Sark

SARK (Security Audit and Resource Kontroler)

Enterprise-Grade Multi-Protocol AI Governance Platform

> "He's not any kind of user, SARK, he's a program." —MCP, probably

SARK provides zero-trust governance for AI deployments at scale. Built for Model Context Protocol (MCP), with support for MCP, HTTP/REST, gRPC, and custom protocols through a universal adapter interface.

Target Scale: 50,000+ employees, 10,000+ AI resources

📖 [Quick Start](docs/QUICK_START.md) | [Changelog](CHANGELOG.md) | [Full Documentation](docs/)

---

What is This?

The Problem: AI assistants accessing enterprise systems (databases, APIs, cloud infrastructure) without governance creates security chaos—no visibility, no control, no audit trail.

The Solution: SARK sits between AI and your systems, providing:

• 🔐 Authentication - OIDC, LDAP, SAML, API Keys
• 🛡️ Authorization - Policy-based access control (OPA)
• 📊 Audit - Complete trail of every AI action
• ⚡ Performance -

cd sark

If you already cloned without --recurse-submodules:

git submodule update --init

python3.11 -m venv venv && source venv/bin/activate pip install -e ".[dev]"

2. Build Rust extensions

maturin develop

3. Start services

docker compose --profile full up -d

4. Access UI and API

UI: http://localhost:5173 (admin/password)

API: http://localhost:8000/docs

**Next Steps:**
- 📖 **[15-Minute Quick Start](docs/QUICK_START.md)** - Complete getting started guide
- 💻 **[Development Guide](docs/DEVELOPMENT.md)** - Development workflow and standards
- 🎓 **[Tutorials](tutorials/)** - Step-by-step examples
- 📚 **[API Reference](docs/API_REFERENCE.md)** - Complete API documentation

---

## Features

### Multi-Protocol Support
- **MCP** - SSE and HTTP transports functional (stdio in development)
- **HTTP/REST** - OpenAPI discovery, 5 auth strategies
- **gRPC** - Reflection-based, mTLS support
- **Custom** - Plugin system for any protocol

### Enterprise Security (v1.3.0 Enhanced)
- **Authentication** - OIDC, LDAP, SAML, API Keys
- **Authorization** - OPA policy engine, ReBAC+ABAC
- **Audit** - Immutable logs, SIEM integration (Splunk, Datadog)
- **Federation** - Cross-organization governance with mTLS
- **🆕 Prompt Injection Detection** - 20+ patterns, entropy analysis, 30x faster
- **🆕 Anomaly Detection** - Behavioral baselines, real-time alerts
- **🆕 Secret Scanning** - 25+ patterns, automatic redaction, 50x faster
- **🆕 MFA** - TOTP/SMS/Push/Email for critical actions
- **🆕 Network Controls** - Kubernetes policies, egress filtering

### Production Ready
- ✅ 64% test coverage (improving to 85%), 1 low-severity vulnerability (Windows-only, dev dependency)
- ✅ <100ms p95 latency, 847 req/s sustained throughput
- ✅ Kubernetes-native, Helm charts, Terraform modules
- ✅ 100+ pages of documentation

📖 **[Features Overview](docs/FEATURES.md)** | **[Security](docs/SECURITY.md)** | **[Performance](docs/PERFORMANCE.md)**

---

## Web UI

Modern React UI for managing AI governance:

- 📊 Dashboard with metrics
- 🖥️ Server/resource management
- 📝 Policy editor (Rego syntax)
- 📜 Audit log viewer
- 🔑 API key management

```bash
cd frontend && npm install && npm run dev
# Access: http://localhost:5173

📖 [UI User Guide](docs/UIUSERGUIDE.md) | [UI Deployment](docs/DEPLOYMENT.md#ui-deployment)

---

Deployment

Development

docker compose --profile full up -d

Production

# Kubernetes with Helm
helm install sark ./helm/sark -n production --create-namespace

# Or with kubectl
kubectl apply -f k8s/

Cloud Platforms

• AWS EKS, GCP GKE, Azure AKS
• Terraform modules included for all platforms

Home Deployment (v1.7.0)

Lightweight deployment for home networks and low-resource environments:

# Quick start with Docker
make home-up

# Or with Docker Compose directly
docker compose -f docker-compose.home.yml up -d

• Target: 512MB RAM, single core
• Database: SQLite (instead of PostgreSQL)
• Platform: OPNsense plugin or Docker
• Features: Family governance (bedtime, parental controls, cost limits)

📖 [Home Deployment Guide](docs/deployment/HOMEDEPLOYMENT.md) | [Policy Cookbook](docs/policies/POLICYCOOKBOOK.md)

Enterprise Deployment

Full-featured deployment with PostgreSQL, Redis, and external OPA:

# Kubernetes with Helm
helm install sark ./helm/sark -n production --create-namespace

📖 [Deployment Guide](docs/DEPLOYMENT.md) | [Terraform Guide](terraform/README.md) | [Production Readiness](docs/PRODUCTION_READINESS.md)

---

Documentation

Getting Started

• [Quick Start](docs/QUICK_START.md) - 15-minute setup
• [MCP Introduction](docs/MCP_INTRODUCTION.md) - What is MCP?
• [Architecture](docs/ARCHITECTURE.md) - System design
• [Use Cases](docs/USE_CASES.md) - Real-world examples

Deployment & Operations

• [Deployment Guide](docs/DEPLOYMENT.md) - Production deployment
• [Monitoring](docs/MONITORING.md) - Observability setup
• [Operations Runbook](docs/OPERATIONS_RUNBOOK.md) - Day-2 operations

Development

• [Development Guide](docs/DEVELOPMENT.md) - Setup and workflow
• [API Reference](docs/API_REFERENCE.md) - Complete API docs
• [Contributing](CONTRIBUTING.md) - Contribution guidelines

Security & Compliance

• [Security Guide](docs/SECURITY.md) - Security best practices
• [OPA Policy Guide](docs/OPAPOLICYGUIDE.md) - Policy authoring
• [Audit & Compliance](docs/AUDIT_COMPLIANCE.md) - Compliance features

📚 [Full Documentation Index](docs/README.md)

---

Project Status

🚀 v1.7.0 - Current Release (Released Feb 2, 2026)

New in v1.7.0 - YORI Home Deployment:

• ✅ Home Deployment Profile - 512MB RAM, single-core target for home networks
• ✅ Governance Modules - Allowlist, time rules, emergency override, consent tracking
• ✅ Policy Templates - Bedtime, parental controls, privacy, cost limits
• ✅ Analytics Services - Token tracking, cost calculation, usage reporting
• ✅ OPNsense Plugin - Web UI dashboard, service management, policy configuration
• ✅ Comprehensive Tests - Unit, integration, and OPA policy tests

v1.6.0 - Polish & Validation:

• ✅ Security Hardening - 96% vulnerability remediation (24/25 CVEs fixed)
• ✅ Test Infrastructure - 39 tests fixed, 100% pass rate for export + tools routers
• ✅ Dependency Cleanup - Eliminated ecdsa, migrated to PyJWT[crypto]
• ✅ Bug Fixes - Keyword detection for snake_case, FastAPI route ordering
• ✅ Documentation - Comprehensive release notes, migration guides

v1.5.0 - Production Readiness:

• ✅ Gateway Transport Implementations (HTTP, SSE, stdio)
• ✅ Security Fixes (LDAP injection, CSRF, credentials)
• ✅ Frontend Authentication UI (Login, MFA, API key management)
• ✅ E2E Integration Tests (Complete user flow testing)
• ✅ Performance Benchmark Infrastructure (Locust, pytest-benchmark)

v1.4.0 - Rust Foundation:

• ✅ Embedded Rust OPA engine (4-10x faster policy evaluation)
• ✅ Rust in-memory cache (10-50x faster than Redis)
• ✅ Feature flags & gradual rollout (0% → 100% with instant rollback)
• ✅ 2.4x higher throughput (2,100+ req/s)
• ✅ 2.3x faster requests (42ms p95, down from 98ms)
• ✅ 100% backwards compatible with v1.3.0
• ✅ Automatic Python fallback for safety
• ✅ Comprehensive migration and performance documentation

Completed (v1.3.0):

• ✅ Enterprise authentication (OIDC, LDAP, SAML, API Keys)
• ✅ Policy-based authorization (OPA)
• ✅ MCP Gateway integration (opt-in)
• ✅ SIEM integration (Splunk, Datadog)
• ✅ Prompt injection detection (20+ patterns, 30x faster than target)
• ✅ Behavioral anomaly detection (30-day baseline, real-time alerts)
• ✅ Secret scanning & redaction (25+ patterns, 50x faster than target)
• ✅ MFA for critical actions (TOTP, SMS, Push, Email)
• ✅ Network security controls (NetworkPolicies, egress filtering)
• ✅ Comprehensive testing (350+ unit, 530+ integration, 2200+ performance)
• ✅ Complete documentation (100+ pages)
• ✅ Production deployment guides

Future Roadmap:

• v1.8.0 - OPNsense plugin submission to official repository
• v1.9.0 - Local LLM support (Ollama integration)
• v2.0.0 - GRID Reference Implementation (protocol abstraction, federation, cost attribution)

📖 [Roadmap](docs/ROADMAP.md) | [Changelog](CHANGELOG.md)

---

Requirements

• Python 3.11+
• Docker with Docker Compose v2
• PostgreSQL 15+, Valkey 7+ (Redis-compatible)
• Open Policy Agent 0.60+
• Kong Gateway 3.8+ (production)
• Kubernetes 1.28+ (production)

📖 [Requirements](docs/REQUIREMENTS.md)

---

GRID Protocol

SARK is the reference implementation of GRID Protocol Specification v0.1.

GRID (Governed Resource Interaction Definition) is a universal governance protocol for machine-to-machine interactions—protocol-agnostic, federated, zero-trust, policy-first.

SARK v1.1.0 Compliance: 85% of GRID v0.1 specification

📖 [Gap Analysis](docs/specifications/GRIDGAPANALYSISANDIMPLEMENTATION_NOTES.md) - Detailed compliance matrix

📖 [GRID Specification](docs/specifications/GRIDPROTOCOLSPECIFICATIONv0.1.md) | [Gap Analysis](docs/specifications/GRIDGAPANALYSISANDIMPLEMENTATIONNOTES.md)

---

Related Projects

YORI - Home LLM Gateway (Integrated in v1.7.0)

YORI (Your Observant Router Intelligence) provides zero-trust LLM governance for home networks. As of v1.7.0, YORI's home deployment profile is integrated directly into SARK.

Deployment Options:

• SARK Home Profile - Use make home-up or the OPNsense plugin (recommended)
• Standalone YORI - See YORI repository for standalone builds

Features:

• Target: OPNsense routers, home users (512MB RAM, 1 CPU)
• Database: SQLite (lightweight, no external dependencies)
• Policies: Bedtime rules, parental controls, privacy protection, cost limits
• Governance: Allowlist, time-based rules, emergency override, consent tracking
• Analytics: Token tracking, cost estimation, usage reports

YORI reuses SARK's battle-tested Rust core (grid-opa, grid-cache) via PyO3 bindings, bringing enterprise-grade policy evaluation to resource-constrained home routers.

📖 YORI Repository | [Project Plan](docs/v2.0/YORIPROJECT_PLAN.md)

---

Contributing

We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for:

• Code style and standards
• Development workflow
• PR process
• Multi-agent collaboration guidelines

---

License

MIT License - see [LICENSE](LICENSE) file for details.

Copyright © 2025 James Henry. All rights reserved.

---

Built with ❤️ for enterprise AI governance at scale.

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: apathy-ca
• Source: apathy-ca/sark
• License: MIT
• Homepage: https://github.com/apathy-ca/sark/blob/main/docs/QUICK_START.md

Install and usage instructions live in the source repository linked above.