One gate between your agents and every risky action.
CAGIS.ai sits on the endpoint as a PreToolUse gate. Every action an AI agent attempts is scanned on-device against your policy, secrets are tokenized before they leak, and every decision is audited — locally and centrally. Here's the full path, step by step.
The whole gate, in sixty seconds
Before you read the step-by-step below, see it end to end: an agent action intercepted, evaluated on-device, approved by a human, and audited across the fleet.
60 seconds · sound on for the full walkthrough (captions included)
From agent action to audited decision
Every tool call an agent makes travels the same five-step path — evaluated before it runs, decided against your policy, and recorded.
- 01
An agent attempts an action
Claude Code, Codex, or a hosted surface tries to run a shell command, read a file, hit the network, or call a tool. Before it executes, the attempt is intercepted at the PreToolUse boundary — the agent is paused, nothing has run yet.
- 02
The gate scans it on-device
The endpoint binary evaluates the action against the 60-rule behavioral catalog and the session's prior steps — de-obfuscating shell with an AST tokenizer and correlating multi-step chains like secret-read → egress. This runs locally, even fully offline.
- 03
The policy engine decides
When online, the platform API applies your org policy as defense-in-depth — it can only tighten the on-device verdict, never loosen it. The decision is resolved to allow, ask, or deny and attributed to the user and session.
- 04
Allow, ask, or deny is enforced
Allow lets the action through. Deny blocks it. Ask defers to the agent's own native permission prompt — no custom dialog. If anything fails, the gate fails closed: a crashed hook never means allow.
- 05
Every decision is audited
The verdict, the matched rules, and the DLP metadata are written to a local and server audit trail — attributed to user and session, normalized to one event schema — feeding fleet inventory, analytics, and cost metering.
Four components, one control plane
The gate lives on the endpoint. Decisions, audit, DLP, inventory, and metering are served by the platform API and surfaced in the dashboard — with optional gateways extending reach.
The PreToolUse gate on every laptop. Scans actions on-device, tokenizes secrets, fails closed.
NestJS policy engine + audit + DLP + inventory + metering. Applies org policy as defense-in-depth — tighten-only.
Next.js console to set policy, review the audit trail, watch inventory, and track spend across the fleet.
An MCP gateway extends the same policy to claude.ai and Cowork; an optional LLM proxy adds cost control and metering to model traffic.
Ships as a Node-free compiled binary with a one-command installcurl … | sh— and normalizes every event to one schema across Claude Code, Codex, and hosted surfaces.
Enforcement that can't be quietly weakened
Four properties keep the gate trustworthy — on the endpoint, offline, and across your whole fleet.
On-device & offline-first
Enforcement lives on the endpoint, so protection holds with no network. Online, the server is defense-in-depth that can only tighten — never loosen — what the device already decided.
DLP: detect, then tokenize
A detected secret or PII value is swapped for a reversible vault token before it reaches the model, your logs, or the wire. Only {detector, count} metadata ever leaves the machine.
Fleet governance
A multi-tenant console pushes one policy fleet-wide over MDM/SSO, with per-user identity, a live inventory of AI assets on every endpoint, and audit that rolls up centrally.
Hosted-surface coverage
The same policy reaches claude.ai and Cowork through an MCP gateway — so agents outside the terminal are gated by the same allow/ask/deny rules and the same audit trail.
Online only ever tightens. It never loosens.
The on-device verdict is the floor. When the endpoint reaches the platform, the server policy is layered on as defense-in-depth — it can add restrictions, but it can never relax what the device already decided. Lose the network and protection holds; the gate simply falls back to local enforcement and fails closed.
Explore the full capability set