Capability is the market.
Accountability is the product.
Follow us on GitHubGuardrail stops dangerous agent actions. Engram gives agents memory. Amparo is the agent that acts under policy. ELLM is the engine underneath.
AI agents are getting dangerous tools — shells, databases, cloud credentials. The industry's answer is another AI: LLM judges that cost money, burn energy, and can be talked out of the right answer. We build the deterministic alternative: the same verdict every time, with a trace a human can audit — protecting people from harm and the planet from waste. And the agent that acts through it is Amparo — open, under policy, bring your own LLM.
But this is not only an AI story. Shell scripts, CI pipelines, and automation have been executing dangerous instructions since long before LLMs existed. AI didn't invent the problem — it multiplied the blast radius. Our tools are built for that wider world: they help AI, and not only AI.
Your data stays on your device. No telemetry. No phoning home. Our servers store only the minimum needed to run your account — never sold, ever. Read the full privacy page →
Our approach
Deterministic over probabilistic. Every check produces the same output every time. No model to inject a prompt into. No hallucinations. No distribution shift. A Rete forward-chaining network replaces the LLM judge — same security boundary, zero probability.
Efficiency as proof. The deterministic check is also the cheap one: a tool call classified in 15µs (p50) on a single core, ~65 KB of memory per check — millions of times less energy than an LLM judge for the same decision.
Ungameable by design. Actions are parsed into ASTs and content-addressed before classification. Obfuscation, encoding tricks, and prompt injection don’t work. Ambiguity defaults to deny.
Products
Guardrail
A firewall for AI agents that act — blocks dangerous tool calls in 15µs, no AI judge. Try it live, no signup.
Engram
Long-term memory for your AI. Encrypted on your machine, never in a cloud. Source-available under the FSL, free to use.
Amparo
An open agent that acts under policy. Bring your own LLM — deny-by-default gates, human-only approval, and a ledger for every consequential act.
ELLM — the reasoning engine underneath Guardrail and Engram. Content-addressed frames, deterministic forward-chaining, auditable inference traces. It's how we can say "provably," not just "probably."
Built for AI. Not only for AI.
Guardrail — any programmatic execution
An agent loop, a CI pipeline, a shell script, a human operator’s terminal. Same policy, same 15µs verdict, same audit trail. Who issues the instruction doesn’t change how safety works.
ELLM — embeddable anywhere
The reasoning engine underneath is embeddable at every scale. Any software that needs provable inference — security tooling, compliance, automation — is a home for it.
Engram — a problem older than AI
A memory vault aimed at AI agents today — but what to keep, what to strengthen, and what to forget is a problem far older than AI.
Amparo — the agent that acts under the rules
Bring your own LLM and give it real tools. Every consequential act passes the gate chain — registry, ceiling, policy, and a human for the dangerous ones — and leaves a ledger entry a human can audit.
Your data stays on your device
Your data stays on your hardware
The guardrail engine is self-hosted on your infrastructure. It never phones home — no license checks, no telemetry. The deterministic check makes no network call at all.
No third-party model in the loop
There’s no LLM judge by default, so your tool calls are never sent to a model provider. If you enable the judge tier, it calls an endpoint you supply. We never see your tool calls.
Memory that never leaves
Engram is an encrypted, local-first memory vault. SQLCipher at rest, keys bound to your hardware, on your machine.
The console keeps the minimum
The hosted console processes only account, member, key metadata, and the event records your engines report. Never sold. Payloads are read only to operate the service, debug issues you report, or comply with law.
An agent that brings its own LLM
Amparo calls the model endpoint you supply — no model in our loop — and records every consequential act in a privacy ledger of counts, never values.
Proof, not promises
Measured by a reproducible benchmark: cargo run --release --bin guardrail_bench (requires licensed source). Full methodology →
From the journal
- August 2026
Drilling our own security, and a console that grew up
Org-scoped API keys, audit-first tier gating, per-org usage metering — and a round of drills that attacked our own infrastructure, including a two-machine pairing test.
- August 2026
Engram 0.1: the memory vault ships
The local-first memory vault is on GitHub Releases — Linux, macOS, Windows, source-available, with a sync relay that never sees your plaintext.
- August 2026
Engram memory, measured: 100% recall, and what it costs
We A/B-benchmarked the Engram vault against wholesale CLAUDE.md injection: 100% recall at both scales, 100% unsolicited tool adoption — and an honest cost crossover around 110–150 memories.
- August 2026
Audit first, enforce second: enforcement modes per organization
Every org now starts in audit mode — real verdicts, zero blocking — and flips to enforce with one admin toggle, gated by plan tier and attributed by API key.
- August 2026
The guardrail, measured: 15µs, 37,700 checks/sec, zero false-ALLOWs
We built a reproducible benchmark and ran it to the wall: 1M mixed commands, six ecosystems beyond Bash, and one honest surprise — parallel is 40% slower than sequential. Here are the real numbers and what we learned.