AI agents that answer for what they do.
DurbarAI is a runtime for AI agents that you host yourself. Risky tool calls wait for a named person. A new agent version ships only after it passes a release test against the live one. Agent events go into a hash-chained log that shows if anyone edits it.
Going open source, license to be announced. Runs on Docker Compose or Kubernetes.
What is DurbarAI?
DurbarAI is a runtime for AI agents built by Prashna Labs. It runs agents on LangChain deepagents and adds what production needs around them: approval-gated tools, a release gate on every promotion, a hash-chained audit log, a stop button, and document search that respects who may read what, with citations.
- Deploy
- Docker Compose, or Kubernetes with kustomize
- Stack
- Python 3.13 API, PostgreSQL, Next.js web app
- Models
- Anthropic or OpenAI, with your own key
- Tracing
- OpenTelemetry GenAI spans and JSON logs
- Channels
- Web app, REST API, web widget, Slack
One action, on the record
What happens when an agent reaches a risky tool
A refund, a deleted record, a message to a customer: any tool you mark as approval-gated takes the same path, and every step leaves a trace.
- Someone asks for a task
A person asks an agent for something that ends in a change outside the conversation.
- The agent reads what that person may read
It searches only the documents the person is allowed to open, then plans the tool call.
- The run stops before the call
The tool is approval-gated, so the request lands in the approvals inbox with its arguments and the policy that required it.
- A named person decides
An approver says yes or no. The decision is recorded under their identity.
- The run finishes, or the tool never runs
Approved, the agent resumes from where it stopped. Rejected, the call is never made.
- Anyone with access can check the record
Verify recomputes the audit hash chain end to end and points at the first event that does not match.
Studio
Build an agent, then publish it on purpose
Write the instructions, pick the tools and mark which ones ask a person first, connect knowledge and skills, and try the draft in a preview that never runs gated tools. Each agent carries an identity card with its owner, its risk level and the tools that change things. People only ever reach the published version.
Release gate
A new version ships only if it holds up against the live one
Publishing from the Studio and promoting through the API run the same check. The candidate's evaluation results are compared with the live version's on four quality and two safety metrics. By default it must clear every minimum, score 0.7 overall, and drop no more than 0.05 below the live version. An owner or risk role can set different floors per agent, and every override is audited.
| Metric | Default minimum |
|---|---|
| Tool selection | 0.70 |
| Tool argument correctness | 0.80 |
| Plan quality | 0.60 |
| Action completion | 0.70 |
| Forbidden tool avoidance | 1.00 |
| Error containment | 0.50 |
What it does not do: it scores how the agent works through a task, not whether the final answer is right.
Audit
A record that shows if anyone edits it
Each event's hash covers the one before it and is signed with an HMAC, and checkpoints over the chain are signed with Ed25519. Change one event and verification fails from that point on.
- Verify nowRecomputes the whole chain from the first event.
- ExportSearch events and export them as JSONL or CEF for your SIEM.
- Evidence bundlesSigned, grouped by SOC 2 control, ready for an auditor's request.
Who it protects against: the keys belong to whoever operates the deployment, so the log exposes edits by anyone without them. It is not proof against the operator. How the audit log works
Data and access
Agents see only what the person may see
Agents search your documents before they answer and cite the passages they used. A restricted document never reaches the answer of someone who may not open it. Data-loss prevention rules run on prompts, replies, tool inputs and tool outputs: each one blocks, redacts or only logs, and can run in simulate mode before you enforce it. Check access explains why a person can or cannot do something, rule by rule.
Today: search matches words, not meaning. Retrieval by meaning is on the roadmap.
Runs where your data already lives
Your documents, runs and audit log stay in your PostgreSQL. Bring your own model key.
- Docker ComposeAPI, web app and PostgreSQL on one host.
- Kuberneteskustomize manifests for the same services.
- REST APIRun and stream agents from your own product.
- Web widgetPut an agent on a page of your site.
- SlackTalk to an agent in a channel.
Container images are built from source today. Slack and the widget have not yet been shown against a live customer workspace. Self-hosting details
For risk and compliance teams
Three questions a reviewer asks before an agent goes live
What can it do without asking a person first?
Everything except the tools you mark approval-gated. Those stop the run until a named approver says yes. You can simulate a policy before you publish it.
Not covered: approvals gate tool calls, not what the agent writes in a chat reply.
How do you stop it if it goes wrong?
A stop button halts new runs and in-flight runs at the next step, and users see the reason you typed.
Not covered: it fails open if its own store is down, and it does not cover document intake.
Can you show what it did last Tuesday, and who approved it?
Search the audit log, open an event to see its integrity check, and export what you found.
Not covered: some run receipts are written best-effort, so a missing one is not flagged by itself.
Every known gap is listed on what DurbarAI cannot do yet.
Questions people ask
What is DurbarAI?
DurbarAI is a self-hostable runtime for AI agents, built by Prashna Labs. It runs agents on LangChain deepagents and adds the controls a production deployment needs: tools that wait for a named approver, a release gate on every promotion, a hash-chained audit log, a kill switch, and document search that respects who may read what.
Is DurbarAI open source?
Not yet. We are preparing the repository for a public release, and the license is not decided. Leave your email on the open source page and we will write once, on the day it goes public.
Can I run DurbarAI on my own servers?
Yes. The API, the web app and PostgreSQL run with Docker Compose, or on Kubernetes with kustomize manifests. You build the container images from source today. Your documents, runs and audit log stay in your database.
Which language models does it work with?
You bring your own key. Anthropic and OpenAI models are the ones we price and test against; the provider and model are set per deployment, and the builder assistant can use its own.
Does the release gate check that answers are right?
No. It scores how the agent works through a task: whether it picked the right tool, passed the right arguments, planned sensibly, finished the action, stayed inside its allowed tools and contained errors. An optional model-graded check can only block a release after it has been calibrated against human labels.
Can someone edit the audit log without anyone noticing?
An edit breaks the hash chain, and Verify reports where. The keys are held by whoever operates the deployment, so the log shows edits by anyone without the keys; it is not proof against the operator. Some run receipts are written best-effort, so a missing receipt is not flagged on its own.
Does DurbarAI have a SOC 2 report?
No. DurbarAI produces signed evidence bundles grouped by SOC 2 control (for example CC6.1 and CC8.1) that your own audit can use, but Prashna Labs has no SOC 2 report and no penetration test yet. The limits page lists what else is missing.
Hear the day DurbarAI goes public
One email when the repository opens. No newsletter, and we delete the address after that if you ask.
Opens your email app with the subject filled in. Or write to hello@prashnalabs.com.