How does it perform on benchmarks?

Per the vendor's published benchmarks: OpenAPPA achieves 89% task completion with 0% successful attacks, compared to Claude Auto mode (90% / 10%) and FIDES by Microsoft (41% / 31%).

Is OpenAPPA open source?

Yes, it is MIT-licensed, and the project is vendor-agnostic. Code and documentation are available on GitHub.

How much does it cost?

Pricing is not stated on the website; the project is MIT-licensed open source.

OpenAPPA — An information-flow policy engine for LLM agents

OpenAPPA is an open-source (MIT-licensed), deterministic information-flow policy engine for LLM agents. Instead of matching patterns or using LLM judges, it tracks data flows across tool calls using security labels (audience × trust), deriving every enforcement decision algebraically so prompt injection or model hallucination cannot cause data exfiltration. It runs outside the agent's prompt and execution loop and plugs into an existing agent loop in one place.

Key Features

Information-flow tracking, not pattern matching

Policies describe data sources, audiences, trust levels, and authorities; every agent trajectory carries a security label that only ever gets more restrictive, and each decision is derived algebraically from it.

Declarative single configuration (appa.toml)

A single TOML configuration drives the cross-platform, pluggable engine, letting you validate in CI/CD that the whole tool graph is covered and scale to millions of agents without changing the config.

Tamper-resistant by design

The engine runs outside the agent's prompt and execution loop, so the model cannot see, negotiate with, or manipulate it — 'you cannot prompt-inject an algebra.'

Machine-readable remedy plans

Instead of a bare 'forbidden' that stalls agents, blocked calls return a remedy plan describing legal ways to proceed, which the vendor says lifts task completion from 37% to 90% on their benchmarks.

Built-in sanitizers and custom plugins

Stock sanitizers ship in the box to mask secrets or redact PII so payloads can flow to wider audiences; custom sanitizers, including model-based ones, plug in with a clear blast radius.

Authorities for scoped approvals

A human or internal API can approve one specific action without lifting the session's restrictions for later calls.

Subagent isolation

Untrusted reads can be isolated in a disposable branch so the parent trajectory continues unpoisoned.

Operations tooling

Includes validation, observability, reporting (appa yell), and self-improving policies; documentation is also available as an MCP server or via curl.

How It Works

Label every trajectory

Every agent trajectory carries a security label of audience × trust: reading a private repo narrows the audience, reading an unvetted web page lowers trust. Labels only become more restrictive.

Derive decisions algebraically

The engine derives each tool-call decision from the current label algebraically, rather than judging calls with a classifier or matching regexes.

Plug in once, outside the loop

The engine plugs into an existing agent loop in one place and runs outside the prompt/execution loop. It supports coding agents, LLM proxies, MCP gateways, MCP servers, and agents in production, with documented integrations for Archestra, Claude Code, and kAgent.

Return remedies instead of dead ends

When a flow is blocked, the agent receives a machine-readable remedy plan — sanitize the payload, get an authority approval, or use a subagent — so it can legally proceed instead of stalling.

Pros & Cons

Pros

Deterministic and verifiable: 0% successful attacks on their benchmarks, versus 10% for Claude Auto mode and 31% for FIDES
MIT-licensed and vendor-agnostic, with a pluggable, cross-platform engine
Maintains high task completion (89%) while enforcing strict security, unlike regex blocklists that break agents
Declarative config enables CI/CD validation of full tool-graph coverage and auditability
Utility-preserving enforcement via remedy plans, sanitizers, authorities, and subagent isolation
Cannot be manipulated by the model since it runs outside the prompt and execution loop

Who It's For

Best for

Engineering and security teams running coding agents (Claude Code, Archestra, kAgent) or MCP-based agents in production who need provable re
Organizations that find LLM-judge auto-modes too risky (injectable classifiers, ~0.7% breach rates at scale) and regex blocklists too brittl
Teams that want to validate guardrail coverage in CI/CD and scale policies across many agents without per-agent configuration

Not ideal for

Teams wanting a zero-configuration, out-of-the-box guardrail — OpenAPPA requires authoring a declarative policy
Users seeking an LLM-based judge that approves tool calls conversationally (this project explicitly positions itself against auto-modes)

Use Cases

Preventing data exfiltration from LLM agents caused by prompt injection or model hallucination

Enforcing security on coding agents like Claude Code without breaking task completion

Securing MCP servers, MCP gateways, and LLM proxies in production agent fleets

Validating in CI/CD that an entire agent tool graph is covered by policy

Scaling deterministic guardrails across millions of agents with a data-specific configuration

FAQ

What is OpenAPPA?

OpenAPPA is an information-flow policy engine for LLM agents — a deterministic AI guardrail designed to be 100% resistant to data exfiltration from prompt injection or model hallucination, without breaking agent task completion. It is open, vendor-agnostic, and MIT-licensed.

How is it different from LLM auto-modes or regex blocklists?

It doesn't use a second model to judge tool calls (which classifiers can't track data flow across calls and are themselves prompt-injectable), and it doesn't match patterns like blocked commands (which agents route around). Instead it tracks data flows with security labels and derives decisions algebraically.

How does the policy model work?

A single appa.toml configuration describes data sources, audiences, trust levels, and authorities. Every trajectory carries a security label (audience × trust) that only gets more restrictive, and the engine derives each decision from that label.

Does strict enforcement break agents?

OpenAPPA