Niyantrak — public demo
The hosted, read-only demo of Niyantrak, governance for AI agents and
business bots: https://demo.vigyanbytes.com
This repository holds only what is needed to build and run that demo. It has no secrets and needs none.
What you can do there
- Try it — paste a message; personal identifiers (Aadhaar, PAN, UPI, card numbers, IBAN, SSN, NHS, emails,
phone numbers, …) come back as placeholders such as
<AADHAAR_1>. The check runs Niyantrak's own Python
recognizers (checksum-validated) on the server.
- Overview, Fleet, Activity (6W), Decisions, Compliance, Proof — the panel's screens, filled with a fictional
sample team (asha, ravi, meera, tomas; six machines on documentation-range addresses) generated by
tools/demo-data.py in the free edition and labelled "Sample data" on every screen.
- The OWASP LLM coverage and the Pro screens are shown as previews.
How it stays safe
| |
|---|
| No login, no writes | The only POST that works is /api/scan. Every other POST is refused with 403; PUT, PATCH, DELETE, OPTIONS and friends with 405. There is no join, approve, discover or regenerate. |
| Nothing stored | Submitted text lives in memory for the length of one request. No database, no files: the container runs with a read-only root filesystem. |
| Nothing logged | Request logs contain method, path without the query string, status and duration. Never the body, the query string, the client address, the user agent or cookies. |
| Rate limited | 30 scans a minute per client (burst 10), 600 a minute in total; 64 KB per request, 20 000 characters per text. Clients are tracked by a salted hash in memory only. |
| No real data | Every name, machine, path and address in the sample data is made up. The real panel's live screens (which show the running machine's hostname and addresses) are never served: Overview and Fleet come from the sample bundle baked into the page at build time, and the server exposes no node, peer or network API. scripts/smoke.sh fails if a public response contains a real fleet hostname, the origin address, or a private/tailnet address. |
| Headers | Content-Security-Policy (default-src 'none', scripts only from this page by hash and the pinned ECharts on jsDelivr, frame-ancestors 'none'), X-Frame-Options DENY, nosniff, no-referrer, Permissions-Policy, COOP/CORP, HSTS. API responses are Cache-Control: no-store. |
| Pinned build | Base image by digest, the free edition by commit (v0.1.1 = d0bc4be), build-only packages by version. Runs as an unprivileged user (uid 10001). |
Settings live in demo/config.json; the server refuses to start unless read_only is true.
Run it locally
docker build -t niyantrak-demo .
docker run --rm --read-only --cap-drop ALL --security-opt no-new-privileges -p 127.0.0.1:8080:8080 niyantrak-demo
scripts/smoke.sh http://127.0.0.1:8080 # RATE_LIMIT=1 to also check the 429
Without Docker (Python 3.10+):
git clone --branch v0.1.1 https://github.com/vigyanbytes/niyantrak.git ../niyantrak
pip install 'pyarrow==26.0.0' 'duckdb==2.0.0' # build time only, for the sample data
python3 demo/seed.py --src ../niyantrak --out demo/site
PYTHONPATH=../niyantrak python3 demo/server.py --port 8080
Files
| File | What it does |
|---|
Dockerfile | Two stages: build the demo page from the pinned free edition, then a slim runtime with the server and the recognizers only. Has a healthcheck on /healthz. |
demo/seed.py | Runs the free edition's tools/demo-data.py (fictional team) and tools/build-demo.py, then points "Try it" at the server. |
demo/server.py | Standard-library HTTP server: the page, /healthz, /api/scan; everything else read-only. |
demo/config.json | Read-only flag, rate limits, logging fields, security headers and CSP. |
scripts/smoke.sh | curl checks: health, page and headers, scan placeholders, writes refused, size limit, optional rate limit. Takes extra curl args after -- (for example --resolve). |
Hosting
Deployed with Coolify from this repository (Dockerfile build, port 8080) on a VPS behind Cloudflare, as its own
application; it shares nothing with other sites on that host. Cloudflare does not cache HTML or /api/* for this
hostname; the page is no-cache and the API no-store at the origin either way.
First-time setup (needs a write-capable Coolify token and a Cloudflare DNS token; both scripts are report-only
without --apply and touch only the demo's own app and record):
COOLIFY_BASE_URL=http://localhost:8000 COOLIFY_TOKEN=... deploy/coolify-create.sh --apply
CLOUDFLARE_API_TOKEN=... deploy/cloudflare-demo-dns.sh --apply
scripts/smoke.sh https://demo.vigyanbytes.com
License
Apache-2.0. Niyantrak itself is Apache-2.0 too, © VigyanBytes Solutions Private Limited.
