…
Loading the engine…
- Agent
- Action
- Sent as
- Decided in
- Decision
- Previous
- This record
- Signature
Beyond filtersChecks every step after the prompt, through to the receipt →
See whatyour agents do.Stop what they shouldn't.
For teams whose developers run coding agents with MCP tools. Route an agent's calls through PyxGrant and each one, from file reads and shell commands to prompts, pushes, and payments, is checked against identity, workspace, data, and budget. PyxGrant allows, redacts, holds, or blocks it before it lands, and signs the decision.
- Self-hosted
- Fails closed
- Receipts you verify with your key
In plain terms
- Data stays where it belongs.Agents can't send customer records, secrets, or source code to places they shouldn't go.
- Spend stops before the bill.A runaway agent hits its budget and stops, instead of showing up on next month's invoice.
- Developers keep moving.Ordinary work goes straight through. Only the risky step is held or refused.
- Anyone can check the record.Every decision comes with a signed receipt your auditor or board can verify without trusting us.
Try it
Make an agent do something. Get the signed verdict.
These are PyxGrant's real baseline rules, running in this page against a fictional demo organization. Pick what the agent tries. The decision is signed with a key your browser just made, and nothing is sent to us.
What the agent tries
Edit the request
Some checks need the real machine, such as resolving symlinks on disk or reading an independent observer's signature. They can't run in a browser, so here they fail closed, the same as the product does when it can't confirm something.
Where to start
Start with coding agents and their MCP tools.
Your developers already run Cursor, Claude Code, and CI agents with auto-run on and MCP servers they installed themselves. That is where agents touch source, secrets, and production first, so it is the first deployment we recommend.
See the pilot plan →- Find them.The collector reads the config files and process names coding agents leave on laptops and CI runners. MCP servers it finds stay off until someone approves them.
- Wrap the tools.The MCP guard sits in front of each server. A tool whose description changed since approval is refused, and a result that matches a known injection pattern is withheld from the model.
- Check the risky steps.Shell and file actions routed through the runtime checkpoint are held to the workspace. Secret paths are refused even in auto-run mode, and writes resolve symlinks first.
- Cap the spend.One run budget is shared by every child process that carries the same run id. A loop is stopped on its third identical call.
- Keep the record.Each decision is signed and chained, and it exports to your SIEM on one decision id.
When that works, the same checkpoint extends to
AI apps and agents
AI spend
Healthcare data
Payments
Industrial controls
Where PyxGrant goes further
Filtering the prompt is step one. PyxGrant checks every step after it.
An agent's action has six points where it can go wrong. A prompt and response filter watches the first two. PyxGrant makes a signed decision at all six, including the ones after the model has answered.
PyxGrant · every step, through to the receipt
Prompt and response filtering
- 01Prompt
Secrets, card numbers, and PHI are refused or redacted before the model sees them.
R-SECRET-LLM · R-REDACT - 02Model call
The model is pinned, regulated data goes only to models approved for it, and the cost is forecast in the same verdict.
R-PHI-BAA · R-WALLET - 03Tool call
The tool must match its pinned digest. Undeclared or instruction-shaped arguments are refused.
R-DRIFT · R-UNDECLARED - 04Tool result
The result is scanned before it re-enters the model. An injection hidden in a page or a file stops here.
R-RESPONSE - 05Side effect
Writes resolve symlinks, clicks recheck the landed URL, and money needs a grant that an independent observer reads back.
R-SYMLINK · R-LANDED · R-READBACK - 06Receipt
Each decision is signed and chained to the one before it. You verify it with a key you hold.
Ed25519 · hash chain
Coverage today
What it enforces today, and what it doesn't.
PyxGrant decides what reaches it. This is exactly what reaches it in the current build.
| Surface | How it reaches PyxGrant | Status |
|---|---|---|
| MCP tool calls | The MCP guard wraps each server | Enforced Denied calls are never forwarded. If PyxGrant is down, the guard stops forwarding. |
| Shell and file actions from coding agents | Runtime checkpoint: a CLI and local proxy on laptops and CI | Enforced if routed Built-in agent tools that bypass both the checkpoint and MCP are not seen. |
| Your own agents and their model calls | Decision API | Your code asks Enforced when your code asks first and honors the answer. There is no drop-in model proxy yet. |
| Finding agents | Collector on laptops and CI runners | Observed Known config files and process names only. An agent that leaves neither is missed. |
| Meeting bots, SaaS agents, phones, plant controllers | Reference connector endpoints | Your code asks The endpoints exist. No vendor-built connector ships yet. |
| Every file and syscall on the host | None | Not covered No kernel probe. Your EDR keeps this job. |
| Running through an outage | One host | Not built It fails closed. High availability is not built yet. |
The console
One place to watch your agents, live.
Click through it. Activity, agents, files, downloads, data protection, and approvals, all from signed decisions.
Northstar HealthDemo org
Search agents, files, destinations…
Live
JO
Activity
Each routed action, decided before it runs
0 allowed
0 redacted
0 held
0 blocked
Agents
Found on laptops, CI, clusters, and the network. No developer opt-in.
AgentHostOwnerScopeStatus
Ccursor-samCursoreng-mbp-114Sam Nguyen/work/northstarEnforced YOLO on
Cclaude-platformClaude Codeeng-mbp-221Sam Nguyen/work/northstarEnforced
Cclaims-botCustom agentclaims-pod-3Avery ChenPHI · purpose paymentEnforced
Bbilling-loopCustom agentbilling-podRiley ShawWalletWallet drained
Rrt-canaryRefund agentbilling-podJordan OkonkwoRefunds ≤ $500Awaiting approver
Oollama-shadowOllama :11434basement-gpuUnowned—Unenrolled · refused
Files & workspace
cursor-sam · the grant is the workspace, resolved on disk, not the path the agent typed
/work/northstarWorkspace grant
src/
claims.tsRead
billing.tsRead
notes/
export.csvWrite · grant needed
.envSecret path
.mcp.jsonConfig rewrite
.claude/hooks.jsonConfig rewrite
vendor/link → /etcSymlink escape
Outside the grant
~/.ssh/id_rsaSecret path
../../etc/hostsTraversal
Tree hashed on the laptopThe working tree digest must match the pin. A branch name that looks like a commit is not accepted.
R-TREESymlinks resolvedA path inside the workspace that resolves outside it is refused.
R-SYMLINKYOLO doesn't widen itAuto-run mode is visible on the console. Secret paths stay denied.
R-SECRET-PATHDownloads
Files an agent fetches through a checkpoint, checked before they reach disk or context
FileSourceAgentDecision
TGZzod-3.23.8.tgzregistry.npmjs.orgcursor-samAllowedgrant for this hash
DOCMinvoice-macro.docmmail attachmentclaims-botBlockedmacro found · R-MALWARE
PPTXq3-claims.pptxsharepointclaims-botQuarantinedinjection in speaker notes · R-HIDDEN
ZIPclaims-dump.zips3://northstar-claimscursor-samBlockedno grant · R-TRANSFER
Data protection
Checked on the way into the model, into tools, and out to the network
Prompt → claude-sonnet-baaRedacted
Follow up with [email protected][email] about claim 18.
SQL → claims warehouseColumn removed
SELECT name, ssn FROM members
Post → Slack #claimsBlocked
Session read MRN 884211 earlier. PHI cannot flow to Slack.
claims-bot · R-SLACKPrompt → gpt-publicBlocked
Patient data to a model without a BAA.
claims-bot · R-PHI-BAAPrompt → any modelBlocked
aws_key = AKIA••••••••••••
cursor-sam · R-SECRET-LLMTool call → stripe.notesBlocked
Card 4111 •••• •••• 1111 passes the Luhn check.
rt-canary · R-PANDetectsCard numbersSSNsMRN, NPI, DOBCloud and API keysPrivate keysEmailsSource codeCanary tokens
Approvals
A grant covers one argument hash, and an owner can't approve their own agent
stripe.refund · $800rt-canary · owner Jordan Okonkwo · approver must be someone else
Approve this exact callDeny
Write notes/export.csvcursor-sam · writes need a grant for this argument hash
Grant 15 minutesDeny
Product preview. Northstar Health is a fictional organization the appliance seeds on first boot for demos; it is not a customer.
Deployment
Runs on your host. Refuses when in doubt.
The four questions every security review asks first, answered before the demo.
How does it deploy?
One Node service and one SQLite file on hardware you control. Agents reach it three ways, and you can mix them.
- MCP guard. Wrap any MCP server; denied calls are never forwarded.
- Runtime checkpoint. A CLI and local proxy beside the agent on laptops and in CI.
- Decide API. Your own agents ask before they act.
What does it do to speed?
Policy is evaluated in-process from readable rules. No model is called to make a decision, and the model is never the enforcement point.
- Every receipt records its own decision time, so you measure latency on your traffic, not on our slide.
- Cost is forecast inside the same verdict, not in a second pass.
What if PyxGrant is down?
The call is refused, not waved through. The CLI exits with code 3 and the MCP guard stops forwarding.
- That is the safe default, and it means our uptime becomes your agents' uptime.
- Today it runs on one host with a second chain copy on the same disk. High availability is not built yet.
What does it work with?
It sits in front of agent actions and leaves the rest of your stack in place.
- Identity. Any OIDC IdP for the people behind each agent.
- SIEM, finance, GRC. Every export joins on one decision id.
- EDR. Keeps the host. PyxGrant decides the agent's actions and does not replace it.
Evidence
Proof you can rerun, not a logo wall.
We don't have public customer results yet. This is what you can check today, and the command that reproduces it.
public incident classes refused. Twelve are caught from the request or by a PyxGrant component. Three need the caller to supply the signal.
median engine time. With signing and the database write, the median is 3.3 ms. Measured in-process on a laptop; no network hop.
scenarios in the live demo get the same verdict in your browser as on the server. A test fails the build if any differ.
Reproduce it: npm run evidence · Full results and method →
Boundary
What it does, and what we don't claim.
Enforced today
- Fail closed on every error path
- Tool results, writes, downloads, and payments checked before they land, when they pass a checkpoint
- Unenrolled agents refused on the machine
- Split-turn injection caught when fragments match known patterns
- Honeypot tools and canary tokens
Not claimed
- Prompt injection is not solved. A successful injection still has to pass a checkpoint that does not trust the model.
- DLP is pattern-based. It catches known formats, not every way data can be paraphrased.
- Signing is software Ed25519, not a FIPS 140-3 validated module.
- FedRAMP export is a readiness list. There is no authorization to operate.
- No kernel probe. File access is seen when it goes through an agent's tools, not every syscall on the host.
Start with one team's coding agents.
A pilot covers one team, its laptops and CI runners, and the MCP servers they use. The plan lists the setup, what we measure, and the limits up front.