Niyantrak — public demo

The hosted, read-only demo of Niyantrak, governance for AI agents and business bots: https://demo.vigyanbytes.com

This repository holds only what is needed to build and run that demo. It has no secrets and needs none.

What you can do there

• Try it — paste a message; personal identifiers (Aadhaar, PAN, UPI, card numbers, IBAN, SSN, NHS, emails, phone numbers, …) come back as placeholders such as <AADHAAR_1>. The check runs Niyantrak's own Python recognizers (checksum-validated) on the server.
• Overview, Fleet, Activity (6W), Decisions, Compliance, Proof — the panel's screens, filled with a fictional sample team (asha, ravi, meera, tomas; six machines on documentation-range addresses) generated by tools/demo-data.py in the free edition and labelled "Sample data" on every screen.
• The OWASP LLM coverage and the Pro screens are shown as previews.

How it stays safe

No login, no writes	The only POST that works is /api/scan. Every other POST is refused with 403; PUT, PATCH, DELETE, OPTIONS and friends with 405. There is no join, approve, discover or regenerate.
Nothing stored	Submitted text lives in memory for the length of one request. No database, no files: the container runs with a read-only root filesystem.
Nothing logged	Request logs contain method, path without the query string, status and duration. Never the body, the query string, the client address, the user agent or cookies.
Rate limited	30 scans a minute per client (burst 10), 600 a minute in total; 64 KB per request, 20 000 characters per text. Clients are tracked by a salted hash in memory only.
No real data	Every name, machine, path and address in the sample data is made up. The real panel's live screens (which show the running machine's hostname and addresses) are never served: Overview and Fleet come from the sample bundle baked into the page at build time, and the server exposes no node, peer or network API. scripts/smoke.sh fails if a public response contains a real fleet hostname, the origin address, or a private/tailnet address.
Headers	Content-Security-Policy (default-src 'none', scripts only from this page by hash and the pinned ECharts on jsDelivr, frame-ancestors 'none'), X-Frame-Options DENY, nosniff, no-referrer, Permissions-Policy, COOP/CORP, HSTS. API responses are Cache-Control: no-store.
Pinned build	Base image by digest, the free edition by commit (v0.1.1 = d0bc4be), build-only packages by version. Runs as an unprivileged user (uid 10001).

Settings live in demo/config.json; the server refuses to start unless read_only is true.

Run it locally

docker build -t niyantrak-demo .
docker run --rm --read-only --cap-drop ALL --security-opt no-new-privileges -p 127.0.0.1:8080:8080 niyantrak-demo
scripts/smoke.sh http://127.0.0.1:8080          # RATE_LIMIT=1 to also check the 429

Without Docker (Python 3.10+):

git clone --branch v0.1.1 https://github.com/vigyanbytes/niyantrak.git ../niyantrak
pip install 'pyarrow==26.0.0' 'duckdb==2.0.0'          # build time only, for the sample data
python3 demo/seed.py --src ../niyantrak --out demo/site
PYTHONPATH=../niyantrak python3 demo/server.py --port 8080

Files

File	What it does
Dockerfile	Two stages: build the demo page from the pinned free edition, then a slim runtime with the server and the recognizers only. Has a healthcheck on /healthz.
demo/seed.py	Runs the free edition's tools/demo-data.py (fictional team) and tools/build-demo.py, then points "Try it" at the server.
demo/server.py	Standard-library HTTP server: the page, /healthz, /api/scan; everything else read-only.
demo/config.json	Read-only flag, rate limits, logging fields, security headers and CSP.
scripts/smoke.sh	curl checks: health, page and headers, scan placeholders, writes refused, size limit, optional rate limit. Takes extra curl args after -- (for example --resolve).

Hosting

Deployed with Coolify from this repository (Dockerfile build, port 8080) on a VPS behind Cloudflare, as its own application; it shares nothing with other sites on that host. Cloudflare does not cache HTML or /api/* for this hostname; the page is no-cache and the API no-store at the origin either way.

First-time setup (needs a write-capable Coolify token and a Cloudflare DNS token; both scripts are report-only without --apply and touch only the demo's own app and record):

COOLIFY_BASE_URL=http://localhost:8000 COOLIFY_TOKEN=... deploy/coolify-create.sh --apply
CLOUDFLARE_API_TOKEN=... deploy/cloudflare-demo-dns.sh --apply
scripts/smoke.sh https://demo.vigyanbytes.com

License

Apache-2.0. Niyantrak itself is Apache-2.0 too, © VigyanBytes Solutions Private Limited.