ai-tc

AI Traffic Control

AKA Security — We secure agent harnesses at the source.

AI Traffic Control (ai-tc) is an open-source control plane for coding agents. It watches an agent session's traffic (prompts, tool calls, responses, file reads), scans each event against your rule packs, and decides what happens next: monitor, warn, redact, block, or a manual exception. Secrets and regulated data like PCI, PHI, and PII are caught locally: live detection and enforcement never send them to a model or a third party. The one exception is the opt-in /aka:setup calibration, which does send what its history scan finds to the model API to be rated.[^egress]

ai-tc works standalone, and governs what a session carries: rule packs, findings, policy, and an audit trail, across Claude Code and Claude Desktop. To harden the harness itself — safe-default permissions, structural command guards, and credential deny rules for Claude Code — pair it with claude-tools. They compose: claude-tools hardens the harness, ai-tc governs the traffic.

How it works

Every event in a session runs through one control point before it takes effect:

prompt · tool call · response · file read   →   ai-tc policy engine   →   monitor · warn · redact · block · exception

Prompts and tool inputs are checked before they reach the model; tool outputs and file reads are checked after it responds. Each event is scanned against your installed rule packs, every match becomes a finding (rule id, category, severity, matched span), and policy decides the outcome. Everything is logged.

Detection is mostly regex, patterns shaped like an AWS access key, an email address, or a bank routing number, which covers most secrets and PII since they have a predictable shape. A smaller set of rules match on keyword, and some regex matches run through a validator, such as a Luhn checksum for card numbers or a Shannon-entropy check for high-entropy secrets, to cut false positives.

Policy outcomes

A finding resolves to one of five outcomes:

Outcome	What happens
Monitor	Logged only. Every rule ships active here, so nothing is enforced until you promote it.
Warn	Surfaces a warning in the session; the content still goes through unchanged.
Redact	The matched value is replaced in place before it reaches the model. Tool inputs and outputs only, not prompt text.
Block	The prompt or tool call is stopped, with a message explaining what fired.
Exception	A manually granted, exact-value override that lets one specific match through despite its rule's policy.

Promote any detection from monitor to warn, redact, or block from the dashboard, per rule or per category.

Key concepts

Term	What it is
Event	A prompt, response, tool call, or file read captured from an agent session.
Finding	A rule match produced by the detection engine against an event.
Rule	A JSON file describing what to detect: a keyword list, a regex pattern, or a validator.
Rule pack	A directory of rules and their fixtures with a manifest.json.
Policy	The decision about what to do when a rule or category fires.
Plugin	The harness extension that intercepts sessions. One package, used by Claude Code and Claude Desktop.

Where your data lives

ai-tc keeps what it records in a local SQLite store at ~/.aka/data/aka.db, with your settings beside it under ~/.aka/settings. There is no database server to run and no schema to manage — the CLI, the plugin, and the dashboard all read and write that one file.

That store is a running log of your agent sessions: prompts, responses, tool calls. What gets masked in it follows the policy assigned to the detection that flagged the span: a flagged span is masked at rest only where that policy is redact or block. Under monitor or warn the value is stored as it was seen, and everything outside a flagged span is stored verbatim and unencrypted either way. Every detection ships on monitor, so on a default install nothing is masked at all and aka.db builds up a full local record of what your agent saw, raw secrets included; promoting a detection changes what is stored from then on, not what is already there. Files read by aka scan are stored under the same rule. On macOS and Linux the store directories are created owner-only (0700) and the files are written 0600. Those permissions are the only at-rest control there is, and they do nothing on Windows.

That stored content is also what an attached machine sends. aka attach registers a machine against a control plane your organization runs — not a service AKA operates — and from then on this machine forwards each captured event to that deployment as it stored it, so the masking rule above is also the rule for what crosses the network: under monitor or warn the matched value reaches that deployment unmasked, and promoting the detection to redact or block masks it before it is stored and so before it is sent. Every detection ships on monitor, so on an attached machine that is the default posture rather than an edge case. A machine you have not attached forwards none of this.[^egress]

SECURITY.md has the full picture — every file the store spans, what an attached machine forwards, what to do on Windows, and how to report a vulnerability.

Install

ai-tc installs as a plugin through the AKA marketplace. The aka CLI installs on its own, with or without a coding agent.

Claude Code

In Claude Code:

/plugin marketplace add akasecurity/marketplace
/plugin install ai-tc@akasecurity

Claude Desktop

Claude Desktop is supported too; the installation guide covers both. ai-tc runs locally alongside your agent. Standalone by default: there's no backend to stand up, and no scanning happens off your machine.[^egress]

The aka CLI (standalone binary)

The CLI carries the dashboard, the local store and aka scan. The binary embeds its own runtime, so it needs no Node.js.

macOS / Linux, with Homebrew:

brew install akasecurity/tap/aka

Windows, with Scoop:

scoop bucket add akasecurity https://github.com/akasecurity/scoop-bucket
scoop install aka
# or, without adding the bucket:
scoop install https://github.com/akasecurity/ai-tc/releases/download/bin-latest/aka.json

Or the bootstrap installer, which downloads the same archive:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.sh | sh

# Windows (PowerShell)
irm https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.ps1 | iex

Or download an archive directly — these four links always serve the newest binary release. The binary is ad-hoc signed and not notarized, so a browser download is quarantined and Gatekeeper refuses to run it, while brew, curl and command-line tar don't quarantine what they fetch.

Platform	Download
macOS (Apple silicon)	aka-darwin-arm64.tar.gz
Linux x64	aka-linux-x64.tar.gz
Linux arm64	aka-linux-arm64.tar.gz
Windows x64	aka-win32-x64.zip

Intel macOS (darwin-x64) has no binary build — install the CLI from npm there instead: npm install -g @akasecurity/cli (needs Node.js 24+).

Each archive extracts to its own aka-<platform>-<arch>/ directory; the binary has to stay inside it to find the files it loads at startup. Then run aka init.

Check a download against SHA256SUMS and its build provenance with gh attestation verify — tools/installer/README.md sets out the trust chain and what each check does and does not establish. The Homebrew tap and Scoop bucket entries above are published by each binary release.

Upgrade the way you installed: brew upgrade aka, scoop update aka, or re-run the one-liner.