suhui-organization/pod

> Your agent ran for a week. pod compiles what it actually did into the smallest policy it needs.
>
> 让 AI Agent 只拥有它真正需要的权限——从真实行为编译最小权限策略。
**Record → compile → enforce → prove.**
Most agent security tools stop at one of two places: a scanner that tells you what your agent *could* touch, or a gateway that asks you to *hand-write* a policy. pod closes the loop — run your agent in record-only mode for a few days, compile a least-privilege policy from its real tool calls, enforce it, and keep tamper-evident evidence for everything that ran.
中文速览
- **不是又一个 MCP 网关**：网关让你手写策略；pod 从 agent 的真实行为里**编译**出最小权限策略。
- **闭环**：pod record（只录不拦）→ pod policy draft（生成策略 + 与基线 diff）→ 人工复核 → pod serve（执法）。
- **证据**：每一次工具调用进入 SHA-256 哈希链，可校验、可导出为证据包（敏感内容只存哈希）。
- **本地优先**：策略、审计、密钥不出你的机器；Pod Cloud 是可选控制平面。
See it in 5 minutes
No agent, no account, no data leaves your machine — everything runs in a temp directory:
It seeds a realistic week of tool calls (reads, writes, a delete, and one .env access), then compiles a policy from that corpus and diffs it against a permissive baseline:
Two details matter here: read_file is locked down because it touched .env **once** (observation beats guessing), and get_file_info is removed because it never appeared in the corpus (least privilege = don't grant what you didn't observe).
Install
The installer clones v0.4.2 to ~/.pod/src, builds, and puts pod in ~/.local/bin. Override with POD_SRC, POD_BIN_DIR, POD_REPO_URL, POD_VERSION（POD_VERSION=main 跟主干）。
**中文 / English**：CLI 输出支持中英切换——pod --lang en-US ，或设一次
POD_LANG=en-US（也会读 LC_ALL / LANG）。默认中文；未翻译的句子原样显示，
不会出现空白或 key 名。pod guard 与 pod harden 的报表、威胁目录与交付物
**整篇有英文**（含 finding 正文与策略草稿的判定依据），由 CI 断言守门。
覆盖进度自查：bash scripts/i18n-coverage.sh
（列出还没英文词条的串和词表里的僵尸键，--strict 有缺口时退出 1）；控制台另有
真机逐页验收 bash scripts/web-acceptance.sh（指到 k8s 后端、无头 Chrome 点一遍，
断言"每页都渲染了内容且没有非数据中文"）。
Run the MCP gateway as a container
同一个网关也能以自包含镜像运行：镜像里已经构建好 CLI、预装了上游 filesystem server，
默认用 baseline 策略（只读工具放行，写操作进审批），从 stdio 暴露 MCP。
要换成别的上游 server 或策略，覆盖 entrypoint 参数即可；默认等价于
pod serve --agent glama --server filesystem --command mcp-server-filesystem --arg /workspace。
（公开目录收录时要求的检查也是这两步：进程能启动、能响应 initialize / tools/list。）
Requires **Node.js ≥ 22.13** (pnpm 11's runtime floor) and git.
What's in this repo
一个仓库包含完整闭环：本地在 agent 机器上执法，云端（可选）做跨机器视图。
| 路径 | 是什么 | 怎么装 |
|---|---|---|
| packages/ | 核心库：策略求值、审计哈希链、网关、能力图、控制平面姿态、身份/委托/JIT、扫描器 | pnpm install && pnpm build |
| apps/cli | pod 命令行（网关 + 策略编译 + 证据 + 控制平面命令） | bash scripts/install.sh |
| apps/web | 本地控制台（pod ui：读为主，写操作只有纳管/移除） | 随 CLI 构建 |
| cloud/server | 可选云端控制平面后端（FastAPI）：agent 注册、审计同步、策略中心、告警、时间线、控制平面事件 | bash deploy/install.sh |
| cloud/web | 云端控制台前端（Vue 3 + Element Plus） | 同上（随 docker 构建） |
| deploy/ | 一键部署：install.sh + docker-compose.yml + .env.example（含每个配置项说明） | bash deploy/install.sh |
| cloud/server/deploy/k8s/ | Kubernetes 清单（参考，适合本机 kind/Docker-Desktop 集群） | bash cloud/server/deploy/k8s/install-local.sh |
能力与价值速览见 docs/FEATURES.md。
From source:
> npm i -g @podsec/cli is **not live yet** — use the installer above until the package is published.
From zero to enforcement
What pod is / is not
| pod is | pod is not |
| --- | --- |
| A **policy compiler**: turns real tool-call corpora into least-privilege rules | A sandbox or a container runtime |
| A **policy enforcement point** on the MCP boundary (fail-closed) | A replacement for your agent's own sandbox |
| A **tamper-evident audit + evidence layer** across agents | An LLM content-moderation firewall |
| **Local-first**: policies, audits and secrets stay on your machine | A cloud service that needs your logs |
Compared with the rest of the market: platform-native sandboxes (Claude Code, Codex, Gemini CLI) protect **one agent**; MCP gateways (agentgateway, ToolHive, ContextForge, Docker) give you a **place to enforce hand-written rules**; scanners (Snyk Agent Scan, mcp-guard) tell you **what is exposed**. pod is the missing step between "what is exposed" and "what is allowed": it **writes the policy for you from observed behavior**, then proves what happened.