01
Deterministic action policy
Normalize every tool call into an attributable action and return a reproducible allow, deny, or require-approval decision from explicit policy.
Open source / AI-agent security
Dvar
A policy firewall for AI agents, tool calls, and MCP connections. Dvar sits between reasoning and execution so every proposed action can be evaluated, approved, constrained, and audited before it affects a real system.
Features / 01
Secure the action boundary, not just the prompt.
Dvar evaluates proposed actions with explicit identity, environment, tool metadata, arguments, policy, approval state, runtime limits, and output controls.
02
MCP inventory and lockfiles
Discover MCP tools, classify capabilities, generate reviewable inventories, and detect server, schema, annotation, destination, and capability changes.
03
Bounded human approvals
Create signed, expiring, replay-resistant approval grants tied to the reviewed action, user, environment, rule, scope, and selected fields.
04
Runtime safety controls
Apply quotas, cost and monetary limits, loop detection, retry ceilings, circuit breakers, and shared Redis or Valkey state at the execution boundary.
05
Output and local-tool hardening
Filter JSON and text outputs, deny binary by default, redact secrets, supervise local subprocesses, and avoid inherited environments by default.
06
Framework adapter surface
Wrap Vercel AI SDK style tools and other framework surfaces without making Dvar depend on a single model provider or agent framework.
Dvar 0.7 / Alpha channel
From policy engine to framework-ready agent security.
Version 0.7 combines the core policy engine with MCP enforcement, approvals, runtime safety, stdio hardening, output guards, and the first framework adapter surface.
Package
@rokadhq/dvar
Install the package from npm's alpha channel and use the same runtime for function tools, MCP proxying, approvals, runtime controls, output filtering, and adapters.
Configuration
dvar.yaml
Define monitor, enforce, strict, or off modes with explicit defaults, policy rules, guardrails, integrity settings, approval requirements, and runtime failure behavior.
Lockfile
dvar.lock.json
Review tool inventories before trusting MCP capabilities, then detect future schema, metadata, destination, and capability drift before execution.
Adapter
Vercel AI SDK tools
Wrap AI SDK style tools so framework execution passes through Dvar while preserving the tool shape expected by generateText and streamText.
Capabilities / 02
A control plane for tool-using AI systems.
Use Dvar to limit what agents may do, when they may do it, and what evidence is retained for review and incident response.
01
Allow, deny, and require-approval decisions for AI-agent actions
02
Monitor-first rollout with would-allow, would-deny, and would-require-approval observations
03
MCP Streamable HTTP scanning, proxying, inventory files, and lockfiles
04
Signed approval grants with once, session, and task scopes
05
Task, session, call, cost, monetary, depth, retry, and loop controls
06
Stdio subprocess supervision with executable identity and environment policy
07
Output classification, redaction, size limits, and deny-pattern blocking
08
Vercel AI SDK adapter and framework-neutral conformance helpers
Use cases / 03
Protect systems from unsafe agent actions.
Govern MCP access
Scan MCP servers, review capability drift, enforce lockfiles, and stop unknown or changed tools before they reach production systems.
Control sensitive operations
Require approval for payments, data exports, account changes, infrastructure operations, repository writes, and other high-impact tool calls.
Prevent runaway agents
Constrain loops, retries, repeated actions, cost, monetary value, depth, and session volume before an agent exhausts budget or damages systems.
Harden framework tools
Wrap agent-framework tool objects so application teams keep familiar SDK ergonomics while routing execution through deterministic policy.
Integration surfaces / 04
Use Dvar where actions cross into real systems.
Dvar is local-first and vendor-neutral. It can sit around ordinary functions, MCP servers, local tools, and framework tool definitions.
@rokadhq/dvar
Function tools
Protect ordinary TypeScript functions with normalized action records, argument validation, policy decisions, approvals, runtime safety, and output guards.
@rokadhq/dvar/mcp
MCP proxy
Scan and proxy MCP Streamable HTTP servers with pre-execution policy checks, lockfile integrity, request attribution, and bounded forwarding.
@rokadhq/dvar/approvals
Approvals
Issue and verify signed approval grants with expiry, scope, identity, environment, rule, action, and replay protections.
@rokadhq/dvar/runtime-safety
Runtime safety
Apply quotas, call ceilings, cost and monetary limits, loop detection, circuit breakers, and shared Redis or Valkey state.
@rokadhq/dvar/stdio
Local tools
Supervise subprocess execution with shell-free spawning, executable inspection, argument checks, environment allowlists, and output caps.
@rokadhq/dvar/adapters/vercel-ai-sdk
Framework adapters
Wrap Vercel AI SDK style tools, compose approval hints, preserve tool metadata, and route execution through Dvar protected tools.
Dvar FAQ / 05
Before you trust agents with side effects.
Understand Dvar's boundary, rollout model, approval semantics, and how Rokad can help integrate it into agentic systems.
01What does Dvar protect?
What does Dvar protect?
Dvar protects proposed actions: tool calls, MCP calls, local subprocesses, framework tool execution, and other side-effect boundaries routed through its wrapper or proxy.
02Does Dvar replace application authorization or IAM?
Does Dvar replace application authorization or IAM?
No. Dvar complements application authorization, IAM, OAuth, database permissions, network policy, sandboxing, secrets management, and human review. It does not replace them.
03Is monitor mode protection?
Is monitor mode protection?
No. Monitor mode allows execution while recording what Dvar would have denied or escalated. It is intended for safe adoption before enforcing policy.
04Can Dvar work without a Rokad cloud service?
Can Dvar work without a Rokad cloud service?
Yes. The core runtime, policy engine, MCP scanner, lockfile workflow, replay tooling, approval primitives, and audit events are local-first.
05Can Rokad implement Dvar for us?
Can Rokad implement Dvar for us?
Yes. Rokad can design agent action policy, harden MCP access, connect approvals, add runtime safety, test monitor-mode evidence, and manage rollout into enforcement.
Start with Dvar 0.7