Overview

UrNammu is an open-source AI governance and compliance platform for enterprise teams. It provides centralized oversight of AI systems, autonomous agents, and API usage across your organization.

What is UrNammu?

Named after the ancient Sumerian code of law, UrNammu brings structure and accountability to AI usage in your organization. It answers critical questions:

  • What AI systems are we running? — Complete registry of systems and agents, with staged approval and governance records
  • What risks do they pose? — Multi-dimensional risk scoring, heat maps, and EU AI Act classification
  • Are we compliant? — Framework control catalog, policy enforcement, evidence, and audit trails
  • What shadow AI exists, and is it actually blocked? — Automated discovery across identity, device, network, and endpoint sources, with a blocklist feed and IdP app-disable for enforcement
  • Is sensitive data leaking? — Scheduled leakage probes against your AI gateways and inline DLP on proxy traffic
  • What does it cost, and who is using what? — Provider, gateway, and developer-tool telemetry with budgets, anomaly detection, key usage rules, and a per-person view that totals every surface for one named colleague

Key capabilities

  • AI System & Agent Registry — Inventory every AI system and autonomous agent with ownership, lifecycle status, and traceability
  • Approval Workflows & Governance Records — Staged Owner / Security / Legal / Compliance sign-off, time-bound exceptions, evidence artifacts, and governance incidents per system
  • Agent Governance Lifecycle — Charter and approval gate, a proxy-enforced kill switch, human-review triggers with a pending review queue, accountability roles, incidents and retirement, behaviour baselines, and a six-dimension posture score
  • MCP Tool Governance — Per-agent allowlists for MCP servers and tools, plus an org-approved catalog, observed and enforced at the proxy
  • Framework Controls — Seeded NIST AI RMF, ISO/IEC 42001, EU AI Act, and SOC 2 control catalog with crosswalk inheritance and per-framework coverage
  • EU AI Act Classification — Wizard that derives each system's risk tier and pre-creates its article obligations for evidence
  • Risk Center — Score systems across six dimensions (bias, security, privacy, fairness, performance, transparency) with interactive heat maps
  • Endpoint Agent — An installable agent for managed macOS and Windows machines that reports the AI apps, allowlisted AI hostnames, and local model runtimes a device actually uses — the only source that sees off-VPN laptops, personal-tier accounts, and loopback inference. Reports identifiers and counts only, never prompts, responses, or URLs
  • Shadow AI Discovery & Enforcement — Detect unregistered tools via Google Workspace and Microsoft 365 OAuth scans, Hexnode UEM, CrowdStrike Falcon, DNS / proxy / Netskope log imports, the installable endpoint agent, and manual reporting, matched against a 164-tool registry with per-tool users, granted scopes, and first and last seen; enforce blocks through a network blocklist feed and identity-provider app-disable
  • Sensitive Scan & Inline DLP — Probe configured gateways for system-prompt, credential, and PII leakage; inspect live proxy traffic for secrets, exfiltration attempts, and pasted sensitive data
  • Compliance & Policy-as-Code — Define governance policies, enforce machine-readable rules at the proxy, and track compliance per system with a Policy Denials log
  • Alerts & Key Usage Rules — One inbox for every governance signal, tunable dangerous-prompt rules, and key usage rules that flag anomalous API key behaviour
  • AI Oversight — Monitor usage, budgets, costs, and anomalies across provider admin APIs and AI gateways; grade each provider's security and privacy posture
  • Developer AI Dashboards — Per-surface telemetry for Claude Platform, Claude Code, Cowork, Cursor, and GitHub Copilot, plus session traces that replay a session with the proxy's view of each call
  • Usage by Person & Directory Sync — Per-person cost and token totals joined across every surface, with identity, aliases, and departments synced from Google Workspace or Microsoft Entra ID and an alert when a deactivated person keeps using AI
  • Reports & Executive Dashboard — Templated, exportable, schedulable governance reports and a board-ready posture summary with 12-month trends
  • Vendor Governance — Track vendor risk, contracts, subprocessors, and data residency requirements

Quick start

The fastest way to get running:

git clone https://github.com/JuanNephrota/UrNammu-community.git
cd UrNammu-community
npm install
cp .env.example .env     # Configure your environment
npx prisma migrate dev   # Set up database
npm run db:seed           # Load demo data
npm run dev               # Start on http://localhost:3000

For the full installation guide including production deployment, see the Installation page.

Prerequisites

  • Node.js 20+
  • PostgreSQL 16+ (Homebrew on macOS, or any managed Postgres)
  • Google or Microsoft OAuth credentials (for production authentication)
  • Optional: Azure Functions CLI (for the API proxy)