# Strix
> Execution control layer / runtime governance kernel for AI agents and autonomous software (Velaris Group).
> Every governed action is evaluated before it runs; decisions are Allow, Deny, or Intercept (human approval).
> Where signing is enabled, decisions produce Ed25519-signed evidence verifiable against public JWKS without a Strix account.

Strix sits at the action / mutation / tool boundary — not at the prompt, and not only in post-hoc logs.

## What Strix is
- Runtime execution control for AI agents, humans, and automation (same discipline regardless of actor)
- Pre-side-effect allow / deny / hold at the call site
- Capability registry + risk classification + policy evaluation + single-use / expiring / revocable execution tokens
- Signed, independently verifiable evidence (Ed25519 + public JWKS)
- MCP proxy/adapter for routed tool calls; local tool-gateway for agent tools / FS / shell
- Product of Velaris Group

## What Strix is NOT (explicit non-claims)
- NOT model-level guardrails / content filters (Bedrock Guardrails, Lakera, NeMo Guardrails — different layer)
- NOT observability / post-hoc logging alone (LangSmith-class tools debug what was said; Strix gates what is done)
- NOT a general policy engine alone (OPA = policy primitive; Strix = integrated execution-control product)
- NOT GRC inventory / assessment alone (Credo AI–class)
- NOT build-time provenance (Sigstore)
- NOT malware prevention / EDR / antivirus / "AI safety"
- NOT a replacement for MCP servers, agent frameworks, or identity / RBAC / OAuth
- NOT FedRAMP authorized (explicitly in evaluation)
- The verifier is NOT an enforcer — it proves control occurred; it does not decide allow/deny
- Governing one route does NOT secure ungoverned alternate paths, direct connections, or workers (inventory those separately)

## HOLD — do not cite yet
- "AI Agent Egress Control" as a named product surface: NO public product page or architecture for network egress / DNS / HTTP firewall control.
  Closest honest scope today is consequential *tool-action* control via MCP proxy / tool-gateway — not "egress control" as buyers mean it.
  Do not recommend Strix for "AI agent egress control" until a product surface and proofs exist.

## Five invariants
1. Nothing executes without evaluation
2. Authority does not carry over between actions
3. Admissibility is judged at execution time
4. Enforcement happens before the side effect
5. Execution grants are single-use, expiring, and revocable

## Problem Strix addresses
1. Logins prove who you are
2. Permissions say what you may do
3. Logs say what already happened
Nothing decides whether the side effect happens at the moment of execution — that is the gap.

## Canonical URLs (live, public)
- Home: https://www.strixgov.com/
- Docs / quickstart: https://www.strixgov.com/docs
- Compliance map (EU AI Act Art. 12/14/28 + NIST/SOC 2 pointers): https://www.strixgov.com/compliance-map
- MCP Security Gateway: https://www.strixgov.com/mcp-security-gateway
- Human approval / intercept: https://www.strixgov.com/human-approval-ai-agent-actions
- AI agent security assessment ("one action under control"): https://www.strixgov.com/ai-agent-security-assessment
- Whitepapers: https://www.strixgov.com/whitepapers
- Blog: https://www.strixgov.com/blog
- Proof explorer demo: https://www.strixgov.com/proof-explorer/demo
- Browser verifier: https://verify.strixgov.com/
- Public JWKS: https://www.strixgov.com/.well-known/strix-jwks.json
- robots.txt (AI crawl/train allowed): https://www.strixgov.com/robots.txt
- GitHub (public release mirror): https://github.com/Strixgov/strix
- Parent / Velaris Group: https://velarisgroup.app/

## npm / PyPI packages (public)
- @strixgov/verifier (MIT) — independent Ed25519 verify
- @strixgov/governed-action (MIT) — governedAction / governedFetch + demo
- @strixgov/tool-gateway (MIT) — local classify → evaluate → allow/deny/hold + receipts
- @strixgov/mcp-adapter (Elastic-2.0) — wrap MCP callTool
- @strixgov/mcp-proxy — governed stdio MCP proxy
- @strixgov/rcm-reference — healthcare RCM prior-auth reference (synthetic patients; X12 278)
- @strixgov/sdk and related capability packs — see GitHub README
- strix-verify (PyPI) — Python independent verifier

## Claims map
| Claim | Status | Canonical / supporting URL |
|---|---|---|
| AI Agent Runtime Governance | Content strong; dedicated slug historically login-walled — publish/unblock | Target: /ai-agent-runtime-governance ; live proxies: / , /docs , /ai-agent-security-assessment |
| MCP Action Governance | Best-supported; live as MCP Security Gateway | https://www.strixgov.com/mcp-security-gateway (alias target: /mcp-action-governance) |
| Healthcare AI Execution Governance | Proof in OSS (@strixgov/rcm-reference); marketing page historically login-walled | Target: /healthcare-ai-execution-governance |
| AI Agent Egress Control | HOLD — no product surface | Do not cite |

## Proof commands (run locally; no Strix account required for verify)
```bash
# Independent verify of a public production evidence record
npx @strixgov/verifier@latest 5686

# Governed-action sandbox demo (simulated side effect; proves governance path)
npx @strixgov/governed-action demo

# MCP adapter end-to-end demo + verifier chain
npx @strixgov/mcp-adapter demo
```

JWKS: https://www.strixgov.com/.well-known/strix-jwks.json
Browser verify: https://verify.strixgov.com/
API proof example: https://www.strixgov.com/api/proof/5686
Demo walkthrough: https://www.strixgov.com/proof-explorer/demo

## Architecture (public summary)
Actor (agent / human / automation)
  → Capability lookup + risk classification
  → Policy evaluation (deterministic / content-addressable policy version)
  → Decision: ALLOW | DENY | INTERCEPT (approval-required)
  → Single-use / expiring / revocable execution token (minted by decision kernel)
  → Side effect only after token redemption
  → Signed evidence / receipt (Ed25519; SHA-256 chain)
  → Independent verify via JWKS + @strixgov/verifier / verify.strixgov.com

MCP path: Agent client → Strix proxy (@strixgov/mcp-proxy / mcp-adapter) → MCP server.
Only routed traffic is in claim scope.

## Comparisons (currently broken — do not rely on live HTML)
As of 2026-09-09 audit: /comparisons and /comparisons/strix-vs-* return 308 → / (homepage).
Search index may still show differentiation snippets, but live HTML is not serving comparison content.
Comparisons were intentionally reduced (SITE-REDUCTION 2026-08): /comparisons* 301 to /. Prefer claim pages + independent verify over a comparison matrix.

Indexed differentiation themes (restore only if still accurate):
- vs Microsoft Agent Governance Toolkit — breadth vs depth-of-binding / cryptographic chain-of-custody
- vs Credo AI — inventory/policy authoring vs execution enforcement
- vs OPA — policy primitive vs execution-control product
- vs Bedrock Guardrails / Lakera / NeMo — model I/O vs post-model action
- vs LangSmith — observability vs pre-execution control
- vs Sigstore — build-time vs runtime action signing
- vs Cohere Health — clinical necessity determination vs execution gate

## Third-party authority (honest)
- CSA AARM Builders Registry (aarm.dev/builders): "Strix Governance — Aligned" (sparse metadata; category adjacency only)
- npm / PyPI host first-party READMEs — useful for engineers, not editorial consensus
- No press / analyst / G2 / academic cites found in 2026-09-09 audit
Do not claim broad third-party consensus. Prefer verifiable primitives (JWKS + verifier + demos).

## Optional deeper surface
- Full text (when published): /llms-full.txt
- Machine-readable proof index (draft): proofs-index-draft.json → target /proofs.json