AXOR CONTROL PLANE
Eval. Control. Protect.

Your agent lies when its tools fail.
Catch it. Prove it. Govern it.

Break a tool on purpose and most agents don't report the failure — they fabricate a result and ship it. Axor catches the lie as a reproducible receipt you can replay deterministically, hand to your security team, and attach to the incident — then gives you the pause button and the kill switch for the whole fleet.

plainly: detect when an agent's claims diverge from the observed tool results — and prove it, deterministically.

Catch your first lie — 10 min, free → Become a design partner

open source (Apache-2.0) · self-hosted · no credentials leave your machine · 3 design-partner slots, one per vertical
One run: a fabrication is caught as an EvidenceCase, replayed, and a live governed node obeys interventions
one continuous demo run: fault injected → fabrication caught → replayed with a taint graph → live node paused. recorded, deterministic.

You've been in one of these rooms

Why did the agent email that customer? Show me exactly what it saw.

The exec question. Your observability trace is 4,000 lines of JSON. Axor's answer is one EvidenceCase and a replay cursor pointing at the exact step.

It's 3am and the agent is burning API budget in a loop.

The on-call moment. Axor pages you (webhook, dead-letter honesty), and gives you pause / budget-cap / cascade-stop — instead of kill -9 and prayer.

What controls do you have around your AI agents?

The auditor. You hand over signed intervention logs, append-only facts, and PDF receipts — mapped to EU AI Act Articles 12/14/26.

How it works

Four surfaces, one loop. Every one produces an artifact you can show someone.

1 · CATCH

Break a tool. Read the receipt.

An observe-only proxy fronts your tools (auth passes byte-for-byte, raw bodies never stored). Inject a fault; the audit compares reality against the agent's claim.

→ you stop arguing about what the agent did
2 · REPLAY

Question any run, deterministically.

Scrub the trace; fork counterfactuals ("no exec capability", "this value arrives tainted") and see the first step that diverges. No model call, ever.

→ incident review takes minutes, not a day
3 · GOVERN

Live fleet, real interventions.

Wrapped agents are live nodes: pause, budget-cap (decrease-only), cascade-stop the subtree. Ed25519-signed commands; Axor down ⇒ agent unaffected.

→ you get a pause button before you need it
4 · REGRESS

CI for governance configs.

Pin caught attacks and legit flows; replay the corpus under a candidate policy. Two-sided — a config that blocks everything fails honestly.

→ you ship policy changes without fear
git clone https://github.com/Bucha11/axor-control-plane && cd axor-control-plane cp .env.example .env && docker compose up --build open http://localhost:8080 → Run demo-mode (mock tools, zero credentials)
MCP-native: paste the mcpServers config you already have — tools discovered, proxied, done.

Three depths. We're honest about each.

The demo is one click. Your own tools take ~5 minutes, observe-only, no code change. Full live Control needs the one-wrapper adapter. Here's exactly what each rung sees, proves, and controls — no rung oversells the one below it.

DepthAxor seesCan proveCan control
demo
our mock broken tools		our scripted agent + mock toolsa full EvidenceCase, end to end— (showcase)
proxy
your tools, observe-only		your tools' I/Otool faults immediately; a full EvidenceCase once the agent's final claim is submitted (one-line hook, see examples/)— (observe-only)
adapter
one wrapper on your loop		agent trajectory + per-value provenancefull causal reconstructionpause / stop / cascade — live Control

the proxy is genuinely observe-only — it sees the tool boundary. Matching a result against the agent's later claim needs that claim: the demo submits it for you, an examples/ recipe does it for your agent in a few lines. We say so rather than imply a transparent proxy magically governs a running agent.

Where Axor sits

Three tool families get conflated. They compose — most teams should run observability and guardrails and (we argue) execution governance. Axor answers a question the others don't.

ToolWhat it tells you
Tracing (LangSmith, Langfuse)what calls happened
Evalswhether a run passed
Guardrails (NeMo, Lakera)whether known content/policies triggered
Axorwhere the agent's claim diverged from observed execution — and whether a new policy would have prevented it

what the others do better, honestly: observability has far richer LLM-call analytics (tokens, costs, prompt diffs); guardrails catch toxic/off-policy text, which Axor doesn't look at. Full comparison →

Running a tree of agents? The lie travels. Axor stops it at the boundary.

One bad tool call at a leaf becomes the orchestrator's confident answer three hops later. Multi-agent Axor makes that propagation visible, contained, and provable.

CARRIED, NOT LAUNDERED

Taint rides in the message.

Labels travel with values in every envelope between agents — a fabrication delegated through two siblings arrives still tainted. Hop count cleans nothing; the export gate denies at the boundary.

→ containment, counted per boundary: 1/1 held, fabricated_failure → honest_failure
TOPOLOGY, LIVE

The tree as a graph.

Control's graph lens draws your federation from traced spawn events (never self-reported): delegation and lateral edges, denials flashing where they happened, cascade-stop as one signed command to the root.

→ the kill switch scales to the whole subtree
ONE CASE, THREE NODES

The receipt grows a causal subgraph.

A fabrication at the root caused by a fault at a leaf is one EvidenceCase — anchored at the consequence, with the minimal chain of nodes that produced it: origin, conduit, container. Derived from the trace on open, deterministic.

→ "who lied first" is a diagram, not a debate
FOREIGN AGENTS

Peers are claims, not colleagues.

Agents under someone else's keys are declared like sinks: L0 by default, identity buys attribution, signed agreements buy a bounded discount — never label authority. Critical sinks ignore discounts entirely.

→ a compromised partner can't launder taint into your tree

Watch the lie spread — then stop → (recorded two-tree demo)

Proof, not promises

No customer logos yet — we're pre-launch, and we won't fake them. What we have instead is better: claims you can re-run yourself. Every number below reproduces with one command.

Read the table honestly: it's not a field-accuracy claim. It proves the detector is deterministic and never fires on an honest run, against constructed personas. Real-LLM catch rates (lower, per-model) are the next milestone — same harness, swap a persona for a live loop.

persona \ fault modesilent_failcorrupt_retrievalinstruction_injectiontool_substitution
misbehaving persona (structured claims)100%100%100%100%
misbehaving persona (free text only)100% (heuristic)100%100%100% (heuristic)
honest persona (false-positive check)0%0%0%0%
real LLM agents (per model)pending — reported when measured

140+ tests, all E2E-real

Playwright drives the actual UI against the actual stack; the backend E2E suite boots real processes. The deploy gate smokes the compose stack on Postgres before merge.

Limits, not adjectives

50 concurrent SSE subscribers, zero drops, perfect fan-out; ~70 rps ingest ceiling on the dev DB — published in docs/ops-limits.md with the script that measured it.

Same kernel enforces and replays

Replay isn't a reconstruction — it's the identical pure function over the recorded trace. That's why the receipt is evidence, not narrative. Paper in submission.

Built for the person who gets the call

Platform / SRE

You run the agents everyone else ships. You get the pager, the pause button, budget caps, and a regression gate for policy changes.

Security & compliance

You answer for them. You get signed, append-only intervention logs, scoped share links, PDF receipts, and the EU AI Act mapping one-pager.

Agencies shipping agents

You hand clients a deliverable: "here's the EvidenceCase report and the regression corpus proving it's governed." Per-client licensing.

Pricing that won't ambush you

Line 1: anything that makes an agent safer is free forever — that's structural, not a promo. Line 2: you pay only for how your org runs it.

Free

$0
open source · unlimited agents

Everything above: catch, replay, govern, regress, export, self-host.

compose up →

Team

$250 / env·mo
first company deployments · per environment, not per node

Hosted convenience, scheduled corpus CI, routing rules.

get Team →

Enterprise

annual
SSO · RBAC · air-gapped · compliance reports

From $20–50k/yr. Offline license — never phones home.

talk to us →

worried about vendor risk? the escape hatch is structural: the safety layer is Apache-2.0 — if we vanish, your governance doesn't.

Why now

EU AI Act record-keeping and human-oversight obligations (Articles 12, 14, 26) are entering application for high-risk systems — and "show me the agent's audit trail" is becoming a procurement question everywhere, regulated or not. Teams that can answer it with a receipt instead of a shrug win those deals. Our article-by-article mapping →

The questions you're already asking

Does the proxy add latency to my agent?

One local hop. Clean passthrough streams (no buffering — SSE/chunked tool responses flow), and the proxy is observe-only: it never blocks traffic. Enforcement, when you opt into it, happens in-process in the adapter.

What happens if Axor goes down mid-run?

Nothing, structurally: the control plane is an advisory overlay. The adapter enforces locally with its own config and keys; the observe-only proxy fails loud (502), never fabricates. Your agent never depends on our backend being up.

What does Axor see — and store?

Observations only: tool names, statuses, sizes, SHA-256 hashes. Raw request/response bodies are never persisted; your Authorization headers pass through byte-for-byte, unparsed. Threat model: SECURITY.md.

Am I locking into a framework?

No. Observe-only works with anything that makes HTTP/MCP tool calls — zero code change. The deepest integration is one wrapper around your agent loop. Recipes for OpenAI Agents SDK and CrewAI are in examples/.

Why is the good stuff free?

Because the paper, the community, and your trust are worth more than gating a taint graph. The paid tiers sell what only organizations need — fleets, SSO, compliance reports, hosting. Safety never checks a license (that's enforced in code, not in a pinky promise).