Repolode
Submit
archestra-ai

archestra-ai/OpenAPPA

A deterministic policy engine that sits between AI agents and their tools, blocking tool calls that would send sensitive data to unauthorized destinations.

View on GitHubWebsite
Stars
1,619
Forks
70
Open issues
24
Last commit
9 hours ago

What is it?

OpenAPPA sits between an agent and its tools and checks each tool call before it runs, asking whether the data involved is allowed to go to the destination. It tracks the sensitivity and trust level of everything an agent reads, so sensitive data does not reach an unauthorized tool. It is built on APPA, an information-flow policy model.

Policies are written in declarative TOML. The engine decides from the event log alone and makes no network or file calls, so the same log always yields the same decision. Unlike classifiers and PII detectors, which are probabilistic, this check is deterministic. It can run in-process or as a sidecar process that checks each tool call.

The project is in preview and RFC status, and its configuration and wire interfaces may change. The CLI offers `appa describe --check` to validate configuration and `appa replay` to test scripted tool calls against expected decisions, so policy can be verified in CI before merging. Integrations include a Claude Code plugin and the Archestra LLM proxy.

Key features

  • 01Checks every tool call against data sensitivity and destination before execution.
  • 02Declarative policy written in TOML.
  • 03Deterministic decisions derived solely from the event log.
  • 04Runs in-process or as a sidecar process.
  • 05Includes CLI commands to validate configuration and replay tool-call tests in CI.
  • 06Provides a Claude Code plugin and works with the Archestra LLM proxy.

Use cases

  • Preventing an agent from posting private meeting content to a public repository.
  • Enforcing data-flow rules for enterprise agents that access internal documents and external tools.
  • Adding policy tests to CI so configuration changes are validated before merge.

Quick start

  1. 1

    Run the official install script from the README

  2. 2

    Install the Claude Code plugin

    ~/.local/bin/appa plugin install claude-code
  3. 3

    Start a protected Claude Code session

    clappa

Things to know

  • The project is a preview and RFC, and config and wire surfaces may break without shims.

Featured in Repolode Weekly

In collections

Security scanners, audits & threat intel tools

Topics

#guardrails#agent-security#information-flow#policy-engine#llm-agents#access-control#guardrails-ai#security

FAQ

What is OpenAPPA?
A deterministic policy engine that sits between AI agents and their tools, blocking tool calls that would send sensitive data to unauthorized destinations. OpenAPPA sits between an agent and its tools and checks each tool call before it runs, asking whether the data involved is allowed to go to the destination. It tracks the sensitivity and trust level of everything an agent reads, so sensitive data does not reach an unauthorized tool. It is built on APPA, an information-flow policy model.
Is OpenAPPA free to use? What license does it have?
OpenAPPA is open source under the MIT license. Check the license terms before using it in commercial products.
Is OpenAPPA still maintained?
Actively maintained. The last commit to OpenAPPA was on Nov 6, 2026.
What can I use OpenAPPA for?
Preventing an agent from posting private meeting content to a public repository. Enforcing data-flow rules for enterprise agents that access internal documents and external tools. Adding policy tests to CI so configuration changes are validated before merge.
How do I install OpenAPPA?
Run the official install script from the README Install the Claude Code plugin: ~/.local/bin/appa plugin install claude-code Start a protected Claude Code session: clappa
Where can I get OpenAPPA?
The source code and installation instructions are on GitHub: https://github.com/archestra-ai/OpenAPPA

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects