No single layer is ever enough.
That is the oldest rule in security, and the reason a serious system is built in layers: a breach only happens when the holes line up across every one of them (the Swiss-cheese model). So we do not ask you to trust any single control. Here are our layers, mapped to the functions every security program is measured by, the NIST Cybersecurity Framework and the CIA triad, and each one states its own limit. Reading the limits is the point.
The layers (NIST CSF)
Identify
Discovery + BorderBuiltInventory the MCP servers you actually have configured, and flag config-level risk the server scan cannot see: unpinned loaders (the rug-pull surface), hardcoded secrets, internal endpoints.
Sees what you submit; it does not crawl your whole environment for agents you never told it about.
Protect
ExecutiveStrongA deterministic allow / require-approval / deny gate with no model in the blocking path, so a jailbroken agent cannot argue past it. Per-agent policy and budgets, and an inline gateway so an agent is governed by pointing its config at us, not by wrapping its code.
Cooperative: it governs calls that route through us. An adversary with code execution on the same host can skip an in-process SDK, which is why the gateway and the record exist as further layers.
Detect
Intelligence + PoliceBuiltDeterministic detectors for tool poisoning, malicious arguments, artifacts, and output injection, plus a standing patrol that scores each actor for wide, exfiltration-shaped coverage between its calls.
Pattern-based detection is bypassable by design; the patrol is advisory and reads only instrumented actors. A novel attack can pass a signature.
Respond
CorrectionsBuiltA human-pulled kill switch and an automatic circuit breaker, revocation, and a signed incident bundle. Findings export to your SOC as OCSF, so we are a slice in the stack you already run.
The kill switch stops governed calls, not an adversary who left the governed path. Actor-scope action is never autonomous, on purpose.
Recover
JudiciaryBuiltContest a decision and have a reversal recorded as visibly as the accusation, on the same tamper-evident ledger, and re-pin the version. The offline retro-hunt reconstructs a campaign after the fact.
Recovery is of the record and the governed subject; recovering a system already breached out of band is not ours to do.
Govern
Legislature + ConstitutionStrongA published, versioned, non-retroactive corpus you can read before you are judged, and an institution bound by a record no one, including us, can rewrite.
Laws change by our release today; an independent legislative process is still to come.
The CIA triad
Enforcement runs in your own process; no tool description, output, or session state leaves your infrastructure. Baselines are per-customer, never pooled. A deny redacts its own reasoning from the agent.
Ed25519 receipts, a hash-chained ledger, RFC 6962/9162 Merkle inclusion and consistency proofs, and a daily external timestamp. Anyone verifies it offline with our published package. This is the leg most tools cannot match.
The kill switch fails safe, not open, when its state cannot be read; an unreadable stop routes to a human rather than allowing blind. Rate limiting and a customer-chosen fail mode default to tightening, never opening, under an outage.