Ritvo

Ritvo is an open-source authority layer for AI agents. When an agent asks to do something its bindings do not clearly allow, Ritvo decides who may approve it, escalates along named roles, enforces separation of duties, and keeps the evidence in a tamper-evident ledger.

The name comes from the Sanskrit ṛta, the right order of things.

Status

Early, pre-alpha. The ritvo package on PyPI (version 0.0.1.dev0) is a placeholder that reserves the name. It contains only the ritvo --version command and no features. Nothing here is ready for production use. Interfaces, file formats and commands will change without notice until the first feature release, v0.1. See CHANGELOG.md for what exists today.

Where Ritvo sits

Gateways sit between an agent and its tools. Ritvo sits below them, next to the resource, and above them as the policy authority:

• Enforcement points run next to the resource. The first is middleware inside your own MCP server, added with one library call and removed the same way. They work behind any gateway, or none.
• The Governance OS publishes signed policy bundles to enforcement points, resolves asks along escalation ladders, and mints single-use grants. It never touches a live call.
• The inspector (ritvo inspect) is a local, read-only scan of the MCP servers and agent frameworks you name. It writes an inventory and a report; it sends nothing anywhere.
• The diagnostic (ritvo review, ritvo diagnose) reads files and writes a gap report and a draft ritvo.yaml. It never connects to anything.

The design is in docs/PRD.md (what and why) and docs/SPEC.md (behaviour and interfaces). Why Ritvo is not a gateway is recorded in docs/decisions/0001-below-the-gateway.md.

Non-goals

• Not a gateway. No key issuance, budgets, provider proxying or tool allow lists. Those are well served elsewhere.
• No credential custody, no TLS interception, no autonomy scoring, no agent-authored intent.
• Not multi-tenant SaaS. One instance per organisation, plus the library inside that organisation's own MCP server.
• No vertical policy content.
• Not a security scanner for prompt injection or malicious tool descriptions.

Quick start

There is nothing to run yet beyond the CLI entry point. To install from source:

git clone https://github.com/Ritvo-ai/ritvo.git
cd ritvo
python3.12 -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -e .
ritvo --version

The quick start will cover ritvo inspect and ritvo review as they land, and ritvo demo on examples/mcp-demo after that.

Getting help

See SUPPORT.md. Report security issues privately as described in SECURITY.md, never in a public issue.

Contributing

See CONTRIBUTING.md. Every commit needs a DCO sign-off. Please read the Code of Conduct.

Licence

Apache-2.0. See LICENSE and NOTICE. The name Ritvo is covered by TRADEMARK.md.