Move with AI.
Stay in control.

A single-node policy gateway, encrypted sensitive records, wrapped cloud keyring, registered HTTP tools, scoped principals, exact-request reviews, organisation sign-in, audit console and backup helper. Optional endpoint encryption includes a customer-side SDK. An experimental local English classifier includes separate training, validation, promotion and rollback. Optional external model suggestions require a separately configured deployment.

Enterprise teams connecting authorized AI agents to registered HTTPS tools. The product website is public; the console and tool APIs require provisioned identities. Each customer needs an isolated deployment and tested integrations.

Ordinary calls use HTTPS and encrypted storage; the gateway can read their payloads. Optional endpoint-encrypted tools use signed JWE requests and responses, with private keys held by the customer’s agent and tool. In that mode Aegivora sees ciphertext and routing metadata, and cannot inspect content. Both endpoints require integration and key custody; this mode is not yet validated with a customer deployment.

Local rules screen ordinary tool requests and responses for selected credential formats, email addresses, payment-card candidates and common prompt-injection patterns. For end-to-end encrypted calls, these checks run in the customer’s agent and tool SDK, where plaintext exists. The gateway cannot inspect ciphertext or prove that endpoint checks ran. Rules can miss attacks or block legitimate content; a no-match result is not a safety guarantee.

Task and concurrency budgets bound repeated actions. Optional tool-level approval and response schemas add checks. Repeated uncertain outcomes stop a tool until an administrator resets its circuit. A persistent emergency stop blocks execution. Local size and timing statistics freeze after 30 successful calls and flag unusual changes for review; they never grant access or modify code. These statistics are not a trained AI security classifier.

A separate, resource-limited training process updates numerical classifier weights from approved labelled datasets. Fixed synthetic tests, administrator promotion and rollback control releases. The hosted service currently runs the advisory v3 classifier; the v4 candidate below has not been promoted. No paid LLM is configured. The v4 update trains on 512 examples: 368 authored development records and 144 public training records. It retains all 80 visible regression cases, which informed development. On public test splits after candidate selection, it flags 13 of 60 labelled attacks with 1 of 56 false alarms in deepset, and 105 of 112 attack-selected Lakera examples, with two abstentions. Compared with v3, deepset attack recall is unchanged, false alarms fall from four to one, and the Lakera flagged count rises from 64 to 105. These small, biased public sets expose remaining misses and do not establish enterprise accuracy. Runtime scores are advisory only. The model cannot train on live customer traffic, change security rules, deploy application code or grant access.

Only actions routed through the gateway are evaluated. Customers must restrict direct access to tools and must configure appropriate labels, resource scopes, destinations and network controls.

Review the included release checklist: deployment validation, identity integration, backup recovery, adversarial testing, independent security review, incident response, support terms, and customer acceptance. High availability and native MCP transport are not included. Automated customer provisioning and live payment activation remain unverified. Billing integration and private installation setup are included as source.