration to start — the Quickstart goes from pip install suvra to a protected agent in about five minutes. Decisions come from a deterministic classifier and policy engine: no LLM in the path, no network calls, and every decision shows exactly which rule fired (Core Concepts has the details).

The action layer for AI agents

Because Suvra sits in the action path — not observing your agents from outside — every action your agents take becomes an asset. Three pillars, and every dashboard module belongs to exactly one:

Control — block catastrophic actions, gate risky ones for a human, allow safe ones through. This is the firewall: the zero-config classifier, the deny-by-default policy engine, the rules library and simulator, human approvals, and agent registration all live here.
Record — nothing passes through invisibly. Every decision lands in an explainable audit trail that rolls up into SOC 2, NIST AI RMF, and ISO 27001 compliance reports, and into durable institutional memory.
Compound — the record becomes signal. Evals catch quality drift, the Learning Loop turns every block into a lesson, and Analytics tracks pass/deny rates and cost-to-outcome over time.

Runtime, Gateway, and Nodes are how this scales — policy-gated agent-to-agent delegation, a workflow engine and MCP server registry (Preview), and distributed enforcement nodes near your agents — infrastructure underneath the three pillars, not a fourth one.

What Suvra is not

Not a workflow engine. Suvra does not orchestrate agent steps, manage state machines, or define task graphs. Your agent runtime handles orchestration — Suvra enforces the boundary between intent and execution.
Not an LLM wrapper. There is no language model anywhere in the enforcement path. Suvra does not interpret, summarize, or rewrite agent actions. It evaluates them deterministically.
Not a prompt guard. Suvra operates at the action layer, not the prompt layer. It does not inspect, filter, or modify LLM inputs or outputs. It evaluates the structured actions that agents request to execute.

Two modes: local firewall, shared control plane

Suvra works two ways, and you can start with the first and grow into the second:

Local, zero-config firewall (Free)

pip install suvra gives you the CLI, the local firewall (zero-config classifier plus local policy engine), a local dashboard, and a local SQLite audit trail — self-hosted forever, one agent, free including production use under Apache-2.0.

Shared control plane (Team / Enterprise)

When you need more than one agent or one laptop, the same package scales into a shared control plane: one dashboard, one audit trail, and one policy set across your team, plus Slack approvals, Evals, the Learning Loop, Analytics, and (at Enterprise) RBAC, SSO-ready identity, compliance report packs, and fail-closed enforcement nodes near your agents. See Deployment.

License

Suvra is Apache-2.0 licensed — free and open source, including production use, for every tier. Paid tiers are the hosted control plane and team features, never permission to run the software. See Pricing.

Quickstart — install and protect your first agent
Core Concepts — the classifier, actions, decisions, and architecture
Agent Runtimes — Claude Code, Codex, Hermes, OpenClaw, any MCP server