Frontier APIs and self-hosted open-weight models fail the same accountability test in different ways. A hosted provider cannot show you what your own agents did with its output, and an open-weight model has no vendor standing behind it at all. Excubitor is the signed, tamper-evident record that covers both, with enforcement that stops and contains an agent the moment something goes wrong.
Bring your own model key. Self-host on your own hardware. Nothing leaves the building.
They read email, move money, write code, and call tools. A poisoned document or a bad instruction can turn a helpful agent into a costly one, and most teams have no record of what the agent did or why.
Per-call guardrails catch a single bad prompt. They cannot see a threat travel from one agent to the next, and they leave nothing behind to review.
Excubitor is a lightweight library and gateway that sits alongside your AI application. Every agent writes what it did into one shared, signed ledger, so you get detection, containment, and an audit record from a single place.
It adds no latency to the path it protects, needs no framework, and runs on your own hardware with your own model key.
Three jobs on the live path, each built in and each composing the open tools your team already trusts.
A single decorator around an agent, or the gateway in front of it, records each tool call, run result, and decision into one normalized ledger. By default it stores hashes, not your data.
A built-in detection floor plus your choice of open detectors flags prompt injection, secret leaks, and unsafe output, each mapped to OWASP LLM and MITRE ATLAS so the finding is legible to your security team.
Reversible fixes apply on their own behind a test gate and roll back if the checks fail. Anything destructive, such as rotating a credential or patching a prompt, is staged and waits for a human.
When your agents write code, Excubitor reviews the change across languages, applies the safe fixes behind a test gate that must pass, and keeps a log of what it changed and why.
A pre-merge check fails the build on findings above the severity you set and leaves a plain-language comment on the pull request, so risky changes stop at the door.
Findings flow to your SIEM in a standard open format, policy is written as code, and the whole thing self-hosts with a container image and a chart. No new console required to start.
These read the whole history, not one call. A per-prompt guardrail cannot replicate them, because the picture only exists once every agent writes into one place.
Learns each agent's normal tools, scopes, and actions, then flags the drift when one starts doing something it never did before.
Trace any decision back through prompt, tool, data, and action. Replay exactly how the agent got there, signed and step by step.
Follows one threat as it spreads from agent to agent and raises the alarm the moment a taint crosses a boundary, not after the damage.
A red-team probe that got through becomes a signature that flags the same wording the next time it reaches an agent, and refuses once you approve it. Every run, Shield's findings included, is scored and signed.
Managed with evidence, never on faith.
Your models. Your hardware. Your evidence.
Every action lands in a hash-chained ledger. Each record links to the one before it, so a single altered entry breaks the chain and shows itself. It is owned by you, readable by your auditor, and independently checkable.
Any edition, any configuration. The platform price is the same in every one: adding reviewers, analysts or auditors costs nothing. Talk to sales for a quote sized to your AI footprint.
Running it yourself adds a yearly support line beside the platform price, not a discount on it, and a one-off deployment engagement. Identity, network policy and integration are set up per customer, which is why both are quoted rather than listed.
Having us operate it inside your account is quoted per engagement, because it is an on-call commitment in your environment rather than a support line on ours. The platform price is the same one; what is quoted sits beside it. It starts with a conversation about what you need answered at three in the morning.
A handful of applications, one team, no security function of its own.
Several applications across teams, with a named security owner.
Many applications, a formal security function, regulatory pressure.
One independently deployed system whose AI agents Excubitor records. A twelve-service mesh shipped as a unit is one; two products sharing a repository are two. Non-production environments, ones that serve no end users, are not counted.
Nothing is degraded, throttled or switched off. True up the difference or move to the edition that covers it, and moving up at renewal waives the true-up. A count dispute is settled from your own signed ledger export, checked by a third party we both pick if needed.
Pre-assessment engagements, with regulatory add-ons. Quoted separately, delivered by our team, findings and evidence handed to you. Not part of any edition.
Your models. Your hardware. Your evidence.
Excubitor is built to sit inside your own environment, not to route your traffic through ours.
Point Excubitor at your own model provider and key. It uses an industry standard endpoint, so you keep control of the model choice and the bill.
A container image and a chart drop it into the infrastructure you already operate. No dependency on an Aurakore-hosted service to function.
The ledger, the detectors, and the response loop all run in place. Your prompts and data stay inside your boundary.
We will walk your team through Excubitor on a live agent, show the ledger fill in real time, and leave you with the signed record to check for yourself.