Suvra — the action layer for AI agents
Stop your AI agents from destroying things.
Your agents now have real shell, database, and cloud access. Suvra sits between them and the real world — blocking catastrophic actions, gating risky ones for a human, and recording every decision. Deterministic, sub-millisecond, no LLM in the path.
Apache-2.0 open source · pip install suvra · Works with Claude Code, Codex, OpenClaw, Hermes & any MCP server
$ suvra demo
Suvra — agent action firewall
No policy file. No setup. Just the built-in guardrail classifier.
[1/4] rm -rf / --no-preserve-root BLOCKED (catastrophic: destructive shell)
[2/4] DROP TABLE customers; BLOCKED (catastrophic: destructive SQL)
[3/4] rm -rf build/ NEEDS APPROVAL (risky: destructive shell)
[4/4] fs.write_file workspace/notes.txt ALLOWED (safe)
Protected in five minutes
$ pip install suvra
$ suvra demo # watch it block catastrophic actions
$ suvra init claude-code # protect Claude Code with a PreToolUse hook
$ suvra mcp wrap -- npx -y @modelcontextprotocol/server-filesystem .All four runtimes verified end-to-end against the real agent binaries — not mocks.
What it catches
A deterministic, zero-config classifier runs before any policy engine — no LLM, no network call, sub-millisecond.
Destructive shell
Blockedrm -rf, mkfs, dd of=/dev/*, fork bombs, chmod -R 777, curl | bash
Destructive SQL
BlockedDROP TABLE, TRUNCATE, DELETE/UPDATE without WHERE (incl. via psql/mysql -e)
Force-push / history rewrite
Blockedgit push --force to protected branches, git reset --hard
Infra destroy
Blockedkubectl delete, terraform destroy / -auto-approve
Secret-file access
Gated for approval.env, private keys, credential files
Mass deletes
Gated for approvalbulk file/record deletion above a safe threshold
Every action becomes an asset
Suvra sits in the action path, not observing from outside. The same stream that blocks catastrophic actions also powers audit, compliance, evals, and analytics.
Control
Block catastrophic actions, gate risky ones for a human, allow safe ones through. Zero-config classifier, deny-by-default policy engine, 60+ rule library, simulator, and human approvals in Slack.
Record
Nothing passes through invisibly. Every decision lands in an explainable audit trail that rolls up into SOC 2, NIST AI RMF, and ISO 27001 compliance reports — and into durable institutional memory.
Compound
The record becomes signal. Evals catch quality drift, the Learning Loop turns every block into a lesson, and Analytics tracks pass/deny rates and cost-to-outcome.
Why Suvra
Deterministic, not another ML classifier
Regex/parser decisions, reproducible, sub-millisecond, you see exactly which rule fired.
In the action path, not watching from outside
It can actually stop an action, and every action becomes an audit, compliance, and eval asset.
Works when the agent's own guardrails don't
Verified live: blocked a real rm -rf under Codex running with --dangerously-bypass-approvals.
Zero-config to start, full policy engine when you need it
And Apache-2.0 open source, free including production.
How it scales
Enforcement Nodes
Fail-closed, offline-capable, deployed near your agents.
A2A delegation
Agent-to-agent delegation, policy-gated through the same engine.
Runtime & Gateway
PreviewWorkflow engine, MCP server registry, deployment templates.
Pricing
Free
$0
CLI, local firewall, local dashboard, 1 agent.
Apache-2.0 · self-hosted forever
Team
$199/mo
Up to 10 agents, Slack approvals, shared control plane, Evals + Learning Loop + Analytics.
Managed from inside the app
Enterprise
Custom
SSO-ready + RBAC, compliance report packs, enforcement nodes, priority support.
sales@suvra.io