Why Milvago
Your people already use generative AI. Some of it is sanctioned; most of it is a browser tab
nobody inventoried. A policy nobody can observe is a wish, and blocking everything only moves
the problem to personal devices.
Milvago gives you the missing layer: an accurate inventory of AI usage, and control at the
point where data actually leaves, without reading more than you need and without turning
your security team into a surveillance desk.
What you get
Discover
- 169 known AI platforms detected by presence. The browser endpoint reports that a host
was reached, and nothing of the page. You find out which assistants are in use before
deciding anything.
- Mute what you officially use. Hide sanctioned platforms from Discovery without touching
detection: visits keep being recorded, the noise goes away.
Understand
- Conversations on ChatGPT and Claude: prompts, responses, and which model answered.
- Cartography: a flow diagram of who uses which tool, on which provider, with which model.
- Reports: aggregated views, CSV and JSON export, and a printable synthesis for the
steering committee.
Protect
- Mask before it leaves. Custom masking rules (RE2, up to 25 per organization) replace
sensitive values in the prompt itself with readable markers such as
[IP], or [IP1] and
[IP2] when there are several.
- Block file uploads to covered assistants, on the upload routes measured on each site,
never on a guess.
Built for privacy
- Content, device names and identities encrypted at rest.
- Pseudonymous by default: people appear as aliases. Revealing an identity takes a
dedicated permission, a fresh second factor and a written reason; it is audited and expires
after 15 minutes.
- Content retention from 1 to 30 days, owner-only purge behind a fresh second factor, and
an aggregate-only mode that keeps counts and drops the rest.
Secure by default
- Sign-in through OpenID Connect (Keycloak included), TOTP second factor.
- Role-based access with four built-in roles (owner, admin, viewer, reporter) and a full
audit log.
- REST API with scoped keys (
mvk_…): a key never exceeds its creator's current rights.
- A one-time setup token opens the first-run wizard, then closes it for good. HTTPS is
required beyond localhost.
- Shipped as a distroless, non-root container: no shell, no package manager.
How it works
Browser + Milvago extension Milvago server (Go) Console (React)
┌──────────────────────────┐ HTTPS ┌──────────────────────┐ ┌─────────────────┐
│ presence · capture · │ ───────► │ policy · ingestion · │ ◄───── │ discovery · map │
│ masking · upload guard │ ◄─────── │ signed catalogue │ │ reports · admin │
└──────────────────────────┘ policy └──────────┬───────────┘ └─────────────────┘
│
PostgreSQL ◄──┴──► Keycloak (OIDC)
The server signs the detection catalogue and the policy it hands to endpoints; endpoints
enforce it locally, so masking happens before the request reaches the AI provider.
This repository holds the server and the console. The endpoint agent and its browser
extension are distributed separately.
Quick start
On a Linux server with Bash, curl, Internet access and root or sudo privileges, run:
curl -fsSL https://get.milvago.ai | bash
For shared access, enter your full public Milvago URL, such as https://milvago.example.com, at the Milvago public URL [http://localhost:4020]: prompt.
Prepare DNS and an HTTPS reverse proxy to the server's private IP on port 4020 first.
No GitHub account or token is required. The installer checks prerequisites and installs
the public release using its exact image version and digest.
Press Enter at the prompt for local access at http://localhost:4020; the gateway then binds only to
127.0.0.1:4020. An explicit http://localhost:4020, http://127.0.0.1:4020, or an empty
MILVAGO_PUBLIC_URL selects the same local mode. From another computer, tunnel it with
ssh -L 4020:127.0.0.1:4020 user@server, then open http://localhost:4020 locally. Local mode
opens no additional host ports; the application and identity service remain internal.
To provide the URL directly:
curl -fsSL https://get.milvago.ai | MILVAGO_PUBLIC_URL=https://milvago.example.com bash
For non-interactive local access:
curl -fsSL https://get.milvago.ai | MILVAGO_PUBLIC_URL='' bash
Open the displayed URL and enter MILVAGO_SETUP_TOKEN from the .env file at the
path printed by the installer. Complete the wizard to create the administrator.
Configure and test a real SMTP server for invitations and password-reset email;
Mailpit is disabled by default. See INSTALL.md for prerequisites,
checksum verification, upgrades and building from source.
Update an existing installation
Run the same command again with the Linux account used for the original installation:
curl -fsSL https://get.milvago.ai | bash
The default installation is in ~/milvago-community. If you chose another directory,
point the installer to that existing installation:
curl -fsSL https://get.milvago.ai | MILVAGO_DIR='/absolute/path/to/milvago-community' bash
The installer updates the application image while preserving the database, accounts,
secrets and local configuration. Leave MILVAGO_PUBLIC_URL unset to reuse the URL already
confirmed by the instance; a conflicting URL stops the update. Back up the database and
.env before updating. See Updating an existing installation
for details.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
