NOCTRYSRuns where your agents already run.
One enforcement core, three ways to run it. The governance, the audit, and the proof are identical across all three. Pick the one that fits your runtime and latency budget.
Proxy / stdio
Installable as an MCP server your agent runtime spawns. Every tools/call is governed before it runs.
Sidecar
One command, noctrys serve --policy policy.json, boots it. Agents POST /v1/intercept; a live compliance console streams every decision.
Single binary
One static binary for the latency-critical path. No runtime, no dependencies.
Self-hosted, always. NOCTRYS never sees your data; only a 32-byte hash of the audit log is anchored on-chain. See the install guide →
From policy file to running governor in one command
The HTTP sidecar boots straight from a policy manifest. Run it with Node, or use the included Dockerfile and docker-compose.
noctrys serve --policy policy.json # HTTP sidecar on :8787 # or containerized: docker compose up # same governor, same policy
Either way, every POST /v1/intercept is judged against your policy and every decision is sealed into the tamper-evident audit.
Same guarantees, whichever you pick
| MCP | HTTP sidecar | Go binary | |
|---|---|---|---|
| Deterministic policy + detection | ✓ | ✓ | ✓ |
| Tamper-evident audit + AERE anchor | ✓ | ✓ | ✓ |
| Live streaming console | No | ✓ | No |
| Lowest latency / no runtime | No | No | ✓ |
| Best for | MCP tool stacks | services & observability | hot path |
Be one of our first five design partners
Free pilot. A two-week, self-hosted integration. You keep the tamper-evident audit and the AI Act compliance report.
Request a pilot →