S
SkillNav

Bulwark

AI 与智能体

by bpolania

AI agent governance: content scanning, audit logs, policy evaluation, session management.

4GitHub

什么是 Bulwark？

AI agent governance: content scanning, audit logs, policy evaluation, session management.

README

Bulwark

Open-source governance layer for AI agents.

Bulwark sits between AI agents and external tools, enforcing policies, managing credentials, inspecting content, and maintaining a complete audit trail. One policy governs all your agents — Claude Code, OpenClaw, Codex, or any MCP/HTTP client.

Why Bulwark?

AI agents are powerful but ungoverned. They can access any tool, leak any credential, and leave no audit trail. Bulwark fixes this:

  • Policy enforcement — YAML-based rules control which tools agents can use, with glob patterns, scope-based precedence, and hot-reload
  • Credential management — Agents never see real secrets. Bulwark injects credentials at the last mile, encrypted at rest with age
  • Content inspection — Scan requests and responses for secrets, PII, and prompt injection. Block or redact automatically
  • Audit logging — Every action recorded in a tamper-evident SQLite database with blake3 hash chains
  • Rate limiting — Token-bucket rate limits per session, operator, tool, or globally. Cost tracking with budget enforcement
  • MCP-native — Works as an MCP gateway or HTTP forward proxy. Governance metadata on every tool call response

Install

bash
# Homebrew (macOS / Linux)
brew install bpolania/tap/bulwark

# Docker
docker pull ghcr.io/bpolania/bulwark

# From source
git clone https://github.com/bpolania/bulwark.git
cd bulwark && cargo build --release

Quick Start: Govern Claude Code with GitHub

This walkthrough connects Claude Code to GitHub through Bulwark. Every tool call is policy-evaluated, audited, and credential-injected — in about 5 minutes.

Prerequisites: Claude Code installed, a GitHub personal access token, and Node.js/npm (for the GitHub MCP server).

1. Initialize and verify

bash
bulwark init my-project && cd my-project
bulwark doctor

doctor runs 9 diagnostic checks. All should pass.

2. Store your GitHub token

bash
bulwark cred add github-token --type bearer_token
# Prompts for the token — hidden input, encrypted with age at rest

Configure the credential-to-tool binding in your bindings file so Bulwark knows to inject this token for GitHub tool calls.

3. Configure the upstream GitHub server

Edit bulwark.yaml:

yaml
mcp_gateway:
  upstream_servers:
    - name: github
      command: "npx"
      args: ["-y", "@modelcontextprotocol/server-github"]
      env:
        GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_TOKEN}"

policy:
  policies_dir: "./policies"
  hot_reload: true

audit:
  enabled: true

inspect:
  enabled: true
  inspect_requests: true
  inspect_responses: true

Make sure GITHUB_TOKEN is set in your shell (export GITHUB_TOKEN=ghp_...).

4. Write a policy

bash
cat > policies/base.yaml << 'EOF'
metadata:
  name: quickstart-policy
  scope: global

rules:
  - name: allow-reads
    description: "Allow all read operations"
    match:
      actions: ["read_*", "get_*", "list_*", "search_*"]
    verdict: allow
    priority: 10

  - name: allow-github-writes
    description: "Allow creating issues, comments, PRs"
    match:
      tools: ["github__*"]
      actions: ["create_*", "update_*"]
    verdict: allow
    priority: 10

  - name: block-destructive
    description: "Block all delete and force-push operations"
    match:
      actions: ["delete_*", "force_push_*"]
    verdict: deny
    priority: 20
    message: "Destructive operations are blocked by policy"

  - name: default-deny
    match: {}
    verdict: deny
    priority: -100
    message: "No policy explicitly allows this action"
EOF

bulwark policy validate

5. Create a session and connect Claude Code

bash
# Create a session (--ttl is in seconds: 28800 = 8 hours)
bulwark session create --operator $(whoami) --agent-type claude-code --ttl 28800
# → Token: bwk_sess_7f3a...

export BULWARK_SESSION="bwk_sess_7f3a..."   # paste your actual token

# Register Bulwark as an MCP server in Claude Code
claude mcp add --transport stdio bulwark \
  --env BULWARK_SESSION=$BULWARK_SESSION \
  -- bulwark mcp start

6. Use Claude Code — now governed

Start Claude Code. GitHub tools appear namespaced as github__list_issues, github__create_issue, etc.

Try it:

"List the open issues in my repo"

Open a second terminal:

bash
bulwark audit tail
code
22:01:03  github__list_issues   ✓ allow   3ms  (allow-reads)

Every call is logged with the verdict, matched rule, and timing. Now try something destructive:

"Delete issue #1"

code
22:02:01  github__delete_issue  ✗ deny    <1ms (block-destructive)

Blocked. Sub-millisecond — policy evaluation happens in memory. The agent gets a structured error explaining which rule denied it.

What just happened

Claude Code connected to Bulwark (not directly to GitHub). For every tool call, Bulwark validated the session, scanned for secrets/PII, evaluated the policy, injected the real GitHub token, scanned the response, and recorded a tamper-evident audit event. Same agent experience — full governance underneath.

Going Deeper

Content inspection — 13 built-in patterns scan for AWS keys, GitHub tokens, private keys, PII, and prompt injection. Redaction happens before content reaches the agent.

bash
bulwark inspect rules
bulwark inspect scan --text "my key is AKIAIOSFODNN7EXAMPLE"

Policy replay — Preview the impact of policy changes against real audit history before deploying:

bash
bulwark policy test --dir ./new-policies/ --since 1h

Audit forensics — Reconstruct a session timeline and verify the hash chain:

bash
bulwark session inspect <session-id>
bulwark audit verify
bulwark audit export --since 24h --format json

HTTP proxy mode — For non-MCP agents, Bulwark runs as a forward proxy with TLS interception:

bash
bulwark proxy start
bulwark ca export   # trust the CA in your HTTP client

Architecture

code
┌─────────────┐     ┌──────────────────────────────────────────────┐     ┌──────────────┐
│             │     │                  Bulwark                      │     │              │
│  AI Agent   │────>│  Session > Inspect > Policy > Inject > Proxy │────>│  Upstream    │
│  (Claude,   │<────│  <── Audit <── Inspect <── Response <─────── │<────│  Tool/API    │
│   Codex,    │     │                                              │     │              │
│   custom)   │     └──────────────────────────────────────────────┘     └──────────────┘
└─────────────┘

Integration Modes

ModeTransportBest For
MCP Gateway (stdio)stdio/JSON-RPCClaude Code, OpenClaw, any MCP client
MCP Gateway (HTTP)Streamable HTTPRemote agents, MCP registry, multi-agent
HTTP ProxyHTTP/HTTPSCodex, curl, any HTTP client

Example Policy

yaml
# policies/base.yaml
metadata:
  name: my-policy
  scope: global

rules:
  - name: allow-reads
    verdict: allow
    priority: 10
    match:
      actions: ["read*", "get*", "list*"]

  - name: block-destructive-in-prod
    verdict: deny
    priority: 100
    match:
      actions: ["delete*", "drop*"]
    conditions:
      environments: ["production"]

  - name: default-deny
    verdict: deny
    match: {}

See examples/policies/ for complete policy sets (startup, enterprise, development, multi-agent).

CLI

code
bulwark init <path>              # Scaffold a new project
bulwark proxy start              # Start HTTP/HTTPS proxy
bulwark mcp start                # Start MCP gateway (stdio)
bulwark mcp serve                # Start MCP gateway (HTTP)
bulwark doctor                   # Diagnose setup issues (9 checks)
bulwark status                   # Health dashboard
bulwark policy validate          # Validate policy files
bulwark policy test --dir <path> # Test policies against audit log
bulwark session create|list|revoke|inspect
bulwark cred add|list|remove|test
bulwark audit search|tail|stats|export|verify
bulwark inspect scan|rules       # Content inspection
bulwark ca export|path           # CA certificate management
bulwark completions <shell>      # Shell completions (bash/zsh/fish)

Documentation

Development

bash
git clone https://github.com/bpolania/bulwark.git
cd bulwark
cargo build --workspace
cargo test --workspace          # 487 tests
cargo clippy --workspace --all-targets -- -D warnings

Project Structure

code
crates/
  cli/        # CLI binary and commands
  proxy/      # HTTP/HTTPS forward proxy with TLS MITM
  mcp/        # MCP governance gateway
  config/     # Configuration loading and types
  policy/     # YAML policy engine with hot-reload
  vault/      # Credential storage and session management
  audit/      # Tamper-evident audit logging
  inspect/    # Content inspection (secrets, PII, injection)
  ratelimit/  # Token-bucket rate limiter and cost tracker
  common/     # Shared types and error definitions

License

Apache 2.0. See LICENSE.

常见问题

Bulwark 是什么？

AI agent governance: content scanning, audit logs, policy evaluation, session management.

相关 Skills

Claude接口

by anthropics

Universal
热门

面向接入 Claude API、Anthropic SDK 或 Agent SDK 的开发场景，自动识别项目语言并给出对应示例与默认配置，快速搭建 LLM 应用。

✎ 想把Claude能力接进应用或智能体，用claude-api上手快、兼容Anthropic与Agent SDK，集成路径清晰又省心

AI 与智能体
未扫描165.3k

RAG架构师

by alirezarezvani

Universal
热门

聚焦生产级RAG系统设计与优化，覆盖文档切块、检索链路、索引构建、召回评估等关键环节，适合搭建可扩展、高准确率的知识库问答与检索增强应用。

✎ 面向RAG落地，把知识库、向量检索和生成链路系统串联起来，做架构设计时更清晰，也更少踩坑。

AI 与智能体
未扫描23.5k

多智能体架构

by alirezarezvani

Universal
热门

聚焦多智能体系统架构设计，梳理 Supervisor、Swarm、分层和 Pipeline 等模式，覆盖角色定义、通信协作与性能评估，适合规划稳健可扩展的 AI agent 编排方案。

✎ 帮你系统解决多智能体应用的架构设计与协同编排难题，适合构建复杂 AI 工作流，成熟度高、社区认可也很亮眼。

AI 与智能体
未扫描23.5k

相关 MCP Server

顺序思维

编辑精选

by Anthropic

热门

Sequential Thinking 是让 AI 通过动态思维链解决复杂问题的参考服务器。

✎ 这个服务器展示了如何让 Claude 像人类一样逐步推理，适合开发者学习 MCP 的思维链实现。但注意它只是个参考示例，别指望直接用在生产环境里。

AI 与智能体
89.1k

知识图谱记忆

编辑精选

by Anthropic

热门

Memory 是一个基于本地知识图谱的持久化记忆系统，让 AI 记住长期上下文。

✎ 帮 AI 和智能体补上“记不住”的短板，用本地知识图谱沉淀长期上下文，连续对话更聪明，数据也更可控。

AI 与智能体
89.1k

Codebase Memory

by deusdata

热门

持久化的代码库知识图谱，可跨会话保留上下文，在 session 重启或上下文压缩后仍能继续使用。

✎ 专治 AI 编程助手“会话失忆”，把代码库沉淀为持久知识图谱，重启或压缩上下文后也能无缝续上开发状态。

AI 与智能体
36.7k

评论