SoterAI

The AI security command layer. Stop prompt injection, data exfiltration, and rogue agent actions — at the input, at the output, and at the tool call.

Self-hostable · Offline-capable · India-first PII detection · Reproducible benchmarks

Quick start · Benchmarks · Architecture · SDKs · Self-host · Licensing

Why SoterAI

An LLM app has three attack surfaces, and most tools cover one. SoterAI covers all three from a single policy engine:

Detection runs locally, on CPU, with no network call — so it works air-gapped and adds single-digit milliseconds rather than an extra LLM round-trip.

OWASP LLM Top 10 aligned defense-in-depth for risk reduction: the layers below work together — detection, protection, control, compliance, and monitoring — because no single check is sufficient on its own.

Quick start

1. Guard an LLM call (Node.js)

npm install @soterai/core

import { Soter } from "@soterai/core";

const soter = new Soter({ apiKey: process.env.SOTERAI_API_KEY });

// ── Input: check before you spend a token on the model ──
const check = await soter.guardInput({
  message: userMessage,
  userId: "user_123",
  sessionId: "session_456",
});

if (soter.shouldBlock(check)) {
  return { reply: "Message blocked for security reasons." };
}

const safeInput = soter.getSafeText(check, userMessage) ?? userMessage;
const answer = await callMyLLM(safeInput);

// ── Output: check before it reaches the user ──
const outbound = await soter.guardOutput({
  aiResponse: answer,
  sessionId: "session_456",
});

return { reply: soter.getSafeText(outbound, answer) ?? answer };

2. Guard an LLM call (Python)

pip install soter

from soter import Soter

guard = Soter()  # reads SOTER_API_KEY / SOTER_BASE_URL

check = guard.input(user_message, session_id="session_456")
if not guard.should_call_llm(check):
    return "Message blocked for security reasons."

answer = call_my_llm(guard.get_safe_input(check, user_message))

outbound = guard.output(answer, session_id="session_456")
return guard.get_safe_output(outbound, answer)

Or let the SDK run the whole round-trip, guarding both sides:

result = guard.protect_chat(user_message, call_llm=call_my_llm, session_id="session_456")
print(result.reply)

3. No code — try it first

The playground runs the same classifier this repo ships. Paste an attack, see the decision and which detector fired.

Detection performance

Every number below is produced by the production classifier (analyzeText) — the same code path the API serves — and is reproducible from a clean checkout.

Measured 2026-09-02 · commit 911e8d8b · Node v22.16.0

npx tsx scripts/readme-recall-audit.ts

Read the blind-set row before you trust the aggregate. The 98.40% figure covers corpora the detectors were iterated against — it is a regression measure, not a generalization one. On the blind held-out set, which no detector has ever been tuned against, recall is 61.54%, consistent with the ~64% documented ceiling of a rules-first engine on novel phrasings. That gap is the honest state of the art here, it is asserted as a floor in CI (tests/guard/heldout-generalization.test.ts), and closing it is what the ML/semantic tier exists for.

Precision is treated as the hard gate, not recall: benign false positives break real users, so FPR is held at ≤5% on every set, tuned or blind. It currently measures 0.00% on 322 controls.

Latency

From the committed benchmark run (benchmarks/results/latest.json, 2026-07-22, 3,200 cases, CPU only, no network):

Public synthetic benchmark

A separate 3,200-case synthetic corpus (2,200 attacks / 1,000 benign) scores 100.00% recall at 0.00% FPR. It is self-authored and self-maintained — useful as a release gate, not as evidence against an adaptive attacker, and not an independent audit.

node scripts/phase-9-run-public-benchmark.js

Methodology, per-category recall, and stated limitations: /benchmark · dataset card · limitations

To benchmark against third-party corpora, drop PINT / JailbreakBench / HarmBench files into datasets/external/.

Architecture

        ┌──────────────┐   ┌──────────┐   ┌──────────────────┐
        │   Chatbot    │   │ RAG app  │   │ Autonomous agent │
        └──────┬───────┘   └────┬─────┘   └────────┬─────────┘
               │                │                  │
               ▼                ▼                  ▼
   ╔═══════════════════════════════════════════════════════════╗
   ║                      SoterAI Guard                        ║
   ║                                                           ║
   ║   ┌─────────────┐  ┌─────────────┐  ┌─────────────────┐  ║
   ║   │ Input Guard │  │Output Guard │  │ Agent Firewall  │  ║
   ║   ├─────────────┤  ├─────────────┤  ├─────────────────┤  ║
   ║   │ injection   │  │ PII leak    │  │ tool allowlist  │  ║
   ║   │ jailbreak   │  │ secrets     │  │ identity verify │  ║
   ║   │ encoding    │  │ unsafe HTML │  │ risk score      │  ║
   ║   │ PII redact  │  │ exfil sinks │  │ policy eval     │  ║
   ║   └─────────────┘  └─────────────┘  └────────┬────────┘  ║
   ║                                              │           ║
   ║   ┌──────────────────────────────────────────┘           ║
   ║   ▼                                                       ║
   ║   ┌─────────────┐  ┌─────────────┐  ┌─────────────────┐  ║
   ║   │  Webhooks   │  │   Reports   │  │   Forensics     │  ║
   ║   │  + SIEM     │  │ + analytics │  │   + audit       │  ║
   ║   └─────────────┘  └─────────────┘  └─────────────────┘  ║
   ╚═══════════════════════════════════════════════════════════╝
               │                │                  │
               ▼                ▼                  ▼
        ┌─────────────┐  ┌───────────┐  ┌──────────────┐
        │ PostgreSQL  │  │   Redis   │  │    Qdrant    │
        │  (Prisma)   │  │  (cache)  │  │  (optional)  │
        └─────────────┘  └───────────┘  └──────────────┘

Detection is a three-tier cascade: deterministic rules first (fast, explainable), then an ONNX classifier, then an optional semantic/LLM judge. Each tier is independently gated and fails open, so a tier being disabled degrades coverage rather than breaking traffic.

SDKs & integrations

Versions below are the currently published ones, verified against the registries on 2026-09-02.

Products

Attack coverage

Self-hosting

SoterAI runs entirely on your own infrastructure. No telemetry leaves the box, and detection needs no outbound network.

This repository is private. Cloning it requires authorized access, and self-hosting from source requires a written license — see LICENSING.md.

git clone https://github.com/yashchauhan66/Soter-AI.git
cd Soter-AI
cp .env.example .env.local        # set DATABASE_URL and AUTH_SECRET
docker compose up -d --build
# → http://localhost:3000

# Required
DATABASE_URL=postgresql://user:pass@host:5432/soter
AUTH_SECRET=<32+ char random string>

# Optional
REDIS_URL=redis://...
QDRANT_URL=http://qdrant:6333
SOTERAI_API_KEY=<key for the hosted control plane>

docker build -t soterai:latest --secret id=npmrc,src=$HOME/.npmrc .
docker run -p 3000:3000 --env-file .env.production soterai:latest

Development

npm install
npx prisma migrate deploy      # requires a running PostgreSQL
npm run dev                    # → http://localhost:3000
npm run db:seed                # optional fixtures

Testing

npm test                       # unit + security suites (103 test files)
npm run typecheck              # tsc --noEmit
npm run test:e2e               # Playwright
npm run verify                 # full gate
npm run test:sdk:js
npm run test:sdk:python

The latest main run of ci-cd.yml is the source of truth for what currently passes. The repository is private, so that link and the run logs are visible to authorized collaborators only.

Playwright applies migrations and seeds fixtures. Point it at a dedicated database via E2E_DATABASE_URL; a loopback-only DATABASE_URL is accepted as a fallback. A remote DATABASE_URL is never touched unless it is repeated verbatim as E2E_DATABASE_URL to confirm it is test-only.

app/                     Next.js app — pages and API routes
  api/guard/               input / output / streaming guard
  api/agent/               agent firewall, ledger, passport, escrow
  dashboard/               50+ feature pages
lib/
  guard/                   detection engine (rules → ONNX → semantic)
  classifiers/datasets/    benchmark corpora
  agent-firewall/          tool-call enforcement
  agent-action-ledger/     reversibility classification
  usage-governance/        5-step policy engine
  control-plane/           enterprise modules (commercial)
packages/                Publishable SDKs and middleware
apps/                    Browser extension, local AI broker
prisma/                  Schema and migrations
benchmarks/              Public benchmark corpus and results
scripts/                 Maintenance, benchmark and CI scripts
tests/                   103 test files

Compliance

Evidence collection and control mappings are implemented; certification is a separate audit process this repository does not claim to have completed.

Security

Found a vulnerability? Please do not open a public issue — see SECURITY.md for the disclosure process.

Licensing

SoterAI is proprietary, closed-source software. This repository is private and confidential. Read LICENSING.md for the authoritative map.

You may not use, copy, modify, redistribute, or self-host this source, offer SoterAI as a hosted or managed AI-security service, or build a competing product from it, without a commercial license.

Previously open core. Until 2026-09-04 this repository was public under BUSL-1.1 with Apache-2.0/MIT client packages. That model is retired. Rights already granted on published package versions are not revoked; the repository source is no longer licensed for outside use.

Commercial licensing and enterprise enquiries: soterai.in/contact-sales

Copyright © 2026 Yash Chauhan. All rights reserved.

Contributing

This is a private repository and external contributions are not accepted. For authorized collaborators, CONTRIBUTING.md has the workflow.

git checkout -b feature/your-change
npm run verify                 # must pass before you open a PR

Two ground rules specific to this project:

1. Never tune a detector against the blind held-out set (heldoutBlindWide.ts, VALIDATION_ATTACKS). Doing so destroys the only honest generalization measurement in the repo.
2. Benchmark claims need a reproduce command. If you change a number in this README, change the script that produces it in the same PR.