Secure data exchange that now watches, predicts, and explains itself.
X-Road moves data between organisations with end-to-end integrity and non-repudiation. This edition adds an opt-in intelligence layer that runs beside the system — never in the signing path.
From raw signal to operator action — on metadata alone.
Four stages, executed by a read-only sidecar that never reads message contents.
Anomaly detection
A federated temporal call-graph model flags traffic, latency, fault and fan-out anomalies per edge.
Incident clustering
Collapses a wall of edge alerts into a few incidents, centred on the prime-suspect subsystem.
Breach forecasting
Projects each edge's trend to warn — with a confidence score — before a metric actually breaches.
Grounded copilot
Turns an incident into a plain-language, source-cited briefing with read-only next checks.
Additive, opt-in modules. X-Road runs normally with the AI off.
Every claim below maps to code in the repository — ports, endpoints and providers included.
| Module | Capability | Surface | Status |
|---|---|---|---|
| ai-monitor | Explainable Z-score + linear-trend anomaly detection over X-Road traffic. | REST /api/v1/anomalies · :4200 | Live |
| ai-insights | Error, usage, capacity and security analysis — plus natural-language queries. | REST /api/v1/insights · :4201 | Live |
| common-ai | Provider-agnostic core — Anthropic, OpenAI, or on-prem Ollama — with anonymiser, rate-limit and health checks. | Library · Spring | Live |
| xroad-ai-platform | Federated graph detection, incident correlation, forecasting and grounded copilot. | Read-only sidecar | Live |
| admin-ui | AI Monitoring section — anomaly dashboard, drill-down detail, provider & privacy settings. | Security Server · Vue 3 | Live |
| rust-accel | Optional high-performance proxy, crypto and scanner components via gRPC / FFI. | Proposal | Roadmap |
The whole loop, offline, in milliseconds.
No live system, no network, no install. The core trains on synthetic traffic and reports.
$ make clean && make eval window '2026-06-09': 95 calls, 4 edges, 5 nodes (baseline windows: 6) 4 ANOMALY ALERT(S) [ high] LATENCY_SPIKE analytics → registry — mean 2500ms vs baseline 119ms (z=569.2) [ high] VOLUME_SPIKE client-a → registry — 70 calls vs baseline mean 11.8 (z=69.6) [medium] NEW_EDGE scanner → registry — previously unseen call edge with 5 calls [ high] FAULT_SPIKE client-a → payments — fault rate 70% vs baseline 0% 3 CORRELATED INCIDENT(S) INC-1 [ high] registry (service) — 2 alerts [LATENCY_SPIKE, VOLUME_SPIKE] from 2 callers INC-2 [ high] payments (service) — 1 alert [FAULT_SPIKE] INC-3 [medium] scanner (client) — 1 alert [NEW_EDGE] 1 PREDICTED BREACH(ES) [medium] latency analytics → payments — ~3.0 windows to breach (confidence 1.0) READ-ONLY: PASS NO-PAYLOAD: PASS NFR: PASS 44 passed ALL GATES GREEN
make eval, run offline with the Python standard library only.Government-grade guardrails, enforced in code and CI.
Not convention — gates. The build fails if any of these is violated.
- 01
Opt-in by default
Every AI feature is off until an administrator turns it on.
- 02
Air-gap friendly
Run entirely on-premise with Ollama — no cloud dependency.
- 03
No payloads, ever
AI consumes operational metadata only; the signing and message-log path is never read.
- 04
Anonymised before egress
Data is sanitised before any external call; nothing leaves without consent.
- 05
Advisory, non-blocking
Models alert, correlate, forecast and explain — they never block, route, or sign.
- 06
Federated & local
Models train per server; only aggregate deltas are shared, never raw data.
Read the source.
X-Road® is a registered trademark of the Nordic Institute for Interoperability Solutions (NIIS). The AI capabilities shown here are an additive, opt-in extension licensed under the MIT License. This is a community fork — not an official NIIS product page.
Built as one self-contained HTML file. No frameworks, no trackers, no build step. Set in Georgia & monospace.