Govern what your AI agents are allowed to do.
The API capability governance layer. Declare your API's capabilities in YAML. Enforce risk tiers, human approval, and a NIST AU-3 audit trail for every agent action.
The kernel is MIT and self-hostable. The trial is the hosted Team tier, and no card is taken on the signup page.
Why agent governance is broken today
MCP servers expose everything
A vendor MCP server hands your agent every endpoint in the API. Hundreds of tools, each one a token cost and an entry in the attack surface, with no way to say "these three, not those thirty".
Agents act anonymously
Most platforms treat an agent as an anonymous caller. No role, no grants, no idea which agent did what. A tool call is indistinguishable from a stranger holding a service token.
No audit trail for AI decisions
When an agent acts, you cannot answer which agent did this, on whose authority, or whether it was allowed. For anything a regulator touches, that is the whole question.
Declared capabilities. Risk tiers. Human approval.
| Capability | Risk | Agent decision |
|---|---|---|
| get_ticket | low | allowedruns immediately |
| set_priority | medium | approval requiredqueued for a human |
| delete_ticket | high | agent forbiddenblocked for agents |
| rotate_api_key | low | not exposedagent_forbidden: true |
Every call is recorded with actor, capability and outcome. NIST AU-3.
Every capability an agent can call is declared in YAML. Every call is classified by risk. Every action is recorded.
How it works
- 1
Declare API capabilities
One YAML file per integration. Each capability is a name, a method, a path, and a risk tier.
- 2
The kernel enforces
Every call is classified by risk. Low runs, medium queues for a human, high is refused.
- 3
Every call is recorded
Actor, capability, target, outcome and latency, in a NIST AU-3 shaped audit row.
The artifact you write
name: salesforce
capabilities:
- name: get_opportunity
method: GET
path: /sobjects/Opportunity/{id}
risk: low
content_risk: mediumBuilt for platform teams running AI agents in production
- Engineering leaders deploying agent infrastructure
- Platform teams who need an audit trail for compliance
- Security teams concerned about prompt injection
- Companies building internal AI tools that touch customer data
The kernel is MIT and never gated. See the test that proves it, or read the concept.
Four tiers, one kernel
Governance is never gated. The paid tiers add operations at scale.
Community
Free forever
Self-hosted, single tenant
The complete governance kernel, on your own hardware, with no licence key.
- MIT kernel
- Risk gate
- Approval queue
- Audit trail
- Sanitiser
- MCP surface
- Self-hosted
- Single-tenant
Team
Popular$99
per month, 10 seats
For one platform team putting a hosted instance in front of real agents.
Everything in Community, plus
- Multi-tenant hosting
- Hosted registry
- SSO via OIDC
- 10 seats
- Email support
Business
$499
per month, 200 seats
For a company where several teams share one governed deployment.
Everything in Team, plus
- Cross-tenant audit aggregation
- Token analytics
- 200 seats
- 24-hour support
Enterprise
$2,000
per month, unlimited seats
For an estate that needs seat management, longer retention and a named contact.
Everything in Business, plus
- Seat management
- Priority support
- Extended audit retention
- Custom adapters
- Unlimited seats
- Dedicated support
The governance layer is free forever. The paid tiers add operations at scale. Compare the tiers in detail.
Get early access to TCPcore
No spam. No credit card. Just early access.
The kernel is on GitHub under MIT. Join the list if you would rather wait for the next release than self-host today.