Choose an assistant scene, load an example or write your own prompt, then see the verdict Gate returns before your application calls its model.
npm install koma-gateUse it before your application model call. Express and Fastify examples are in the guide.
koma-gate classifier.| classification | — |
| model | — |
| latency | — |
| cached | — |
| reason | — |
Pick a real failure mode. Scout checks the cheap request boundary first, then either blocks immediately or hands the request to your expensive transcription and LLM pipeline.
npm install koma-scoutAdd it before transcription, file parsing, or any other expensive downstream work.
Core separates searchable metadata from protected payloads. Run the attack first, then compare it with the legitimate backend path that can derive the missing content address.
npm install koma-coreKeep token derivation and protected payload retrieval on your backend.
You ask Claude to change a UI. It tries to write before loading your design Skill. Miko blocks the write, tells Claude exactly what is missing, and lets it retry—inside the CLI you already use.
npm install -D koma-miko@alpha
npx koma-miko init --host claudePaste both lines in the project root. The initializer creates the Agent Spec and Claude hook configuration.
A short, honest FAQ for people shipping their first AI feature and engineers deciding whether these boundaries belong in production. / 给第一次做 AI 功能的人，也给正在判断这些边界能否进入生产环境的工程师。
Start with the expensive mistake you want to prevent: Miko for coding agents skipping project rules; Gate for prompt injection or off-topic input; Scout for abusive voice/upload traffic; Core for searchable metadata whose payload must stay protected. Each package works alone.
从你最想避免的昂贵错误开始：Agent 忽略项目规则用 Miko；Prompt 注入或跑题输入用 Gate；恶意语音/上传流量用 Scout；需要“索引可搜索、正文受保护”用 Core。每个包都可以独立使用。
Gate sends your prompt to the configured classifier, but saves nothing by default. A wrong-verdict prompt is stored for up to 30 days only after you explicitly opt in. Scout sends simulated metadata, Miko replays privacy-minimized verifier events, and Core uses seeded demo documents. Never paste secrets.
Gate 会把 Prompt 发给已配置的分类模型，但默认不保存。只有你明确同意提交错误判定时，该 Prompt 才会最多保留 30 天。Scout 发送模拟元数据，Miko 回放经过隐私最小化的验证事件，Core 使用预置演示文档。请勿粘贴秘密信息。查看隐私说明 ↗
Sometimes. Local verification and the ledger use no model tokens, and a clean ALLOW path adds little or no agent context. A DENY, Skill reload, or retry costs tokens—but may save much more by preventing a wrong implementation. Koma does not yet claim measured token savings.
有时会。本地验证和账本不消耗模型 Token，正常放行几乎不增加 Agent 上下文；但 DENY、重载 Skill 和重试会产生消耗。它的目标是用可控开销避免更昂贵的错误实现与返工。目前 Koma 不宣称已经实测能够节省 Token。
Gate's semantic verdict depends on the configured LLM. Scout's demo boundary checks, Core's split-store/token derivation, and Miko's contract verification are deterministic once configured. External geo providers, CI evidence, storage, and host adapters remain operational dependencies.
Gate 的语义判定依赖已配置的 LLM。Scout Demo 的边界检查、Core 的分离存储与 Token 派生、Miko 的契约验证在配置确定后都是确定性的。外部地理位置服务、CI 证据、存储层和宿主适配器仍属于运行依赖。
No. Miko can block observable tool boundaries when the host supports hooks, record Skill/Read/test events, and distinguish asserted evidence from observed or external evidence. It cannot inspect hidden model state, prove comprehension, or protect a path that bypasses the adapter.
不能。宿主支持 Hook 时，Miko 可以阻断可观察的工具边界，记录 Skill、Read、测试等事件，并区分 Agent 自述与真实观察/外部证据；但它无法查看模型隐藏状态、证明模型真正理解，也无法保护绕过适配器的路径。
Evaluate packages independently against your threat model. Choose fail-open or fail-closed behavior deliberately; test the real host adapter; use durable rate limits, storage, and key management; and exercise bypass and outage cases. The in-memory stores and scripted fixtures in this demo are demonstrations, not a production architecture.
请按你的威胁模型分别评估每个包；明确选择 fail-open 或 fail-closed；测试真实宿主适配器；使用持久化的限流、存储和密钥管理；并覆盖绕过与故障场景。本 Demo 的内存存储和脚本化 fixture 只是展示，不是生产架构。