AI News
商业产业 Hacker News LLM 2026-08-28T19:29 正文 ok 924 words

Show HN：Conduct——面向 LLM 与 MCP 工具调用的开源护栏

英文标题：🔶 Show HN: Conduct, open-source guardrails for LLM and MCP tool calls

Conduct 是一套开源 AI 治理平台，通过 Guard 在 LLM 调用、MCP 工具调用和 CLI 工具调用执行前实施策略控制。其核心机制包括工作区签名配置、SHA-256 哈希链审计日志，以及默认失败关闭（fail-closed）的策略执行模式。项目提供 Router 代理，可兼容 Anthropic、OpenAI、Perplexity 等 SDK，并内置 20 多个合规包和 22 个预构建工作流。对于开发者而言，Conduct 可通过 Docker、Kubernetes 或托管服务部署，为 Claude Code、Cursor、Copilot、Codex 等开发环境提供统一治理。
打开原文相关 6 · 机会 4
media957 B media2.0 KB media612 B media3.2 KB media152.1 KB media524.2 KB media112.1 KB

中文

Ask Lens——以自然语言查询你的治理数据

Lens 是 Conduct 的聊天交互界面。它位于每个工作区之上，作为一个由 Guard 强制执行策略的助手运行——你可以用自然语言询问被拦截事件、审批、支出、规则和 Agent 活动。该助手发起的每一次工具调用都会经过 Guard：使用与线上 Agent 相同的策略引擎和审计链路。

Lens 聊天——询问“今天有多少次 Guard 拦截”，基于真实审计数据

  • 整个平台共用一个聊天入口。 Guard、工作流、规则、合规性——一个输入框，无需切换上下文。
  • 基于你的数据。 不是 ChatGPT 的简单封装。每个回答都来自你工作区的审计日志、策略状态和运行历史。
  • 由 Guard 强制执行。 Lens 的 LLM 调用与 Agent 一样经过同一套策略引擎。相同规则、相同限制、相同审计链。
  • 内置下钻能力。 询问“今天谁被拦截了”——即可获得一个表格，每一行都链接到完整审计记录。

两个产品界面，一个代码仓库，一套策略：

  • Conduct Guard ——策略引擎。在每个 AI 操作执行前，决定执行 block / warn / audit / inject 中的哪一种处理；其背后由签名配置和哈希链审计日志支持。
  • Conduct Router ——LLM 代理。将任意提供商 SDK（Anthropic、OpenAI、Perplexity）指向 Router，每个请求在前往上游提供商的途中都会经过 Guard。

治理，而非可观测性

诸如 Straiker 和 Lakera 这样的运行时防火墙会告诉你 Agent 做了什么。Guard 则以密码学证明控制 Agent 能做什么。

| 运行时防火墙 | Conduct Guard
---|---|---
时机 | 操作之后 | 操作之前
配置完整性 | 信任策略包 | 工作区签名
审计 | 日志流 | SHA-256 哈希链
覆盖范围 | 仅 LLM 调用 | LLM 以及 shell / MCP
故障模式 | 失败开放（软性） | 默认失败关闭

三层护城河：

  1. 签名配置 ——每个工作区都会为其活跃策略集签名。每次 Guard 检查都会在执行前验证签名。被篡改的策略包——无论由任何人在任何层推送——都会在其能够做出任何决策之前被拒绝。
  2. 哈希链审计 ——每项决策都会追加至一条以工作区创世记录为根的 SHA-256 链。任何缺失或被修改的条目都会破坏该链，并可通过一键验证发现。可直接交给审计人员的证据。
  3. 策略优先，而非检测优先 ——规则在操作执行前基于结构化原因作出决策，而不是事后进行异常检测。

Discovery——免费的切入点

刚接触 Conduct？从 Discovery 模式开始：在 14 天内以只读方式查看团队发起的每一项 AI 操作。无需编写策略、无需在上游安装任何内容、完全免费。当你准备开始强制执行时，可以将 Discovery 已观察到的内容提升为规则。

→ conductai.ai/sign-up

git clone https://github.com/sseshachala/conductai
cd conductai
docker compose up
  • API 位于 http://localhost:8000（Guard + Router 在 /guard/* 和 /proxy/* 提供服务）
  • Canvas UI 位于 http://localhost:3000
  • Redis worker 和 Postgres 会在同一套栈中启动

将任意提供商 SDK 指向 Router：

curl https://api.conductai.ai/proxy/anthropic/v1/messages \
  -H "Authorization: Bearer cond_agt_..." \
  -H "Content-Type: application/json" \
  -d '{"model":"claude-sonnet-4-6","max_tokens":1024,"messages":[{"role":"user","content":"Hello"}]}'

或者使用 Guard 包装你的 CLI hooks：

pip install conduct-cli
conduct login
conduct sync        # installs hook + MCP, pulls policies

现在，这台机器上的每个 Claude Code、Cursor、Copilot、ChatGPT 或 Codex 会话都会受到同一组活跃策略包的治理。

组件 路径
Guard 运行时 apps/api/app/modules/guard/
Router（代理） apps/api/app/modules/guard/routers/proxy.py
合规包 apps/api/app/modules/guard/skill_packs/
Canvas UI apps/web/
Playbook DSL 加载器 apps/api/app/dsl/
Playbook 库 apps/api/playbooks/（22 个预构建）
CLI packages/conduct-cli/

**开箱即带 20 多个合规包：**OWASP、SOC 2 CC7.3、HIPAA §164.312、PCI DSS 4.0、EU AI Act Art. 15/16、NIST AI RMF、ISO 42001，以及面向 Python、Node 和 Terraform 的框架专用包。

**22 个预构建 Playbook：**Issue → PR、代码审查、事件响应、生产部署闸门、CI/CD 分诊、安全扫描器分诊、Slack 摘要等。每个 Playbook 都是一个 YAML 文件；可编辑后直接运行。

   开发者 / Agent                       Guard 控制平面
   ─────────────────                     ───────────────────
   Claude Code   ──┐                     ┌── Canvas UI (Next.js)
   Cursor        ──┤   CLI hook  ────►   ├── FastAPI + 策略引擎
   Copilot       ──┤   (cond_cli)        ├── Postgres（状态、审计）
   Codex         ──┘                     ├── Redis（worker、队列）
                     ┌──── MCP  ────►    └── 哈希链（SHA-256）
   任意 SDK      ────┤
   (Anthropic,       └── Router ────►    上游提供商（Anthropic，
    OpenAI,             /proxy/*         OpenAI，Perplexity，...）
    Perplexity)

Guard 检查会在三个关键入口触发：

  • CLI hook ——每一次 Claude Code / Cursor / Copilot / Codex 工具调用。
  • MCP 层 ——每一次 MCP 工具调用。
  • Router ——任意 SDK 发起的每一次 LLM 调用。

一套策略，三个执行界面。

  • 使用 docker compose 自托管 ——使用上述命令。在本地运行全部组件。
  • 在 Kubernetes 上自托管 ——部署模板位于 issue #1149。
  • 托管服务 ——conductai.ai。免费层包含 Discovery；付费层解锁强制执行、Router 和哈希链验证 API。
  • SECURITY.md ——漏洞报告政策、范围、协调披露和安全港条款。
  • 威胁模型 ——系统上下文、信任边界、攻击者目标、缓解措施和残余风险。
  • 策略决策契约 ——guard_check 决策语义和故障模式行为。
  • 审计日志验证 ——独立验证 prev_hash/entry_hash 链的流程和示例脚本。
  • API 版本管理 ——代理/MCP 兼容性、弃用窗口和 OpenAPI 发布指南。

Apache License 2.0 ——适用于整个代码仓库，包括 CLI、Guard、Router、Agent Booster、Playbook 和策略包。

  • 可免费用于商业和非商业用途，也可修改和再分发。
  • 包含所有贡献者提供的明确专利授权（Apache 2.0 §3）。
  • 不授予商标权；请参阅 NOTICE ——“Conduct”、“Conduct AI”和“Conduct Guard”仍为 Conduct AI 的商标。
  • 再分发时必须保留 LICENSE 和 NOTICE 文件。

位于 conductai.ai 的托管控制平面（Canvas UI、团队 RBAC、市场、托管 Guard）是在此代码仓库基础上构建的商业产品。

如需企业支持、赔偿保障或许可相关咨询，请发送邮件至 hello@conductai.ai。

我们接受 bug 报告、文档修复、新 Playbook、新策略包、测试和代码贡献。请先阅读 CONTRIBUTING.md。

⭐ 如果 Conduct 为你的团队节省了时间，请给它点星——这能帮助其他团队发现它。

English / 原文

Ask Lens — natural language over your governance data

Lens is Conduct's chat surface. It sits above every workspace as a Guard-enforced assistant — ask about blocked events, approvals, spend, rules, agent activity in plain English. Every tool call the assistant makes runs through Guard: same policy engine, same audit trail as a live agent.

Lens chat — asking "how many guard blocks today", grounded in real audit data

  • One chat for the whole platform. Guard, workflows, rules, compliance — one input, no context switching.
  • Grounded in your data. Not a wrapper around ChatGPT. Every answer comes from your workspace's audit log, policy state, and run history.
  • Guard-enforced. Lens's LLM calls go through the same policy engine as your agents. Same rules, same limits, same audit chain.
  • Drilldowns built in. Ask "who got blocked today" — get a table with per-row links to the full audit record.

Two product surfaces, one repo, one policy:

  • Conduct Guard — the policy engine. Decides block / warn / audit / inject for every AI action before it executes, backed by signed configuration and a hash-chained audit log.
  • Conduct Router — the LLM proxy. Point any provider SDK (Anthropic, OpenAI, Perplexity) at Router and every request runs through Guard on the way to the upstream provider.

Governance, not observability

Runtime firewalls like Straiker and Lakera tell you what an agent did. Guard controls what an agent can do — with cryptographic proof.

| Runtime firewalls | Conduct Guard
---|---|---
Timing | After the action | Before the action
Config integrity | Trust the pack | Workspace-signed
Audit | Log stream | SHA-256 hash chain
Coverage | LLM calls only | LLM and shell / MCP
Failure mode | Fail-open (soft) | Fail-closed by default

The three-pillar moat:

  1. Signed configuration — every workspace signs its active policy set. Every Guard check verifies the signature before enforcing. A tampered pack — pushed by anyone, at any layer — is rejected before it can decide anything.
  2. Hash-chained audit — every decision appends to a SHA-256 chain rooted at workspace genesis. Any missing or altered entry breaks the chain and is caught on one-click verification. Evidence you can hand to an auditor.
  3. Policy-first, not detection-first — rules decide before the action executes, with structured reasons. Not anomaly detection after the fact.

Discovery — the free wedge

New here? Start with Discovery mode : read-only visibility into every AI action your team takes for 14 days. No policy to author, nothing to install upstream, no cost. When you're ready to enforce, promote a rule from what Discovery already saw.

→ conductai.ai/sign-up

git clone https://github.com/sseshachala/conductai
cd conductai
docker compose up
  • API on http://localhost:8000 (Guard + Router live at /guard/* and /proxy/*)
  • Canvas UI on http://localhost:3000
  • Redis worker + Postgres come up in the same stack

Point any provider SDK at Router:

curl https://api.conductai.ai/proxy/anthropic/v1/messages \
  -H "Authorization: Bearer cond_agt_..." \
  -H "Content-Type: application/json" \
  -d '{"model":"claude-sonnet-4-6","max_tokens":1024,"messages":[{"role":"user","content":"Hello"}]}'

Or wrap your CLI hooks with Guard:

pip install conduct-cli
conduct login
conduct sync        # installs hook + MCP, pulls policies

Now every Claude Code, Cursor, Copilot, ChatGPT, or Codex session on that machine is governed by the same active packs.

Component Path
Guard runtime apps/api/app/modules/guard/
Router (proxy) apps/api/app/modules/guard/routers/proxy.py
Compliance packs apps/api/app/modules/guard/skill_packs/
Canvas UI apps/web/
Playbook DSL loader apps/api/app/dsl/
Playbook library apps/api/playbooks/ (22 pre-built)
CLI packages/conduct-cli/

20+ compliance packs ship out of the box: OWASP, SOC 2 CC7.3, HIPAA §164.312, PCI DSS 4.0, EU AI Act Art. 15/16, NIST AI RMF, ISO 42001, and framework-specific packs for Python, Node, and Terraform.

22 pre-built playbooks: Issue → PR, code review, incident response, prod deploy gate, CI/CD triage, security scanner triage, Slack digest, and more. Each is one YAML file; edit-and-run.

   Developer / agent                     Guard control plane
   ─────────────────                     ───────────────────
   Claude Code   ──┐                     ┌── Canvas UI (Next.js)
   Cursor        ──┤   CLI hook  ────►   ├── FastAPI + policy engine
   Copilot       ──┤   (cond_cli)        ├── Postgres (state, audit)
   Codex         ──┘                     ├── Redis (workers, queues)
                     ┌──── MCP  ────►    └── Hash chain (SHA-256)
   Any SDK       ────┤
   (Anthropic,       └── Router ────►    Upstream provider (Anthropic,
    OpenAI,             /proxy/*         OpenAI, Perplexity, ...)
    Perplexity)

Guard checks fire at three chokepoints:

  • CLI hook — every Claude Code / Cursor / Copilot / Codex tool call.
  • MCP layer — every MCP tool invocation.
  • Router — every LLM call by any SDK.

One policy, three enforcement surfaces.

  • Self-host with docker compose — the command above. Runs everything locally.
  • Self-host on Kubernetes — deployment templates ship in issue #1149.
  • Hosted — conductai.ai. Free tier includes Discovery; paid tiers unlock enforcement + Router + hash-chain verification API.
  • SECURITY.md — vulnerability reporting policy, scope, coordinated disclosure, and safe harbor.
  • Threat model — system context, trust boundaries, attacker goals, mitigations, and residual risks.
  • Policy decision contract — guard_check decision semantics and fail-mode behavior.
  • Audit log verification — independent prev_hash/entry_hash chain verification procedure and example script.
  • API versioning — proxy/MCP compatibility, deprecation windows, and OpenAPI publication guidance.

Apache License 2.0 — the entire repository, including the CLI, Guard, Router, Agent Booster, playbooks, and packs.

  • Free for commercial and non-commercial use, modification, and redistribution.
  • Includes an explicit patent grant from all contributors (Apache 2.0 §3).
  • Trademark rights are not granted; see NOTICE — "Conduct", "Conduct AI", and "Conduct Guard" remain trademarks of Conduct AI.
  • Redistribution must preserve the LICENSE and NOTICE files.

The hosted control plane at conductai.ai (canvas UI, team RBAC, marketplace, managed Guard) is a commercial offering built on top of this repository.

For enterprise support, indemnification, or licensing questions, email hello@conductai.ai.

We accept bug reports, docs fixes, new playbooks, new packs, tests, and code. Read CONTRIBUTING.md first.

⭐ If Conduct saves your team time,star it — it helps other teams find it.