Self-hosted · Read the security model →

Cirvix is the runtime authorization layer for AI agents. Every tool call, API action, credential request, and consequential operation is evaluated against identity, policy, and context before execution. See how AI-agent security works at Cirvix.

View plans →Install Free

The agent can reason. Cirvix decides whether it gets to act.

IdentityKnow who the agent is acting for.
AuthorityDefine exactly what it can do.
EnforcementStop unauthorized actions before they execute.
cirvix · decision pipeline illustrative in-browser simulation — evaluated against starter policy rules

Request

agent
pr-triage
action
fs.read
environment
local
origin
developer prompt

Editable. Try ~/.aws/credentials.

Pipeline

  1. parse<0.02ms
  2. normalize<0.03ms
  3. secret detection<0.03ms
  4. risk classification<0.03ms
  5. policy evaluation<0.04ms
  6. approval check—
  7. sanitization—
  8. audit event<0.05ms

Secrets and risk resolve before policy — a rule may test risk >= HIGH, so the value has to exist first.

total<0.2ms

Decision

PERMIT allow-workspace-read

Read inside the workspace root.

riskLOW
  • read-only tool
rules considered
  • allow-workspace-readfs.read /workspace/*
  • deny-dotenv-readfs.read **/.env*
  • deny-credential-filesfs.read **/.aws/** ...

Permitted by allow-workspace-read. Forbid rules checked first.

audit #84921 sha‑256 566c…c1fd prev 0000…0000 verified
    npx @cirvix_ai/agent-control init detects your agents and prints the exact change — it does not edit your config

    Quantitative architecture targets
    <1.2ms
    target policy evaluation latency
    0
    unsanctioned payload data retention
    100%
    local tool-call policy evaluation

    Metric Definitions, Scope & Enforcement Boundaries

    <1.2ms — Latency Target
    Design target for in-memory policy evaluation per decision stage. Separately measured on Intel Core Ultra 5 225U at P50 0.06ms, P99 0.34ms (benchmarks/decision.mjs). Not an SLA guarantee across variable hardware or disk I/O.
    0 — External Cloud Payload Retention
    The local engine ships zero telemetry by default and has no unsolicited phone-home. Arguments and tool payloads are never transmitted to CIRVIX. In Node, telemetry shipping is supported only when explicitly configured with an API endpoint and key; Python has no telemetry shipping capability.
    100% — Governed Tool-Call Evaluation
    Applies exclusively to tool calls explicitly wrapped via guard.wrap() or routed through the MCP gateway. Does not intercept unwrapped tools, native OS processes, or unrouted traffic.
    capability-vs-authority.mdCORE THESIS

    Capability is not authority.

    A model being capable of executing an action does not mean the agent is authorized to cause that consequence.

    Frontier models (such as GPT-6 Astra) are reaching critical cyber-capability thresholds, discovering novel vulnerabilities and chaining multi-step exploits autonomously. Static allowlists and prompt guardrails fail. CIRVIX operates directly in the execution path, enforcing machine-speed (design-target <1.2ms authorization latency) against real-world side effects before actions run.

    Controlled by design

    System architecture
    & execution flow.

    Every agent action crosses a single control layer before it reaches a model, service, or database.

    01 / Inputs
    Client SDKsTyped execution events
    Agent FrameworksBring your own runtime
    WebhooksSigned external triggers
    02 / Core engine
    CONTROL ACTIVE

    Cirvix Control Plane

    Policy Enforcement Engine
    Tamper-Evident Audit Logger
    AES-256 Envelope Encryption
    03 / Outputs
    LLM ProvidersScoped model routing
    External APIsSanctioned tool calls
    DatabasesTenant-aware access
    Control plane primitives

    Built with
    precision engineering.

    A focused set of mechanics for operating AI agents in production without losing the evidence behind every decision.

    Latency budget

    Design targets per execution stage.

    ingressroutepolicyauditegress

    Policy SDK

    One evaluation call, one decision — hash-chained evidence, optionally Ed25519-signed (0.3.0+).

    cirvix.policy.eval({
     agent_id: "agent-01"
    })

    Policy engine

    Rules are live before execution.

    deny-dotenv-read
    active verdictDENY

    Self-hosted deployment models

    Keep the control plane inside the boundary that makes sense for your team.

    01Docker Compose
    02Helm
    03Bare Node
    Verifiable, not assumed

    Enterprise security
    architecture.

    Built on engineering mechanisms you can inspect instead of unverified marketing claims.

    ✓

    AES-256-GCM envelope encryption

    CIRVIX_MASTER_KEY is customer managed. No escrowed master key path.

    ✓

    Tamper-evident audit chain

    Cryptographically linked SHA-256 logs preserve the integrity of each execution.

    ✓

    Structural tenant isolation

    org_id row-scoping is enforced in routing rather than added as an application convention.

    ✓

    Zero unsanctioned retention

    Decisions enter the audit chain; payload data is discarded when it is not approved for retention.

    ✓

    OIDC / SCIM support

    Native integration points for enterprise identity providers and managed access.

    ✓

    Automated evidence generation

    Export a coherent audit trail for a review without assembling raw logs by hand.

    Cirvix enforces strict structural security mechanisms. Formal SOC2 and ISO certifications are currently in progress; we publish no unverified SLA claims. Cirvix is an independent, founder-led company (a sole proprietorship — see the terms) rather than an established enterprise vendor.

    Start where you are

    Six tiers.
    One control plane.

    MonthlyAnnual2 months free

    Compare every feature, tier by tier

    Enforcement is identical across tiers. What changes is coordination, identity, retention and deployment.

    See full pricing →
    Early access

    Free is free.
    The waitlist is for the rest.

    You do not need this list to start. npx @cirvix_ai/agent-control scan works now, needs no account, and sends nothing anywhere. The list is for early access to the paid tiers and the control plane, and for shaping what gets built next.

    What Free actually gives you

    • 1,000decisions per day. A refused call is not counted.
    • 1agent, 1 seat.
    • Localaudit chain, kept for the life of the deployment.
    • Ephemeralsecret handles — they do not survive a restart.
    • $0forever. No card, no expiry, no phone-home.

    Over the daily limit, the call is denied rather than passed through unchecked. A security control that stops enforcing when a counter runs out is not a degraded product, it is an absent one.

    Which do you run?

    One email when there is something to open. No sequence, no sharing, and an unsubscribe that works. Privacy.

    Recorded.

    You will hear from us when there is access to give, and not before. In the meantime the Free tier is the whole enforcement engine — npx @cirvix_ai/agent-control scan.

    Documentation

    Questions, answered.

    The operational details matter. Here is a clear view of how Cirvix behaves under real constraints.

    System status

    Envelope encryption uses AES-256-GCM. CIRVIX_MASTER_KEY remains customer managed and is never held in escrow by the service.

    Cirvix can be deployed through Docker Compose, Helm, or directly on a Bare Node environment with the control plane inside your chosen network boundary.

    Audit evidence is exported as structured JSON with linked execution records and SHA-256 hash metadata for each recorded decision.

    Only approved decision evidence is committed to the audit chain. Unsanctioned payload data is discarded rather than stored for later use.

    Govern what ships

    Bring every agent
    under control.

    Set durable policy, preserve a verifiable record, and give teams a safer way to put intelligent systems to work.

    Launch Control Plane →
    Copied to clipboard