Yagami

Open-source AI context firewall for governed model, retrieval, memory, and tool access.

Documentation | Gateway API | Deployment | Security | Roadmap

Yagami sits between your software and local models, cloud LLMs, retrieval systems, and tools. It classifies context locally, evaluates versioned policy, routes only to allowed destinations, inspects outputs, and produces content-free evidence for each decision.

Existing OpenAI SDK applications can adopt it by changing one base_url. Yagami can run as a headless gateway, in a container or Kubernetes, or with its included React control surface.

Try it in 60 seconds

The demo requires no API key, provider account, Ollama model, or Node.js:

python -m pip install yagami
yagami demo

Open http://127.0.0.1:8000. Demo mode uses a local echo backend, blocks cloud routing, and exercises the UI, policy, lineage, storage, and audit path.

Watch the two-minute demo.

Take the no-data security tour or run the flagship security demos for secret containment, poisoned retrieval, and identity-bound tool approval.

Protect an application

Initialize persistent user configuration, check the host, and start Yagami:

yagami init
yagami doctor
yagami serve

Then point an OpenAI client at the gateway:

from openai import OpenAI

client = OpenAI(
    base_url="http://127.0.0.1:8000/v1",
    api_key="your-yagami-project-key",
)

response = client.chat.completions.create(
    model="yagami-auto",
    messages=[{"role": "user", "content": "Summarize this document."}],
    metadata={
        "purpose": "internal-documentation",
        "sensitivity": "none",
        "session_id": "example-session",
    },
)
print(response.choices[0].message.content)

Supported caller sensitivity values are none, phi, phi_medical, and secret. A caller hint can make the policy stricter; it cannot lower a sensitivity detected by Yagami.

For production authentication, policy, and deployment settings, follow the deployment guide.

Why teams use Yagami

• Deterministic containment after classification. Once context is labeled as PHI or secret, default policy permits local backends only. Sensitive history and tool results inherit the same restriction.
• One governed data plane. Chat Completions, Responses, the browser chat, and MCP use the same policy, lineage, transformation, output-DLP, budget, and audit pipeline.
• Policy as code. Preview and replay decisions, run regression cases in CI, and promote deterministic Ed25519-signed policy bundles.
• Evidence without prompt logging. Policy passports, hash-chained audit records, Prometheus metrics, and OpenTelemetry spans carry labels, hashes, IDs, and counts rather than prompt or completion content.
• **Model ch

... View full README on GitHub