Documentation

Everything the control plane does, written down.

Start with the quickstart — install, scan, write a policy, and watch a call get refused. Then go as deep as you need: the rule language, the deployment topologies, and an honest threat model.

Start here

Four commands to a governed run

The scanner is read-only and needs no account. You will know what is ungoverned on your machine before you decide anything else.

Quickstart

TerminalShell

$ npx @cirvix/agent-control scan$ cirvix check --action fs.read --resource .env$ cirvix policy$ cirvix gateway --servers ~/.cursor/mcp.json

Getting started

Install the CLI, scan a machine, and run your first governed call.

Core concepts

The vocabulary and the decision path everything else builds on.

Guides

Task-focused walkthroughs for the integrations and workflows teams reach for first.

Deployment

Run the control plane in Docker, Kubernetes, or your own VPC.

Reference

The CLI, SDKs, REST API, configuration file, and policy schema in full.

Security

The threat model, the boundary, and how to harden a deployment.