Skip to content
Cirvix.
Start

Developers

One command. It finds what you already run.

No account for the scanner, no code changes for MCP, and nothing is rewritten without showing you the diff. If Cirvix cannot govern a surface, it says so rather than quietly leaving a gap.

npx @cirvix/agent-control scan
or: npm install -g @cirvix/agent-controlthen: cirvix scan
QuickstartCLI referenceSDKs

Getting started

Four commands, in order

Each one is useful on its own. You can stop after any of them and still be better off than you were.
  1. 01

    Scan

    Read-only, no account. Reports the agent runtimes, MCP servers, and credentials reachable from agent context on this machine.

    npx @cirvix/agent-control scan
  2. 02

    Check

    Evaluates one hypothetical call against the rule set and executes nothing. The fastest way to answer whether something would be allowed.

    cirvix check --action fs.read --resource .env
  3. 03

    Enforce

    The gateway sits between the agent and its MCP servers. Every tool call is evaluated before it is forwarded, and every result is scanned on the way back.

    cirvix gateway --servers ~/.cursor/mcp.json
  4. 04

    Verify

    Every decision is appended to a hash chain. Verification proves no record was altered after it was written. Rules live in your repository and are reviewed like any other infrastructure change.

    cirvix audit verify

Auto-detection

What it recognises, and what it writes

Detection is a filesystem and process inspection, not magic. Here is exactly what each runtime results in.

On writing config. Editor and framework configuration files are yours. Cirvix backs up anything it modifies, prints a diff before writing, and cirvix uninstall restores the originals. A tool that silently edits your dotfiles has not earned the access it is asking for.

  • Claude Code

    ~/.claude/settings.json — adds cirvix as an MCP server

  • Cursor

    ~/.cursor/mcp.json — routes existing servers via the gateway

  • Windsurf / Cline

    The editor's MCP config, same mechanism

  • LangChain / LangGraph

    Middleware on the tool-executor boundary

  • CrewAI

    Tool wrapper registered at crew construction

  • OpenAI Agents SDK

    Tool-call interceptor on the client

  • MCP servers (any)

    Registered, pinned, and re-exposed through the gateway

  • Docker / Kubernetes

    Sidecar and egress-proxy manifests

If you prefer code

Two lines, at the tool boundary

The SDKs wrap the executor rather than each tool, so a tool added tomorrow is governed the moment it exists.
TypeScriptTypeScript
import { guard } from "@cirvix/agent-control";import { ChatAnthropic } from "@langchain/anthropic"; // Wraps the tool-executor boundary. Every call the agent// makes is authorized before it runs; denials come back as// a typed CirvixDenied the agent can re-plan around.const tools = guard.wrap(myTools, {  agent: "pr-triage",  environment: process.env.CIRVIX_ENV ?? "local",}); const agent = createAgent({ llm: new ChatAnthropic(), tools });
PythonPython
from cirvix import guardfrom crewai import Agent, Crew # Same boundary, same policy set, same decision record.tools = guard.wrap(    my_tools,    agent="support-triage",    environment=os.environ.get("CIRVIX_ENV", "local"),) crew = Crew(agents=[Agent(tools=tools)])

Using MCP? No code changes at all — agents connect to the gateway and the gateway connects to your servers.

Local first

The evaluator on your laptop is the evaluator in production

Policy changes are found to be wrong on your machine, then in CI, and only then in production — in that order, which is the only order that is cheap.
TerminalShell
$ cirvix replay run_01JQ8F2K7M --policy candidate.json --diff   run_01JQ8F2K7M   agent pr-triage   38 calls   changed decisions                 2 of 36   00.412  fs.read  /workspace/.env.production          was  PERMIT allow-workspace-read          now  DENY   deny-dotenv-read   No side effects were executed.

CLI reference

Eight commands: scan, init, run, why, policy, replay, audit, approve.

SDK reference

TypeScript and Python middleware, typed denials, and the local evaluator.

Integration surface

Every runtime, framework, protocol, and deployment target.

Developers

Run the scanner.

It takes one command, needs no account, and tells you something true about your machine. @cirvix/agent-control

StartBook an enterprise demoRead the docs

Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.