@sovr/engine

@sovr/engine

Unified Policy Engine for SOVR — the single decision plane for all proxy channels.

Overview

@sovr/engine is the core policy evaluation engine that powers all SOVR proxy channels. It provides a unified interface for evaluating actions against policy rules, regardless of the channel (exec, sql, http, mcp).

This package is used internally by:

• sovr-mcp-proxy — MCP transport proxy
• @sovr/proxy-exec — Shell command proxy
• @sovr/proxy-sql — SQL statement proxy
• @sovr/proxy-http — HTTP request proxy

Installation

npm install @sovr/engine

Usage

import { PolicyEngine, evaluate } from '@sovr/engine';

const engine = new PolicyEngine({
  rules: [/* your policy rules */],
  failMode: 'fail-close',
});

const result = engine.evaluate({
  channel: 'exec',
  action: 'rm -rf /tmp/data',
  context: { user: 'agent-1' },
});

// result.verdict: 'allow' | 'deny' | 'escalate'
// result.rule: the matching rule (if any)
// result.reason: human-readable explanation

API

PolicyEngine

The main class for policy evaluation.

Method	Description
evaluate(request)	Evaluate an action against all loaded rules
addRule(rule)	Add a rule at runtime
removeRule(id)	Remove a rule by ID
listRules()	List all active rules
getStats()	Get evaluation statistics

evaluate(request)

Standalone function for one-shot evaluation without engine instantiation.

Rule Format

interface PolicyRule {
  id: string;
  description: string;
  channels: ('exec' | 'sql' | 'http' | 'mcp')[];
  action_pattern: string;      // regex pattern
  resource_pattern?: string;   // optional resource filter
  effect: 'allow' | 'deny' | 'escalate';
  risk_level: 'low' | 'medium' | 'high' | 'critical';
  priority: number;            // higher = evaluated first
}

Verdict Format

interface Verdict {
  verdict: 'allow' | 'deny' | 'escalate';
  rule: PolicyRule | null;
  reason: string;
  timestamp: number;
  channel: string;
}

Built-in Rules

The engine ships with 15 built-in rules covering common risk patterns across all four channels. See the sovr-mcp-proxy documentation for the complete list.

License

BSL-1.1 (Business Source License 1.1) — See LICENSE for details.

The Licensed Work is the @sovr/engine software. The Change Date is four years from each version's release. After the Change Date, each version converts to Apache-2.0.

Links

• Website: sovr.inc
• GitHub: xie38388/sovr
• npm: @sovr/engine