Transparent inline security layer — intercept, scan, and enforce policy on every LLM call, MCP tool call, A2A interaction, and RAG query. No agent code changes.
Autonomous agents with broad capabilities create threats traditional tools cannot address.
All four layers must pass. A block at any layer stops the request immediately.
NFKC Unicode normalization, zero-width character strip, confusable substitution (Cyrillic/Greek → ASCII), HTML entity decode, recursive Base64 sub-scanning. Catches known attack variants at near-zero latency.
LLM-powered second opinion for ambiguous Layer 1 findings. Reduces false positives on legitimate content (security docs, research) and catches novel evasion. Configurable LLM endpoint, purely additive.
Per-tool, per-agent allow/deny/escalate rules. Constitution-compiled rules from plain-English policy. Deny-by-default toggle for strict allowlist mode.
Always blocks: SSH keys, AWS creds, .env files, /etc/passwd, cloud metadata (169.254.169.254, GCP/Azure IMDS), audit log deletion. No config, rule, or operator can disable this layer.
Transparent proxies wrap each protocol's unique attack surface. Zero agent code changes.
LLM-powered analysis for ambiguous findings. Reduces false positives.
Per-tool allow/deny rules.
Human review for findings.
Cross-message analysis.
Full conversation analysis.
Real-time token scanning.
Strips PII/secrets.
Pre-flight validation.
Simulate attacks & validate defenses before deployment.
Isolated testing env.
Custom detection rules.
Chain analysis.
Content boundaries.
Terminate rogue agents.
Behavior classification.
Strict allowlist mode.
Never false block.
Any OpenAI-compatible API.
4 complementary layers.
Unicode normalization.
Built-in red team capabilities to proactively find weaknesses in your AI agents before adversaries do.
Generates prompt injection payloads tailored to your agent's system prompt and tool set.
Chains attacks across multiple conversation turns to test cross-message detection.
Probes each MCP tool with malicious argument combinations and dangerous chains.
Applies Unicode homoglyphs, zero-width insertions, and obfuscation techniques.
Every attack maps to MITRE ATLAS techniques with coverage matrix.
Identifies gaps between policy config and attack surface exposed.
Safe execution environment — no real tools or data accessed.
Save scenarios as test suites and verify defenses post-changes.
Automatically validates custom NOVA rules against payloads.
Run against production-configured agents with zero risk.
Self-hosted. No code changes. No data leaves your network.