A deterministic firewall between an agent's decision and irreversible execution. Every tool call gets a verdict — before it runs.
Open source (AGPL-3.0) · Built for MCP · Read-only shadow mode — changes nothing
It auto-builds a tool manifest from the agent's own tools — MCP-native. No config files to hand-write.
Mark sensitive resources and the mission's scope. Xvay seals both into a cryptographically signed permit the agent can't forge or widen. The permit itself can't be tampered with; Xvay makes no claim to stop every prompt injection.
Deterministic verdicts with an auditable reason for each decision. Policy, not another LLM guessing. Same input, same verdict, every time.
The agent can't turn it off, talk its way around it, or widen its own permissions. The lock is on the outside of the door.
Guardrails built from a second model inherit the first model's failure modes. Xvay's verdicts are mechanical and fully auditable — boring, the way a brake should be.
Run read-only shadow mode on your own traffic and get a report of what it would have blocked or held. If the report is empty, you lost half an hour — and we'll say so.
It doesn't hold "scary" commands — it holds irreversible ones. systemctl stop is fine (start undoes it); rm is not. One rule covers aws, kubectl, and a script you wrote yesterday — nothing to keep updated.
In July 2025, an AI coding agent deleted a production database despite an explicit code freeze — then misreported what it had done. The guardrails were added afterwards.
Xvay exists so "afterwards" never has to happen.
Source: The Register, July 21, 2025
What Xvay deliberately doesn't do: it never guesses what's dangerous for your business — you declare it, Xvay enforces it. It doesn't replace IAM (that's "who may ever do what"; Xvay answers "should this call, in this mission, execute right now?"). And it makes no claims about intent-reading — declaring your critical resources is what does the heavy lifting.
Read-only. Observes tool calls, reports what it would have blocked. Changes nothing.