Osprey V1 - Open Source Rules Engine for Trust and Safety

TL;DR

TL;DR: Osprey V1 is an open-source rules engine built by Discord, open-sourced through ROOST, for real-time trust and safety operations. It processes over 50 million events per day in production at Bluesky, Discord, and Matrix.org.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: roost.tools/osprey
• Source repository: github.com/roostorg/osprey
• License: Apache-2.0 (verified via GitHub API license.spdx_id)
• HN launch thread: news.ycombinator.com/item?id=46860249
• Source last checked: 2026-06-25 (commit verified via GitHub API)

What Is Osprey?

Osprey is an event stream decisions engine and analysis UI designed to investigate and take automatic action on events and their properties as they happen in real-time. It was originally developed internally at Discord to combat spam, abuse, botting, and scripting, then open-sourced through ROOST (Robust Open Online Safety Tools) — a non-profit backed by major tech companies and philanthropies.

“Automate the obvious and investigate the ambiguous.” — Osprey tagline

The project describes itself as:

“High-performance safety rules engine for real-time event processing at scale.”

Osprey is used in production by:

• Bluesky — Trust and Safety operations at scale
• Discord — Re-integrated the community-enhanced V1.0 back into its own platform
• Matrix.org — Protecting the matrix.org network and wider Matrix ecosystem

Architecture Overview

Osprey evaluates events using Structured Meta Language (SML) — a structured rule logic that is extendable via user-defined functions (UDFs). Key capabilities:

• Rules-based decision engine — encode and manage nuanced, platform-specific anti-abuse and safety rules
• State tracking — track state across events by labelling entities (via a pluggable labels service backend; a Postgres example is provided)
• Configurable output sinks — verdicts and custom effects can be routed to any output destination
• Investigation UI — query human actions and past decisions, conduct investigations into emerging threats

Setup Workflow

Prerequisites

• Python 3.10+
• Docker (for containerized deployment)
• A Postgres database (optional, for the labels service backend)

Step 1: Clone the Repository

git clone https://github.com/roostorg/osprey.git
cd osprey

Step 2: Run the Quickstart

Follow the official getting-started guide at roostorg.github.io/osprey.

# Start with Docker Compose (example)
docker compose up -d

Step 3: Write Your First Rule

Rules are written in SML with UDF extensibility:

# Example UDF concept (pseudocode)
def is_new_account(event):
    return event.account_age_days < 7

# Example rule
rule = """
IF is_new_account(event) AND event.action_type == "post":
  VERDICT: DENY
  REASON: "New account posting too fast"
"""

Consult the docs for the full SML syntax and API reference.

Deeper Analysis

Why a Rules Engine for Trust and Safety?

Trust and Safety work sits at the intersection of automated detection and human judgment. Pure ML models are effective at pattern matching but are opaque and hard to audit. Pure rule systems are transparent but brittle. Osprey bridges both: structured rule logic for auditable decisions, with UDF hooks for custom detection logic.

The original Discord tool was designed to handle the immense scale and complexity of a large platform ecosystem. By open-sourcing it, ROOST has made this capability available to smaller platforms that cannot afford to build such tooling from scratch.

What ROOST Is

ROOST (Robust Open Online Safety Tools) is a non-profit organization that brings together expertise, resources, and investments from major technology companies and philanthropies to build scalable, interoperable safety infrastructure for the AI era. ROOST is not a company — it is a cooperative infrastructure builder.

Practical Evaluation Checklist

• [x] Actively maintained (444 stars on GitHub, active Discord community)
• [x] Production-proven (50M events/day at Bluesky, used by Discord internally)
• [x] Open source with Apache-2.0 license
• [x] Supports UDF extensibility for custom detection logic
• [x] Integrates into existing architecture rather than replacing it
• [x] Supports human-in-the-loop investigation workflows
• [x] Pluggable labels service with Postgres backend example
• [x] Pre-commit hooks with Ruff linting and MyPy type checking

Security Notes

Because Osprey handles sensitive trust and safety data, the Apache 2.0 license means any organization can inspect, run, and modify the code without asking for permission. The self-hosted deployment model keeps incident data under your own control — critical for platforms handling user reports and abuse data.

FAQ

Q: What is the difference between Osprey and a pure ML-based moderation system? A: Osprey uses structured rule logic (SML) that is auditable and explainable. ML systems can be more accurate at pattern matching but are opaque. Osprey is designed to combine human-written rules with automated decision-making, with full audit trails for human reviewers.

Q: Can I self-host Osprey? A: Yes. Osprey is designed to be self-hosted. You deploy it on your own infrastructure. It integrates into existing architecture rather than replacing it.

Q: What programming language is Osprey written in? A: Python. The codebase uses Ruff for linting and MyPy for type checking.

Q: How does it track state across events? A: Osprey can label entities (users, sessions, etc.) and track those labels across events, if you provide a labels service backend. A Postgres-backed example is included in the repository.

Conclusion

Osprey V1 is a production-grade, open-source rules engine for platforms that need real-time trust and safety capabilities without building from scratch. Backed by Discord, Bluesky, and Matrix.org — three very different platform architectures — it is designed to be flexible, extensible, and interoperable. If you are building or operating a platform with abuse, spam, or safety challenges, Osprey is worth evaluating.

HN thread: news.ycombinator.com/item?id=46860249