Policy As Code Python Packages

pulumi-policy

Pulumi's Policy as Code SDK, CrossGuard. Define infrastructure checks in code to enforce security, compliance, cost, and other practices, enforced at deployment time.

assay-it

Open evidence profile for MCP tool actions. Enforce configured tool-call policies and record decisions and observations in offline-verifiable bundles. Optional Linux kernel controls. No hosted backend required.

mcp-hangar

MCP policy enforcement plane — deterministic policy on every Model Context Protocol call: identity, RFC 8707 audience binding, tool schema digest pinning, full audit trail. Python, self-hosted, MIT.

chock

Governance-as-code for AI coding agents: author a policy once, enforce it on every agent (Claude, Copilot, Cursor, Codex) via git hooks, CI, and native controls.

oss-policy-kit

Policy-as-code starter kit for OSS repository governance and CI/CD hygiene across GitHub, GitLab, Azure, and AWS.

repo-policy

Declarative GitHub repository governance — audit, plan, or apply a policy.yml for branch protection, rulesets, and repo-level security settings.

aegis-devops

Aegis: provenance-backed, authority-aware policy verifier that blocks context-poisoned and drifted AI agent actions (kubectl/terraform) before they hit infrastructure

stdtel

Telemetry for standards-as-skills — attribute token cost and outcomes to individual skills across Claude Code and GitHub Copilot, so keep/refine/deprecate decisions rest on measurement. Metadata only.

csl-core

Find, prove and control the AI agents on your machines: discovers every agent and what it can reach, proves policies with Z3 + TLA+, enforces them deterministically outside the model.

groundlens

GroundLens is an execution verification runtime for AI systems and agents. It turns observable AI execution into deterministic, policy-governed evidence that can be independently verified.

opal-common

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)

reeflex-claude

A seatbelt for the AI acting on your systems — deterministic, open-source governance gate for AI-agent actions

opal-client

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)

watchlight

Watchlight Developer Edition for Agent Runtime Governance - AI Security - AI Agent Security

appsec-rules-pack

Engine-agnostic AppSec baseline rules pack: a JSON-Schema rule contract, a Python CLI validator, and per-rule OWASP ASVS 5.0 / API Top 10 / CWE / NIST SSDF mappings for security review and CI evidence. Validates and exports rules; it does not execute them.

actra

Actra - control what runs before it runs, controls what actions are allowed before they execute. Evaluate policies across APIs, workflows and AI agents in real time.

skills-orchestrator

Govern, audit, and ship AI-agent skills with policy checks, evidence, SBOM, and MCP.

opal-server

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)

diff-contract

Deterministic guardrails for AI-generated diffs — define what files can change, block violations.

maida-ai

Pre-merge behavioral regression gate for AI agents. Check agent changes, inspect regressions, and block broken behavior before merge. Local-first.

reeflex-litellm

A seatbelt for the AI acting on your systems — deterministic, open-source governance gate for AI-agent actions

shadow-diff

Behavior contracts for AI agents

release-gate

🚪 Governance gate for AI agents. Enforce policies before deployment: request contracts, operational safeguards, identity boundaries, action budgets. CLI tool with YAML config, JSON/text output, CI/CD integration.

mcp-airlock

Stateless governance proxy for MCP (2026-07-28): policy, dry-run, human confirmation, audit, tracing