The open-source
AI agent firewall.
Write a CEL rule. Strathon blocks the tool call before it executes, in-process, in under a millisecond. Three lines of code, ten frameworks, self-host in minutes.
Built on open standards, no black boxes
Wrap your agent. Keep your code.
from strathon import Client, instrument
client = Client(api_key="stra_...") # endpoint defaults to localhost:4318
instrument(client, frameworks=["crewai"])
# tool calls now pass the policy engine before executingSend an attack. Watch the verdict.
A control plane for everything your agents do.
CEL Policy Engine
Seven enforcement actions, 12 OWASP templates, and a shadow mode that tests policies against live traffic without blocking it.
Human Approval
Pause agent execution until an operator approves. Multi-party sign-off for high-stakes actions.
70+ Credential Patterns
Detect AWS keys, GitHub tokens, Stripe keys, private keys and more, redacted at ingest.
EU AI Act Evidence
Evidence export for Articles 9–15 & 19. NIST AI RMF risk scoring built in.
Behavioral Drift Detection
EWMA/CUSUM statistical analysis flags when an agent silently changes behavior.
Dashboard
Trace waterfall, policy editor, approval cards, audit log, and budget charts in one operator console.
Every agent action, on one screen.
A live trace waterfall of tool calls and model invocations, with the exact policy verdict on every span, including what got blocked and why.
Works with the agent stack you already use
Throughput depends on your hardware and database, so Strathon ships a reproducible benchmark you run yourself rather than quoting a single number. See the scaling guide.
Anchored on the OWASP Top 10 for Agentic Applications (2026).
Free forever, on your own infrastructure.
No license keys. No phone-home. Clone the repo, run Docker Compose, open the dashboard, and create your first policy. The full firewall (every scanner, every framework integration) is open source.
Read the quickstartgit clone https://github.com/strathon/strathon.git
cd strathon
docker compose up -d
# open localhost:3000: register, create a policy, doneLatest releases.
- ›Every enforcement surface now fails closed when it cannot confirm a call is allowed. An enforcing policy whose expression cannot be evaluated blocks the call rather than letting it through, and the full policy set is evaluated first, so one policy's error no longer drops another policy's match on the same span.
- ›The MCP gateway and egress proxy fail closed: the gateway validates the upstream address and ignores any caller request to turn its enforcement off, and the egress proxy blocks until it has loaded the project's policy, rather than starting open.
- ›Every SDK adapter fails closed when the receiver is unreachable, and policies are evaluated against the full tool arguments, so a padded argument cannot slip content past a rule.
- ›Project and member operations are confined to the caller's organization, closing cases that could read or act across tenants. Creating an API key or deleting a project now requires re-authentication.