Skip to content
Design-partner program open3 seats, free through pilot.Apply →
Open source · Apache-2.0 · Runs in your VPC

Agents don't have permissions.They have yours.

Nostrodex scopes, contains and approves every tool call your AI agents make — then signs the receipt your enterprise buyer's auditor is asking for.

Apply as a design partnerSee how it works
  • Your data never leaves your VPC
  • Signed with your keys
  • Verifiable without trusting us
NostroDEX operator console, Activity view
Evidence recordndx_evt_9f31c…
Agent
billing-agent · v4
Tenant
acme-health · t_8Q2R
Tool
postgres.query
Action
invoice.refund
Decision
ALLOWrule pay-002
Policy commit
9f2c41a · policies/billing.yaml
Approver
r.mehta · Slack · 14s
Signature
ed25519:3f9a7c…c1d0

One production deployment. Three design-partner seats open.

Your agents have more access than your interns.

Every B2B SaaS company is shipping agents. Then the buyer's security questionnaire arrives: "How do you scope, monitor and revoke your AI agents' access to our data — and can you prove what they did?"

Can't scope

Scoped tokens

Agents inherit god-mode keys from whoever spawned them. Nostrodex mints a short-lived token per call, bound to one agent, one tenant, one tool, one action.

Can't contain

Tenant walls and a kill switch

No boundary at the tool-call layer today. Nostrodex denies cross-tenant calls by default and revokes a fleet in under ten seconds, even when our cloud is offline.

Can't prove

Signed evidence

Logs show what happened, not who allowed it. Every decision is signed with your key, chained, and tied to the exact policy commit in force.

The pain isn't hypothetical risk. It's a seven-figure contract stuck in security review, today.

Apply as a design partnerFree through pilot, no card.
policies/billing.yaml
# Deny by default. Every allow cites a rule id.
rules:
  - id: pay-001
    tool: postgres.query
    action: invoice.read
    effect: ALLOW
    action_class: low
  - id: pay-002
    tool: postgres.query
    action: invoice.refund
    effect: ALLOW
    action_class: high
    require_approval: true
    max_amount_minor: 500000

How it works

  1. 01

    Point agents at the gateway.

    One container in your VPC. No agent code changes.

  2. 02

    Write policy in git.

    YAML rules per agent, tenant and tool. Every decision cites the commit.

  3. 03

    Export the receipt.

    Signed evidence pack per customer, per period. Auditor verifies without trusting us.

First signed record in under 30 minutes.

Added per tool call
< 10 ms
Payloads ever stored
0
Retention, signed
7–11 yr
Of decisions kept working when our cloud is down
100%
“We built Nostrodex because our own agents touch health records and invoices every day, and we had no way to prove to a hospital's security team what they were allowed to do. We run it in production first. Design partners get software already hardened by a real regulated workload.”
A team of dentists and engineers

Enforced in your VPC. Evidenced in ours.

  • The gateway decides locally from cached policy; no round-trip to us per call.
  • Only signed metadata ships, asynchronously. Arguments and responses are hashed, never stored.
  • Self-hosted option for teams that need everything inside the perimeter.

Architecturally unable to take your agents down.

  • Policy cached with a 24-hour TTL and a 7-day hard stop.
  • Records buffer on your disk and sync later; gaps are signed, never silent.
  • High-risk actions fail closed; read-only calls continue with a flag. You choose per action class.

“Trust us” is not an audit trail.

  • Records are canonical JSON, SHA-256 chained, Ed25519 signed with a key that never leaves you.
  • Daily Merkle roots countersigned and published to Sigstore Rekor.
  • ndx verify is open source. An auditor needs the pack and nothing else.

Works with the agents and tools you already run

Gateway-agnostic by design — rides on whichever MCP gateway wins.

  • Model Context Protocol(2026-07-28 spec)
  • LangGraph
  • Google ADK
  • OpenAI Agents SDK
  • Postgres
  • REST / OpenAPI
  • Slack
  • Microsoft Teams
  • OpenTelemetry
  • Langfuse
  • GitHub(policy repos)
  • Sigstore

Annual saves two months.

Open source

Free forever

  • Gateway and SDK, single project
  • Community policy templates
  • 7-day local audit log
  • Apache-2.0
View on GitHub

Team

from $1,000/mo

Billed monthly

  • Multi-tenant boundaries
  • Approval gates and kill switch
  • 1-year signed retention
  • Slack and Teams approvals
Apply as a design partner

Compliance

from $3,000/mo

Billed monthly

  • Everything in Team
  • Evidence packs: HIPAA, Part 11, DPDP, PDPL
  • Questionnaire auto-answers
  • Auditor exports
  • SSO and SCIM
  • 7-year retention
Talk to us

Priced on agents and tenants governed, not seats. Design partners: free through pilot, then 50% off year one.

Payloads never leave your VPC · SOC 2 in progress · DPA and BAA available

Questions the security team asks

Does customer data pass through Nostrodex?
No. The gateway runs in your VPC and forwards calls to your own tools. We receive signed metadata — IDs, hashes, decisions, policy text. Arguments and responses are hashed and never stored anywhere.
What happens if Nostrodex is down?
Your agents keep running. Decisions come from locally cached policy, records buffer on your disk and sync later, and the kill switch is a local CLI. We are never in the synchronous path.
How much latency does it add?
Two to ten milliseconds per tool call, in-network, on a call that typically waits one to three seconds for a model.
Why should an auditor trust your evidence?
They don't have to. Records are signed with your key, chained, and anchored to a public transparency log. The verifier is open source and runs offline.
Is this an LLM gateway or a prompt firewall?
No. We govern tool calls, not model input or output. We bound what an agent can do; we don't detect prompt injection. Use us alongside a prompt firewall, not instead of one.
Which agent frameworks work?
Anything that calls tools over MCP or HTTP: LangGraph, Google ADK, OpenAI Agents SDK, raw MCP clients. No agent code changes for the proxy mode.
Can we self-host everything?
The gateway is always self-hosted. A self-hosted ledger is on the roadmap for teams that need the evidence store inside the perimeter too.
What does the design-partner program include?
Free through a pilot of up to six months, weekly working sessions, and we ship what blocks you. You give us a named engineer, one real security questionnaire, and a reference at go-live.

Prove every agent action.

Three seats. Free through pilot. Your data stays home.

Read the docs / view on GitHub

Apply as a design partner