Skip to content
Cirvix.
Start
Private beta · 472 Node + 68 Python tests green

The enterprise control plane
for AI agents. workflows. policy. audit trails. governance.

Cirvix sits between your agents and everything they touch.

Start interactive demoExplore API specs
live
  • permitfs.read · src/index.ts3ms
  • denyfs.read · .env.production2ms
  • permitdb.query · customers8ms
  • holdk8s.apply · production/checkout4ms
  • routehttp.request · api.stripe.com7ms
  • denyfs.read · ~/.aws/credentials2ms

Synthetic traffic. Every rule and verdict shown is one the engine produces; latencies are design targets, not benchmarks.

  • 540

    tests passing

    472 Node · 68 Python, on every commit

  • 44

    conformance cases

    one fixture both engines must pass

  • 0

    runtime dependencies

    engine, gateway and both SDKs

What are you here to do?

One read-only command. It inventories every agent runtime, MCP server and reachable credential on your machine, changes nothing, and sends nothing.

$ npx @cirvix/agent-control scan
Quickstart

The agent spends a credential it never holds.

Secret brokeringbilling-bot · 1 handle live
  • Control planesealed · AES-256-GCM
  • Agentmodel context
  • Gatewaypolicy · broker
  • api.stripe.comdestination

The agent asks for a credential by name. It does not receive one.

secrets.get("STRIPE_RESTRICTED_KEY")

Every call goes through one place.

    Agents

  • Claude Code · Cursor
  • LangChain · CrewAI
  • CI / GitHub Actions

Cirvix control plane

  • Policy engine

    ordered rules · default deny

  • Secret broker

    handles · destination-bound

  • Audit chain

    sha-256 · append-only

    Tools & models

  • Anthropic · OpenAI
  • Postgres · S3
  • Stripe · Slack · GitHub

The endpoint holds no inbound port — it polls outward, which is why it works behind NAT and inside a locked-down VPC.

Built with precision engineering.

Latency budget

Design targets per stage — not a benchmark

  • Identity resolve
    0.3ms
  • Policy evaluate
    1.1ms
  • Secret broker
    0.9ms
  • Audit append
    0.6ms

Measured around the decision only, not the tool round trip. We will publish methodology alongside any measured number.

Two lines to adopt

Node SDK

import { guard, parseRules } from "@cirvix/agent-control";

const tools = guard.wrap(myTools, {
  agent: "pr-triage",
  rules: parseRules(policy),
});

// CirvixDenied carries the rule, the reason,
// and the remediation the agent can act on.

Policy, live

Toggle a rule, watch the verdict

fs.read · .env.production

deny

Runs where your agents run

Self-hosted — there is no multi-tenant SaaS to trust

  • Docker Compose

    smallest real deployment

  • Kubernetes + Helm

    supported production path

  • Bare Node

    one process, one SQLite file

The endpoint holds no inbound port. It polls outward, so it works behind NAT and inside a locked-down VPC without a firewall exception.

What it produces

A decision,
and its evidence.

Every call leaves four things behind. None of them is a log line you have to interpret.

{
  "name": "deny-dotenv-read",
  "effect": "forbid",
  "actions": ["fs.read"],
  "resources": [
    "**/.env",
    "**/.env.*"
  ],
  "reason": "The most common path
    from a prompt injection to a
    live credential."
}
RuleWhat the agent may do.
deny

fs.read
.env.production
2.1ms

VerdictWhat happened, and why.
HandleA credential the model never sees.
ChainProof the record was not edited.

One engine.
Every surface.

The gateway, the Node SDK, the Python SDK and the CLI all call the same evaluator. A rule cannot pass review and then behave differently at runtime.

Runtime dependencies
0
Decision path
in-process, no network
Engines in agreement
44 shared cases
Node / Python
≥20 / ≥3.9
Read the docsQuickstart
import { guard, parseRules } from "@cirvix/agent-control";
import { readFile } from "node:fs/promises";

const rules = parseRules(
  JSON.parse(await readFile("cirvix.policy.json", "utf8")),
);

// One line at the executor boundary.
const tools = guard.wrap(myTools, { agent: "pr-triage", rules });

try {
  await executor.invoke(input);
} catch (err) {
  if (err instanceof CirvixDenied) {
    err.policy;      // "deny-dotenv-read"
    err.remediation; // 'secrets.get("STRIPE_KEY")'
    err.decisionId;  // hand to `cirvix why`
  }
  throw err;
}

Built to survive a security review.

Every control below is a mechanism in the repository, not a roadmap item.

  • AES-256-GCM envelope encryption

    Secret material is sealed under a key derived from CIRVIX_MASTER_KEY. The key is never in the database, and there is deliberately no escrow.

  • Tamper-evident audit chain

    SHA-256 over canonical JSON, per tenant, each record committing to its predecessor. Verification localises a break to the exact record.

  • Structural tenant isolation

    orgId is read only from the authenticated principal — the parameter that would allow cross-tenant addressing does not exist in the routing layer.

  • Zero runtime dependencies

    The engine, gateway, and both SDKs ship with no third-party packages. The enforcement path has no supply chain to compromise.

  • OIDC SSO and SCIM 2.0

    Google, Entra and Okta. Identity is (issuer, subject), never email. Deprovisioning revokes live sessions, not just membership.

  • Evidence for SOC 2 and ISO 27001

    Scoped control-coverage reports generated from real configuration and audit records. No report claims compliance — the vocabulary has no word for it.

Cirvix holds no SOC 2 or ISO 27001 certification and publishes no uptime SLA. It is in private beta with no production customers. The compliance reports it generates are evidence for your auditor to assess — they do not assert an outcome, and a test enforces that the coverage vocabulary contains no word for “pass”.

“A refusal an agent cannot read is a refusal it cannot recover from.”
Design notes —  on why every verdict carries its rule and its remedy

Free on your machine. Paid when it is a team.

Save 20%

  • Free

    The full local runtime, on your machine.

    $0/mo

    • Runtime enforcement on every tool call
    • MCP gateway, stdio and HTTP
    • Policy engine, risk classification, local secret vault
    • Local hash-chained audit log
    • No account required
    Install the CLI

  • Pro

    Most teams

    For one developer running agents in production.

    $299/mo

    • Human-in-the-loop approvals
    • Secret rotation and history
    • Attestation headers
    • Shareable decision replay

Cirvix is in private beta. Prices are locked at the rate shown when your plan opens — nothing bills today.

Questions we get asked.

  • Is this running in production anywhere?

    No. Cirvix is in private beta with no production customers. The engine, control plane and SDKs are complete and tested — 472 Node tests, 68 Python tests, and 44 shared conformance cases both engines must pass — but nothing is published to npm or PyPI yet and there is no hosted service.

  • Does it stop prompt injection?

    No, and nothing does. Cirvix constrains what an injected agent can do. An agent that is talked into reading .env still asks; the difference is that the call is refused, recorded, and the refusal names the rule. Constraining consequences is a different claim from preventing the input, and only one of them is achievable.

  • What happens if the control plane goes down?

    Enforcement continues. The gateway and both SDKs evaluate locally against a rule set already on the machine; the daemon caches the last known policy and spools telemetry to disk. A control-plane outage must not become an enforcement outage, which is why the decision path never touches the network.

  • How much latency does it add?

    The published figures are design targets, not benchmarks, and the site labels them as such. Evaluation is an in-process pass over an ordered rule set with no I/O, so the honest answer is that it is small and that we will publish a methodology alongside any measured number.

  • Do I have to route everything through your gateway?

    No. The gateway governs every tool call including ones added after deployment, because it sits on the wire. guard.wrap() governs the tools you hand it and nothing else — a real trade, stated in the docs rather than glossed.

  • Can I self-host it?

    That is the only deployment model today. Docker Compose, a Helm chart, or bare Node. The control plane has zero npm dependencies and stores everything in one SQLite file, so a backup is one file and its WAL.

  • What is the policy language?

    JSON. An ordered array of rules with three effects — permit, forbid, hold — plus a closed set of eleven condition operators. There is no DSL to learn and no expression evaluator, because a policy file is the kind of thing scripts template and turning it into an execution surface would make the security product the vulnerability.

Get started

Let the agents do real work.

Start with the free local scanner — it needs no account and tells you what is already ungoverned on your machine. Move to a governed runtime when you are ready.

StartBook an enterprise demoRead the docs

Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.