Yagami AI Context Firewall MCP server

Yagami

<!-- mcp-name: io.github.MatthewTracy/yagami -->

Open-source AI context firewall for governed model, retrieval, memory, and tool access.

Documentation | Gateway API | Deployment | Security | Roadmap

Try it in 60 seconds

The no-credential demo uses your configured Ollama model when it is installed; otherwise it opens a clearly labeled policy-only fallback. Choose one command:

uvx yagami demo
# or: python -m pip install yagami && yagami demo
# or: docker run --rm -p 127.0.0.1:8000:8000 ghcr.io/matthewtracy/yagami:latest yagami demo --host 0.0.0.0 --allow-remote

Open http://127.0.0.1:8000, or use docker compose -f compose.demo.yaml up from a clone. Demo mode blocks cloud routing while exercising the UI, policy, lineage, storage, and audit path. For local AI answers, install Ollama and run ollama pull llama3.2:3b-instruct-q4KM before starting the demo.

https://github.com/user-attachments/assets/a7be9449-eafc-4acb-99b6-ea39edc43cd2

Yagami is for developers and platform/security teams that need to control where agent context goes and which tools it may execute. For example: a coding agent can keep repository secrets on-device and require an identity-bound, one-time approval before a dangerous tool call.

Yagami sits between software and local models, cloud LLMs, retrieval systems, memory, and tools. Existing OpenAI SDK applications can adopt it by changing one base_url; Yagami then classifies context locally, applies versioned policy, and records content-free evidence for each decision.

Take the no-data security tour or run the flagship security demos for secret containment, poisoned retrieval, and identity-bound tool approval.

Protect an application

Initialize persistent user configuration, check the host, and start Yagami:

yagami init
yagami doctor
yagami serve

Install yagami[providers] when the Yagami process or the example client uses Anthropic/OpenAI-compatible SDKs. PDF ingestion and OS key storage are separate ingest and desktop extras; see configuration.

Then point an OpenAI client at the gateway:

from openai import OpenAI

client = OpenAI(
    base_url="http://127.0.0.1:8000/v1",
    api_key="your-yagami-project-key",
)

response = client.chat.completions.create(
    model="yagami-auto",
    messages=[{"role": "user", "content": "Summarize this document."}],
    metadata={
        "purpose": "internal-documentation",
        "sensitivity": "none",
        "session_id": "example-session",
    },
)
print(response.choices[0].message.content)

Supported caller sensitivity values are none, phi, phi_medical, and secret. A caller hint can make the policy stricter; it cannot lower a sensitivity detected by Yagami.

For production authentication, policy, and deployment settings, follow the deployment guide.

Why teams use Yagami

Shortened. The full README is on GitHub.