Centrally configure, secure and audit Claude Code, Codex, Copilot and Cursor across your engineering organization — open-source configuration management, plus enterprise DLP that blocks secrets and sensitive data before they reach the model.
What's broken
Every developer installs them. Every config drifts. Nobody can answer the auditor's question: "show me what the AI was allowed to do on May 14th."
For the CISO
For the VP Engineering
Allow · warn · block · redact — decided on the laptop, before the model sees a byte. The verdict lands in a tamper-evident audit log; the prompt itself never has to be stored.
One control plane
Kerios governs Claude Code, Codex, Copilot and Cursor across your organization through a single local daemon.
Define agent configuration, engineering rules and approved tools once. Kerios keeps every developer's Claude Code, Codex, Copilot and Cursor in sync — and flags drift the moment it appears.
Config sync · Policy standards · MCP governance (roadmap)
Secrets, credentials and customer data never have to leave the workstation to be inspected. Allow, warn, redact or block — decided locally, before the prompt reaches the model.
Local DLP · Secret & PII detection · Targeted AI proxy
Know what's installed, what's compliant, and what got blocked — without reading a single prompt or line of source. Metadata reaches the Brain; content never does.
Fleet inventory · Compliance drift · Audit events
Three steps
One command on each dev laptop. The agent registers with your self-hosted brain over mutual TLS and starts intercepting traffic to AI provider hosts. Fleet inventory populates in under a minute.
curl -sf kerios.sh | shEvery outgoing prompt is scanned for AWS keys, API tokens, vendor credentials, and env-style secrets. Composable rules let you match by host, model, body size, or content — and decide: allow, warn, block, or redact.
action: allow | warn | block | redactEvery detection, every decision, every config change — written to a SHA-256 hash-chained audit log. The prompt itself never gets stored, only the verdict and the rule that fired. Hand it to your auditor on demand.
kerios audit export > soc2.jsonOpen source — GPLv3
Define your agent configuration once — Kerios keeps Claude Code, Codex, Copilot and Cursor in sync across every developer machine. Free. Self-hosted. No Enterprise license required.
Kerios Security
Developers keep their AI tools. Platform keeps them consistent. Security keeps control.
AWS access keys, Anthropic and OpenAI tokens, env-style assignments. Four built-in patterns out of the box, more on Security tier.
Per-rule action: drop the request, alert the dev, or rewrite the body so AKIA... becomes [REDACTED:aws_access_key] before forwarding.
Match by host, model, body size, message count, secret presence. Combine with all / any. First rule wins.
SHA-256 hash chain — break it, the verifier shouts. Stores verdict + rule, never the prompt itself. Optional HMAC signing on the Security tier.
Fleet inventory, audit explorer, policy editor, live reload. Read-only mode for auditors.
One command emits PDF + JSON covering data-loss controls (CC6.7) and change logging (CC7.2). Hand it to your auditor as-is.
Where Kerios sits
Most AI security tools sit between your devs and the model — in their SaaS. Kerios sits on the dev's machine. The secret never has to leave to be inspected.
| Kerios | Prompt Security · Lakera | DTEX · Incydr | Git + shell scripts | |
|---|---|---|---|---|
| Where inspection happens | On the dev's laptop | Vendor SaaS or proxy | Endpoint telemetry | Nowhere |
| Secret leaves the laptop on detection | No | Yes — to their SaaS | Yes — to their cloud | Yes — to the model |
| AI-vendor aware | Yes (4 vendors, parsed bodies) | Yes | No | No |
| Block, warn, or redact | All four — per rule | Block / warn | Warn only | None |
| Tamper-evident audit | Yes — SHA-256 chain | Vendor's choice | Vendor's choice | None |
| Deployment | Self-hosted, mTLS | SaaS | Endpoint agent | N/A |
| Stores the prompt content | No (only verdict + rule) | Often yes | No | N/A |
| SOC 2 evidence export | One command | Varies | Varies | You write it |
How it's built
The Brain distributes policy and collects metadata. The daemon on each laptop does the enforcing — self-hosted, mutually authenticated, hash-chained. Nothing leaves your VM unless you route it there yourself.
Agents authenticate with mTLS using certificates you issue. Tokens never leak — there are none.
SHA-256 chain. Every entry references the previous hash — deletions and edits are detectable. HMAC signing on Security tier.
Brain server in your VPC — no Kerios cloud, no telemetry endpoint, no phone-home. If it's unreachable, every daemon keeps enforcing the last-known-good policy and buffers audit events until it reconnects.
The SOC 2 evidence pack maps to CC6 (logical access) and CC7 (change management). One command emits a dated PDF report + the underlying JSON. Hand it to your auditor without further translation.
Free where it counts
Bottom-up adoption. Any developer or platform team can standardize AI agent config today, no procurement involved.
CISO-led buys. Everything in Kerios OSS, plus the DLP, integrations, and signing your SecOps team will ask for.
500+ developers, regulated industries, or custom detection rule engineering.
Indicative pricing — final terms agreed at contract signing. Annual contracts available.
Common questions
Where it happens. They inspect prompts in their cloud — meaning the secret has already left the laptop by the time it's caught. Kerios runs on the dev's machine; the bytes are inspected before they hit the wire. If a rule fires, the request is blocked or the secret is redacted in-place. Kerios is also self-hosted, so the prompt content never leaves your perimeter, not even to us.
No. Centralized configuration, policy sync and drift detection for Claude Code, Codex, Copilot and Cursor ship in Kerios OSS, free under GPLv3. Kerios Security adds the DLP layer on top — secret/PII detection, the tamper-evident audit log, and the CISO dashboard.
Kerios inspects prompt content for one specific purpose: catching secrets, credentials, and confidential data before they leave the laptop. That analysis happens locally and ephemerally — the prompt itself is never stored. Only the verdict (clean / flagged / blocked) and a content fingerprint reach the audit log. No keystroke logging, no completions captured, no screenshots, no source-code scanning. The agent is open about what it inspects; kerios status shows every detection rule active. When a prompt is blocked, the developer sees a brief notification with the rule that fired. Engineers aren't being watched — they're being kept from pasting AWS_SECRET_ACCESS_KEY into Cursor at 11pm.
Outbound HTTPS to AI provider hosts only — api.anthropic.com, api.openai.com, GitHub Copilot, Cursor. A local trust certificate lets the agent terminate that TLS, scan the body, decide, and forward. Nothing else is watched: no filesystem scan, no process list, no DNS spying, no general-purpose packet capture. Hosts you opt out of route around the agent untouched.
Your VM. Brain server, audit database, admin UI — all self-hosted. We don't operate a cloud. We don't have a telemetry endpoint. Updates ship as a signed binary you pull on your schedule.
Agents keep enforcing the last policy they fetched. New changes can't be pushed until the brain is back, but existing configs don't drift and developers don't notice. The audit log buffers locally and reconciles on reconnect.
A 50-developer rollout typically lands in under a week: day one for the brain server in your VPC, two days for git baseline definition, two days for staged agent rollout. Most teams are in production by Friday of week one.
Start free with Kerios OSS. Add Kerios Security when you need DLP, audit and a CISO dashboard — twenty-minute demo, self-hosted trial in your VPC, no procurement gauntlet.