Products
Amparo — the agent that acts, under policy. Guardrail — the firewall for what agents do. Engram — the vault for what they learn. One deterministic engine underneath.
The agent that acts under policy
An open agent with a gate chain in front of every consequential act: registry, trust ceiling, policy engine — then a human, never a model, for the dangerous ones. Bring your own LLM.
| Status | In beta — install it today, no waitlist |
| What it is | Open agent that acts under policy — bring your own LLM |
| Lineage | ELLM lineage — acts through Guardrail policy and Engram memory |
| The gate chain | Registry → trust ceiling → policy engine → human approval |
| Approvals | Human-only; dangerous calls fail closed in 60 seconds without one |
| Ledger | Append-only record of every consequential act — counts, never values |
| Memory | Engram-native adapter; falls back to built-in store if the daemon is down |
| Policy | Guardrail-native wire engine; audit mode detected and surfaced |
| Privacy | Local-first; model calls go to the endpoint you supply |
| Access | Open — curl -fsSL https://downloads.ellmstack.dev/amparo/install.sh | bash (Linux x86_64 & arm64, macOS, Windows) |
The firewall for what agents do
A deterministic firewall for AI tool use: dangerous actions are blocked before they execute, every check returns a verdict a human can audit.
| Status | Beta — engine is production-ready, console still changing |
| What it is | Deterministic agent firewall — blocks dangerous actions before they execute |
| You define | Dangerous actions, in TOML |
| Verdicts | Allow / Deny / Escalate (escalate = human approval) |
| Latency | 15µs p50 per check |
| Throughput | 37,700 checks/sec on one core |
| Memory | ~65 KB per check |
| Safety record | 0 false-ALLOW across 115 beyond-bash tests |
| LLM judge | Not required — optional second opinion tier on your own endpoint |
| Privacy | Self-hosted on your infra; no phoning home; deterministic tier makes no network calls |
| Free tier | 8,000 checks/month; Pro, Team, and Enterprise plans available |
| Access | Open — create a free account at the console, then install the CLI: curl -fsSL https://downloads.ellmstack.dev/install.sh | bash (macOS & Linux, x86_64 & arm64) |
The vault for what agents learn
An encrypted, local-first memory vault for AI agents — it decides what to keep, what to forget, and proves why it remembered.
| Status | Beta — install it today, no waitlist |
| What it is | Encrypted memory vault for AI agents |
| Storage | Local-first |
| Privacy | SQLCipher encryption at rest; memory never leaves your machine |
| Memory lifecycle | Decay inspired by biology; imagined memories quarantined |
| Retrieval | Deterministic, with a proof trace on every retrieval |
| Access | Open — curl -fsSL https://engram.ellmstack.dev/install.sh | bash. No waitlist, no key. |
One engine underneath
ELLM is the symbolic reasoning kernel Guardrail and Engram are built on. Amparo acts on top of them — Guardrail is its policy engine, Engram its memory. We don't sell ELLM, and its source isn't public yet — we may publish it in the future. Not public yet