Your rules.
Every agent.
Enforced.
Define your engineering compliance policies once — then enforce them across every AI coding agent your team runs. Self-hosted and open source, so your code never leaves your network — and your security team can read every line of ours.
Your agents write fast. None of them know your rules.
Four different AI agents on one team. Each writes code its own way — none of them know your security policy, your approved-library list, or your architecture standards.
So the same violations surface every review cycle, and the same mistakes ship in every onboarding. Across the industry, governance — not the AI — is what stalls the rollout to production.
- Rule
- Never hardcode API keys or credentials.
- Set by
- CTO / Security
- Fix
- Use
process.env.API_KEYinstead.
One policy definition. Enforced everywhere your team writes code.
Define once
Write policies in plain English, add regex evaluators, set severity, and bind them to roles. The CTO's rules cascade down to every junior automatically.
Connect any agent
One API key wires up Claude Code, Cursor, GitHub Copilot, Windsurf, and any MCP-compatible agent. No config on developer machines.
Enforce, fail-closed
Policies inject into the agent's context; violations are blocked before code is written and the agent is told how to fix it. A git pre-commit + CI backstop catches anything that slips through. Every check is logged.
Built to own, not to rent.
Your code never leaves your network
Self-hosted on your own infrastructure — Docker, one command. Nothing phones home. Air-gap friendly, and a straight answer for data-residency reviews. The platform itself is open source (MIT) — audit every line before it touches your network.
One key, every agent
Tool-agnostic enforcement over MCP. You're never locked to a single vendor's assistant — add or swap agents and the same policies still apply.
Fail-closed by default
Non-compliant code is blocked before it's written, not flagged after review. The agent gets the reason and self-corrects on the spot.
Catches the output, not just the prompt
A git pre-commit hook plus a CI backstop inspect what the agent actually produced — a second line of defense most tools skip entirely.
Policies cascade by role
Model your real org — CTO, Lead, Senior, Junior. Rules flow downward automatically, so juniors inherit every security policy without anyone wiring it up.
Roll out without breaking a sprint
New policies start in shadow mode — evaluated on every check and logged, but never blocking. Measure the noise in the audit trail, tune the rule, then flip it to enforced. Nobody's Tuesday gets ruined by a fresh policy.
A managed outcome, not a DIY project
Deployed, tuned to your compliance regime, and supported. You get enforcement working — not a repo to babysit.
Evidence your auditors will actually accept.
Every check — blocked or allowed — is written to an append-only audit trail: who triggered it, which policy fired, and what they were trying to do. Developer-bound API keys attribute every check, violation, and bypass to a person — not to “some agent”. Export to CSV for evidence.
Plus SSO, org-level RBAC, and webhooks to pipe violations into the tools your security team already watches.
// live audit stream — exportable as CSV for your next review
Set up in minutes.
Model your role hierarchy
Define CTO → Lead → Senior → Junior. Policies cascade downward automatically.
role: senior · inherits: lead, cto
Write your policies — or import a pack
Plain-English rules with regex evaluators, block or warn — or start from a HIPAA, PCI DSS, or DPDP starter pack. New policies can run in shadow mode first.
import: pci-dss · mode: shadow
Connect your agents
One JSON snippet in the agent config. Every developer is instantly compliant.
COMPLY_API_KEY="oai_…"
Watch the audit log
Every blocked action shows who tried what, when, and why it was stopped.
GET /audit?severity=block
Bring your rules to your agents.
We're onboarding engineering teams now — we'll set everything up on your infrastructure and tune the policies to your standards.