suhui-organization/pod

pod — least-privilege compiler for AI agents

Your agent ran for a week. pod compiles what it actually did into the smallest policy it needs. 让 AI Agent 只拥有它真正需要的权限——从真实行为编译最小权限策略。

Record → compile → enforce → prove.

Most agent security tools stop at one of two places: a scanner that tells you what your agent could touch, or a gateway that asks you to hand-write a policy. pod closes the loop — run your agent in record-only mode for a few days, compile a least-privilege policy from its real tool calls, enforce it, and keep tamper-evident evidence for everything that ran.

record real calls ──▶ compile least-privilege policy ──▶ enforce (deny > approve > allow)
       │                        │                                  │
       │                        │                                  ▼
       │                        │                    ┌──────────────────────────┐
       └── SHA-256 hash chain ───┴───────────────────▶│ tamper-evident audit     │
          (every call, hashes only)                  │ verify / export evidence │
                                                     └──────────────────────────┘

中文速览

• 不是又一个 MCP 网关：网关让你手写策略；pod 从 agent 的真实行为里编译出最小权限策略。
• 闭环：pod record（只录不拦）→ pod policy draft（生成策略 + 与基线 diff）→ 人工复核 → pod serve（执法）。
• 证据：每一次工具调用进入 SHA-256 哈希链，可校验、可导出为证据包（敏感内容只存哈希）。
• 本地优先：策略、审计、密钥不出你的机器；Pod Cloud 是可选控制平面。

See it in 5 minutes

No agent, no account, no data leaves your machine — everything runs in a temp directory:

git clone https://gitee.com/suhuisoftwares/pod.git && cd pod
pnpm install && pnpm build
bash scripts/demo-least-privilege.sh

It seeds a realistic week of tool calls (reads, writes, a delete, and one .env access), then compiles a policy from that corpus and diffs it against a permissive baseline:

## 策略 diff（baseline → draft）

| server     | tool                 | baseline | draft      | 变化     |
|------------|----------------------|----------|------------|----------|
| *          | *                    | allow    | deny       | 默认决策 |
| filesystem | read_file            | allow    | deny       | 收紧     |
| filesystem | write_file           | allow    | approve    | 收紧     |
| filesystem | delete_file          | allow    | deny       | 收紧     |
| github     | create_pull_request  | allow    | approve    | 收紧     |
| shell      | execute_command      | allow    | approve    | 收紧     |
| filesystem | get_file_info        | allow    | (unlisted) | 移除     |

Two details matter here: `read_file` is locked down because it touched `.env` **once** (observation beats guessing), and `get_file_info` is removed because it never appeared in the corpus (least privilege = don't grant what you didn't observe).

## Install

macOS / Linux — builds from source, no npm account needed

链接钉在发布版上（可复现）：想跟主干就把 v0.4.2 换成 main

curl -fsSL https://gitee.com/suhuisoftwares/pod/raw/v0.4.2/scripts/install.sh | sh

主源连不上时用 GitHub 镜像（同一个脚本）：

curl -fsSL https://raw.githubusercontent.com/suhui-organization/pod/v0.4.2/scripts/install.sh | sh