Deploy

Runs where your agents already run.

One enforcement core, three ways to run it. The governance, the audit, and the proof are identical across all three. Pick the one that fits your runtime and latency budget.

self-hosted alwaysone-command serveNode · Go · Dockerzero dependenciesonly 32 bytes leave

MCP

Proxy / stdio

Installable as an MCP server your agent runtime spawns. Every tools/call is governed before it runs.

HTTP

Sidecar

One command, noctrys serve --policy policy.json, boots it. Agents POST /v1/intercept; a live compliance console streams every decision.

Single binary

One static binary for the latency-critical path. No runtime, no dependencies.

Self-hosted, always. NOCTRYS never sees your data; only a 32-byte hash of the audit log is anchored on-chain. See the install guide →

From policy file to running governor in one command

The HTTP sidecar boots straight from a policy manifest. Run it with Node, or use the included Dockerfile and docker-compose.

noctrys serve --policy policy.json     # HTTP sidecar on :8787
noctrys serve --policy policy.json --store audit.jsonl
                                       # same, with a durable audit that survives restarts
# or containerized:
docker compose up                      # same governor, same policy

Either way, every POST /v1/intercept is judged against your policy and every decision is sealed into the tamper-evident audit.

With --store audit.jsonl, every decision is appended to the file before the HTTP response returns, so the hash chain spans restarts. On boot, NOCTRYS reloads the store and verifies the entire chain: an intact store is extended in place, and a store that fails verification refuses to start. The governor fails closed even against its own history, which is what the EU AI Act logging and retention duties (Articles 12 and 26) actually require of a log.

Same guarantees, whichever you pick

	MCP	HTTP sidecar	Go binary
Deterministic policy + detection	✓	✓	✓
Tamper-evident audit + AERE anchor	✓	✓	✓
Live streaming console	No	✓	No
Lowest latency / no runtime	No	No	✓
Best for	MCP tool stacks	services & observability	hot path

Be one of our first five design partners

Free pilot. A two-week, self-hosted integration. You keep the tamper-evident audit and the AI Act compliance report.

Request a pilot →