Gavio
The AI request runtime and inspector for production systems.
PII protection · audit trails · runtime events · reliability · cost control — as composable
interceptors. Same API in Python, Java, and JavaScript.
📖 Docs: manojmallick.github.io/gavio
What is Gavio?
Gavio sits between your application and any LLM provider. Every request
passes through a pre/post interceptor chain — PII redaction, retries, cost
tracking, audit logging, policy packs, tool runtime, runtime context — before and after the
provider call:
Request → [ PII Guard · Secret Scanner · … ] → Provider → [ … · PII Restore · Audit ] → Response
Every team re-implements the same production concerns around LLM calls: redact
PII before it leaves the building, retry on 429s, fall back to a second
provider, log an audit trail, track spend. Gavio ships them once, as swappable
interceptors, with identical behaviour across three languages — enforced by
shared test vectors.
- Provider-agnostic — OpenAI, Anthropic, Gemini, Azure, OpenRouter, Ollama, Mock. Switching is a config change.
- Zero mandatory dependencies in every core (stdlib HTTP everywhere — no vendor SDKs).
- Dev mode — the whole stack runs in-process with a mock provider. No API key, no network.
- Audit by default — every call logged as metadata + SHA-256 content hashes (never raw text).
- Runtime event export — metadata-safe JSONL events for integrations with gateways, observability, and eval workflows.
- Ecosystem integrations — compatibility matrix, dependency-light metadata helpers, adapter payloads, generated conformance evidence, and sample production apps for LiteLLM, promptfoo, Langfuse, OpenLIT, LangChain, LangGraph, Vercel AI SDK, and related stack tools.
- Self-hosted Control Plane — optional local/private server and admin UI for runtime config, policy rollout, budget config, audit search, workflow releases, and cached SDK fallback.
- Production Trust Package — metadata-only release evidence bundles that verify audit-chain, runtime-event, policy, benchmark, and document evidence.
- Platform Runtime Profile — metadata-only readiness score and gap report for platform-grade production runtime posture.
- Platform Workflow Release — one metadata-only release artifact for prompts, evals, policy packs, trust bundles, and runtime profiles.
- OTel bridge — runtime events map to OpenTelemetry-style spans for production APM pipelines.
- Inspector — opt-in dev-time visualizer: live traces, per-interceptor waterfall, PII redaction diffs, and pipeline lints at
http://127.0.0.1:7411 (inspect(true) or GAVIO_INSPECT=1).
- Inspector agentic & production mode — multi-agent call graphs and session views, trace replay & edit-resend (full mode only), RED stats, hash-chain verification, PII-sanitized export of any trace as a test case, and a read-only dashboard over a persisted audit store:
gavio inspect --store audit.jsonl.
Status: v3.2.1 is the current stable package line. Gavio has an API
stability guarantee, a 24-month 1.x LTS policy, and release automation that
checks lockstep SDK versions before publishing. See
STABILITY.md and the CHANGELOG.
Version map
The package line stays normal semver: v0.11.0 through v0.14.0 completed the
last pre-1.0 product milestones, then v1.0.0 became the stable release.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
