Govern every agent. Any framework.
Your agents already exist. EvalGuard puts a firewall on every tool call, grants autonomy one level at a time, and keeps the evidence — evals, red-team, trajectories, cost. Bring an agent from any framework over MCP or OpenTelemetry, or compose one here to prove it first.
3.67ms p95
Bring your own models — govern agents on every major provider
01 · Compose & prove
Nine node types. One canvas.
Sketch an agent on the canvas and put it through evals, simulated users, and a red-team before it meets a real one. Every run is versioned and executed by a durable worker, so the thing you proved is the thing you ship.
- 01
Compose, don't prompt-glue
Agent, tool, router, memory, human-review, LLM-call, scorer, transformer, and gate nodes wired on a canvas, versioned and replayable. Not a pile of prompt strings.
- 02
Prove before you trust
Every agent carries its own evals, runtime guardrails, red-team report, and cost ledger. Autonomy is earned level-by-level on measured behavior, not vibes.
- 03
Ship behind the firewall
Publish from EvalGuard as a governed embed or API, or point an agent you already run at the MCP gateway — either way every call passes the firewall and the policy engine.
The autonomy ladder
Four levels of autonomy, granted one at a time
Every agent starts supervised and climbs only as its evals and red-team results earn trust. The leash is policy, and the policy is enforced at runtime — pick a level to see what the firewall permits.
# L2 · Assist — Acts on low-risk steps; high-risk tool calls still need approval.
- compose.draft_reply(ticket #4821)auto
- crm.lookup(customer_record)auto
- billing.issue_refund($49)needs approval
- deploy.push(prompt-v2 → prod)blocked
- transfer.wire($25,000) — exceeds envelopeblocked
illustrative policy — configure per agent
One platform, every primitive
Voice, memory, tools, MCP — in the box
Orchestration, simulation, and observability ship alongside them — so you compose agents instead of stitching five vendors together.
Voice-agent evals
Send us a turn's audio and we score it — word-level transcription with timings, audio-deepfake detection, and response-latency eval, on the same pipeline as your text agents.
Semantic agent memory
Long-term recall across sessions with auto-dedup and LLM fact-extraction, scoped per project.
MCP, run guarded
MCP servers behind a pre-deploy audit + live traffic inspection, with opt-in cryptographic agent identity (CIMD).
Workflow orchestration
Versioned graphs of agents, tools, LLM calls, scorers and gates — every version restorable, executed by a durable worker.
Simulate before you ship
Test against synthetic personas and a closed-loop adaptive attacker before a single real user.
Trajectory observability
Every action and tool call traced — loop detection, per-step latency, and a cross-service agent call graph built from your OpenTelemetry spans.
02 · Govern
Six controls travel with every agent
Continuous eval
Score every agent against your datasets + LLM-judges on each change. Regressions attributed to the commit that caused them.
Runtime guardrails
The same firewall that guards your models guards your agents — prompt-injection, PII, secrets, tool-call policy, on the hot path.
Agent red-team
Adversarially probe each agent — goal hijack, tool misuse, multi-step tool chains. Each attack prompt drives the agent's own tool loop for several steps, and every attempted tool call is graded by the firewall and the danger oracle.
Intent + identity policy
Route and gate live agent traffic by classified prompt intent and data-sensitivity. Department and workforce-type rules can be authored and previewed against the policy simulator today.
Cost + trust ledger
Per-session token and cost rollups per agent, and an autonomy proposal that turns an eval pass-rate into a promote/demote recommendation — you or your CI apply the change.
Typed tool builder
Define REST tools with typed parameters, call-time argument validation, SSRF-guarded fetch that re-checks every redirect hop, and AAD-bound encrypted secrets. Code and MCP tool kinds are definable now and execute in a later release.
03 · Deploy
Deploy an agent without dropping your guard
Publish from a template as a public embed widget or API. Every inbound request is still firewalled, policy-checked, and eval-sampled — the same guarantees you had in development follow the agent into production.
- Firewall-guarded public embed widget
- Per-agent policy + intent routing at the edge
- Fail-closed org and per-deployment spend caps on every request
- Every public run enqueued as a traced, replayable workflow run
request → quota.check() + spend.cap() // fail-closed → firewall.scan(message) → intent.classify() + intent.gate() → enqueue(workflow_run) // durable worker
Ship agents you can defend
Build on the canvas, prove with evals and red-team, deploy behind the firewall — all in one governance-first platform.