COGNIS
OPEN SOURCE · LOCAL-FIRST · MCP-NATIVE

THE GOVERNED RUNTIME FOR AI AGENTS.

Cognis gives autonomous agents a controlled execution environment — with policy enforcement, human authorization, auditability, and secure access to real system capabilities.

View on GitHub
Local-First Engine
Zero cloud lock-in
MCP Standard
Native capability interface
Human-in-the-Loop
Interactive prompts
Immutable Audit
Full replay & verification
RUNTIME OBSERVABILITY INTERFACE

LIVE EXECUTION MONITOR

|RUN 8F21AACTIVE
AGENT_INTENT:"Analyze this project and identify risky dependencies."

Policy Engine Evaluation

STAGE 3 / 7

Determines whether requested capability is allowed, denied, or prompt.

TARGET FUNCTIONfilesystem.list_directory
DECISION STATEALLOW
METADATARule: policy.workspace_read · Risk: LOW
EXECUTION PAYLOAD INSPECTOR
EVALUATION: PASS Workspace constraint checked: inside /workspace
Click stage above to inspect runtime details contextually.POLICY ENGINE: v0.1.0
THE EXECUTION PARADIGM GAP

AGENTS CAN REASON.
AGENTS CAN ACT.
WHO GOVERNS THE ACTION?

Modern agents increasingly interact with files, commands, APIs and other capabilities. The model can decide what it wants to do, but execution needs an explicit boundary.

WITHOUT COGNIS
UNGOVERNED
AGENT MODEL
UNCHECKED SYSTEM ACCESS
FILESYSTEM
SHELL
NETWORK
APIs
Risk Profile: Unrestricted path access, arbitrary command execution, secret leakage, unlogged operations.
WITH COGNIS
GOVERNED
AGENT MODEL
COGNIS GOVERNED RUNTIME
POLICY ENFORCEMENT
HUMAN AUTHORIZATION
EXECUTION BOUNDARY
AUDIT LEDGER
FILESYSTEM
SHELL
NETWORK
CAPABILITIES
Governed Execution: Strict path containment, policy enforcement, human approval gates, full auditability.
SYSTEM ARCHITECTURE

MCP CONNECTS AGENTS TO CAPABILITIES.
COGNIS GOVERNS HOW THEY USE THEM.

"MCP standardizes the interface between agents/models and external capabilities. Cognis operates above that interface, providing the execution loop, policy enforcement, human authorization and audit layer."

LAYER 1 — AGENT / MODEL
Reasoning & Planning Engine

Generates intent, plans actions, and interprets execution responses.

LAYER 2 — COGNIS RUNTIMEINSPECTING
The Governed Execution Boundary

Enforces policies, requests human authorization, and logs audit entries before capability dispatch.

LAYER 3 — MCP (MODEL CONTEXT PROTOCOL)
Standardized Interoperability Layer

Provides structured capability schemas and tool declaration standards.

LAYER 4 — SYSTEM CAPABILITIES
Local OS & Hardware Tools

Target system resources executing requested functions under strict containment.

LAYER SPECIFICATION
LAYER IDENTIFIER
LAYER 2 — COGNIS RUNTIME
ROLE & RESPONSIBILITY
Enforces policies, requests human authorization, and logs audit entries before capability dispatch.
SUBSYSTEM COMPONENTS
Agent Execution Loop
Policy Engine
Human Authorization
Execution Boundaries
Audit Ledger
POLICY ENGINE INTERACTION

SEE THE BOUNDARY IN ACTION.

Visual simulation of Cognis policy evaluation behavior on agent requested capabilities.

SELECT SIMULATED REQUEST:
POLICY EVALUATION
REQUESTED COMMAND
shell.execute("rm -rf ./build")
RISK ASSESSMENT
HIGH
EVALUATION DECISION
DENY
REASONING & GUIDANCE
Do not retry this action. Choose an allowed capability.
RETRYABLE BY AGENT: false
STRUCTURED RESPONSE PAYLOAD
{ "status": "DENY", "code": "ERROR_COMMAND_RESTRICTED", "category": "security", "retryable": false, "guidance": "Do not retry this action. Choose an allowed capability." }
Predefined default policy simulation. Enterprise custom rulesets supported.RULE ENGINE: STRICT
END-TO-END WORKFLOW

THE EXECUTION PIPELINE

Every intent undergoes continuous verification through a 6-stage runtime pipeline.

PIPELINE STAGE 1 OF 6STAGE ID: PLAN

01. Intent & Capability Matching

The agent formats raw reasoning into candidate MCP capability requests with parameters.

SECURITY BOUNDARIES

EVERY CAPABILITY CROSSES A BOUNDARY.

Explicit technical security primitives engineered for local runtime isolation.

PATH SECURITY

  • Workspace containment
  • Symlink resolution
  • Traversal protection
Enforces canonical path normalization so file operations cannot escape designated workspace root boundaries via relative dot-dot sequences or symlinks.

COMMAND VALIDATION

  • Single-command validation
  • No chaining (&&, ||)
  • No pipes (|)
  • No redirection (>, <)
  • No command substitution ($())

WORKING DIRECTORY

  • Workspace restrictions
  • Canonical path resolution
  • Symlink escape protection

ENVIRONMENT SANITIZATION

  • Allowlist-based handling
  • Secret protection
  • Sanitization

MODEL POLICY

  • Local-first model support
  • Explicit remote authorization
  • No silent remote fallback

EXECUTION LIMITS

  • Timeouts
  • Resource limits
  • No silent retries
AGENT-FACING GOVERNANCE FEEDBACK

DON'T JUST DENY.
EXPLAIN THE BOUNDARY.

"Cognis exposes structured execution feedback so agents can understand enforcement and replan instead of blindly repeating denied actions."

Explicit retryable flags prevent infinite loops
Machine-readable guidance context for LLM re-planning
Standardized error codes for programatic handling
STRUCTURED_ERROR_PAYLOAD.jsonPOLICY_DENIAL
{
  "success": false,
  "error": {
    "code": "ERROR_POLICY_VIOLATION",
    "category": "policy",
    "retryable": false,
    "requires_user_action": false,
    "guidance": "Command 'rm -rf ./build' is restricted by policy rule 'no_destructive_delete'."
  }
}
IMMUTABLE TRACE LEDGER

EVERYTHING THAT HAPPENED.
NOT JUST WHAT THE AGENT SAID.

Full event lineage capturing intent, policy evaluations, interactive developer interventions, and tool results.

AUDIT_LOG_TRACE_RUN_8F21A.jsonl
FORMAT: JSONL / APPEND-ONLY
10:42:03RUN_STARTEDSession initialized PID 41920
10:42:04MODEL_REQUESTClaude 3.5 Sonnet request received
10:42:04TOOL_CALLfilesystem.list_directory target: ./
10:42:04POLICYEVALUATION ALLOW (read-only workspace)
10:42:05TOOL_RESULT14 entries returned successfully
10:42:06TOOL_CALLshell.execute command: "rm -rf ./build"
10:42:06POLICYEVALUATION PROMPT (High risk command execution)
10:42:07HUMAN_DECISIONDENY action by developer prompt
10:42:07AGENT_REPLANNEDStructured error returned to agent context loop
HASH VERIFIED: SHA256-8F21A99CEVENTS LOGGED: 9
DEVELOPER INSTALLATION

FROM SOURCE
TO GOVERNED EXECUTION.

"Install Cognis your way."

|cognis — terminal
LIVE
MODE:STANDARD INSTALLATION—
$
Use PyPI for standard installation.
View GitHub Install from PyPI
PYTHON 3.11+
MCP NATIVE
LOCAL-FIRST
OPEN SOURCE
POLICY-DRIVEN
HUMAN-IN-THE-LOOP
ZERO-TRUST
OPEN SOURCE REPOSITORY

BUILT IN THE OPEN.

"Cognis is open source and designed to be inspectable, extensible and locally controlled."

Cognis
AritranexX / Cognis
MIT License

Open-source governed agent-native runtime. Local policy execution, human approval boundaries, and MCP compatibility.

Python
MIT
MCP Native
GitHub ↗Read Architecture

GIVE AGENTS CAPABILITIES.
GIVE THEM BOUNDARIES.

"An open-source runtime for governed agent execution."

Get StartedView on GitHub