Lustena

Documentation

AI governance control plane
documentation

Lustena is a platform for scaling AI use with control. See and govern the agents your whole company uses, with owners, limits, content-free findings and an audit trail.

Install for free

Start here

Getting started

Roll out the browser extension, enroll devices and watch agents appear in the inventory.

Install for free

Enterprise

The full platform, with forward deployed engineers in your rollout.

See enterprise

What you can do with Lustena

Four entry points, one inventory.

Browser extension

Roll out by policy

The organization sets three keys through enterprise policy into the extension's managed storage. No tenant id is configured on the device; the API derives it from the enrollment token.

  • Google Admin: Devices → Chrome → Apps & extensions → Users & browsers → select the extension → Policy for extensions.
  • Jamf: a configuration profile for the preference domain com.google.Chrome.extensions.<id>.
  • Intune: registry values under HKLM\Software\Policies\Google\Chrome\3rdparty\extensions\<id>\policy (Edge: the same path under Microsoft\Edge).
  • Without managed keys the extension stays in local mode and sends nothing.
{
  "api_base_url": "https://api.lustena.ai",
  "enrollment_token": "<enrollment token>",
  "user_hint": "<employee email>"
}

Python SDK

Instrument a framework

The SDK sends governance envelopes to the platform: who acted, which model, which tools and what class of data. Your agent keeps running unchanged.

  • Capture modes for CrewAI, LangGraph, Google ADK, Agno, OpenTelemetry, LiteLLM, MCP, HTTP and manual seams.
  • Privacy modes and local detections run in your process; an optional LLM judge runs on your own model.
  • Every envelope is validated against the wire schema before it ships.
# shell
pip install "lustena-sdk[gov-spec-validation] @ git+https://github.com/lustena-ai/sdk@v0.8.3"

# python
import os
import lustena_sdk

lustena_sdk.configure(
    api_url="https://api.lustena.ai",
    token=os.environ["LUSTENA_TOKEN"],
)

MCP server

The inventory from your editor

Fifteen tools over MCP: declare and list agents, discover local processes, run and schedule scans, fetch reports, set and read limits, list alerts. Two transports: stdio and Streamable HTTP.

  • One login per machine: the server prints a URL and an eight-character code an admin approves.
  • The token lives in the OS keychain; no token in the config.
  • The host that spawned the server registers itself as an observed agent.
{
  "mcpServers": {
    "lustena": {
      "command": "node",
      "args": ["/absolute/path/to/mcp/bin/lustena", "mcp"],
      "env": { "LUSTENA_API_URL": "https://api.lustena.ai" }
    }
  }
}

Scanner

Red-team an endpoint you are authorized to test

Ten agent-native checks grouped into core, surfaces and topology suites, plus endpoint hygiene. The report attaches to the agent in the inventory.

  • Run a whole suite with --suite, or single checks by name.
  • Endpoint hygiene reports the clean case and the unreachable case as information, never as a pass.
  • Credentials are referenced by environment variable name, never pasted.
lustena-scan run --target https://agent.example.com/chat --suite core
lustena-scan checks --json   # the catalog

Agents everywhere.

Control here.

Install for freeTalk to us