guardana-server
Guardana's optional collector — a minimal FastAPI service that ingests findings from many agents and, optionally, serves a read-only monitoring dashboard.
Part of Guardana — security verification for self-hosted and self-built AI (model files, live endpoints, and agents) from one rule engine that runs on your laptop, in CI, and next to a served model.
Run it
pip install "guardana-server[serve]" # `[serve]` adds the ASGI server
export GUARDANA_DATABASE_URL=postgresql://guardana:secret@db:5432/guardana
guardana-collector migrate # never on start: see the docs for why
guardana-collector bootstrap --org acme --project web # prints the key, once
guardana-collector serve # http://127.0.0.1:8000
serve binds loopback unless you pass --host 0.0.0.0. The ASGI server is an
extra rather than a dependency, so a deployment that already runs gunicorn or
hypercorn can point it at the app instead:
gunicorn -k uvicorn.workers.UvicornWorker 'guardana.server:create_app()'.
There is an official image too:
docker run -p 8000:8000 -e GUARDANA_DATABASE_URL=… ghcr.io/guardana/guardana-collector:0.27.
The dashboard is a single self-contained page (no build step, works offline)
showing severity, per-source/per-rule breakdowns, an activity-over-time trend,
the unverified counter, and a filterable recent-findings table. It is
read-only, and signs in with a read-scoped API key that it holds in an
HttpOnly, SameSite=Strict cookie — a browser has nowhere safe to put a bearer
token, so it never gets one. It is still a panel over a security database: put it
behind the same network boundary as the collector itself (see
SECURITY.md).
- Main README & quickstart: https://github.com/guardana/guardana#readme
- Documentation: https://guardana.dev
Licensed under Apache-2.0.
1 maintainer
Release files for guardana-server 0.27.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| guardana_server-0.27.0.tar.gz | 136.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| guardana_server-0.27.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 243.5 kB
Release files / guardana_server-0.27.0.tar.gz
| Download URL | guardana_server-0.27.0.tar.gz |
|---|---|
| Size | 136.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
52af55ef6a199aed117fc0a0e04838f0aa23cb402e55a4d99546ad89c5b9222d
|
|
BLAKE2b-256 checksum How to use checksums |
4dc17eced423decfc2622a87a825f936fa899fc4a09bcc2d0015b9ca7eebdfdc
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 24, 2026.
Transparency logRelease files / guardana_server-0.27.0-py3-none-any.whl
| Download URL | guardana_server-0.27.0-py3-none-any.whl |
|---|---|
| Size | 107.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
5c00ab6cadbb26baaefeb94bec4e322d152db631da4f5d8640c90d6192b43cdb
|
|
BLAKE2b-256 checksum How to use checksums |
9fe6076b59c59b3917d29cb79e450715b210bcfc602012e4b7b8246cb0373818
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 24, 2026.
Transparency log
