ShrikeShip AI Agents That Act. Govern Every Action.
Action governance: every prompt, tool call, and response checked against your policy before it runs.
Observe mode blocks nothing. Enforce one agent at a time when you are ready.
Commands, files, queries, fetches, and ten more surfaces, each with its own verdict. See the map →A scope declared once, a lapse the agent refreshed inside its own window, and a command from a fetched page refused on content.
Prompt scanners read what the agent says. Shrike governs what it does.
Enable speed
Start in observe mode, declare a scope, and in-scope work is never second-guessed: 1.1% of benign sessions interrupted, measured.
How scope works →Enforce boundaries
Allow, hold for a person, or block, server-side on every call, against the scope you declared. You declare; Shrike enforces.
Drive the live sandbox →Export evidence
Every verdict mapped to SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001, and OWASP, and exportable to your auditor and your SIEM.
Compliance →Declare what the agent is for. Shrike holds it to that.
Give any agent a scope at spawn: a purpose, the tools it may use, and when it expires. Live today on every channel: REST, SDKs, and MCP.
A scope, at spawn
One declaration, from you or your agent framework, never from the agent's own reasoning.
The model can't talk its way around a boundary it never touches.
Tool calls outside the declared scope route to human approval before they execute. Expired scopes stop acting silently: the check runs in the scan pipeline itself, so every channel inherits it. And where that server runs is your call: our cloud, your VPC, or a hardware enclave. See deployment options →
Scope cuts both ways
The declared purpose also grounds Shrike's semantic analysis: an agent doing exactly what it was scoped to do isn't second-guessed as an attacker. More control and fewer false alarms, from the same declaration.
Named-tool allowlists and expiry ship today. Resource-level read / write / approval statements (scope as code) are on the roadmap. Scope declaration guide →
Measured against the production scan path on public benchmarks (AdvBench, HarmBench, JailbreakBench, ADR-Bench). False positives reported at message and session level; errored probes re-run, never dropped.
14 action controls · 9 content layers · 6 integration channels · 1 line of code to begin
Start with enforcement. Posture and operations come with it.
Runtime Policy Enforcement
Your policy, enforced at every agent action: allow, warn, require approval, or block before it executes.
- Allow / warn / require-approval / block, enforced server-side
- MCP tool-call & command governance
- Prompt & response inspection · PII redaction
- LLM Gateway
Security Posture Management
The same record, read as a risk surface instead of one action at a time.
- Shadow AI discovery
- Model inventory & risk scoring
- Posture monitoring
- Misconfiguration detection
Security Operations Center
The same record, when something needs investigating, answering, or reporting.
- Real-time dashboard & analytics
- Incident management
- Red team testing (6,500+ patterns)
- Audit trails & compliance reports
Built on original research across six foundations: cognitive detection, hardware-isolated enforcement, self-approval prevention, session-aware correlation, security knowledge graph, and runtime-neutral threat adaptation.
Evidence of oversight, without a new project to produce it.
Every action is checked against your policy before it runs, and every decision is recorded as it happens. The evidence your auditors ask for is a by-product of enforcement, not a quarter-end reconstruction.
Who allowed it
Each agent's declared purpose, tools, and expiry, and the named person who approved any action your policy holds for review. The agent never approves its own request.
Which rule applied
Every decision names the rule in your policy it was checked against, allows included, so the record shows the control operating, not only the times it fired.
Where the record is
Audit trail export and evidence packs mapped to SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, NIST AI RMF, the EU AI Act, and the OWASP LLM Top 10 (2026).
Control mappings, not certifications: your assessor makes that call. Why agents raise this question → Trust Center →
Meet your enterprise where it is.
No rip-and-replace. Six integration channels: REST, MCP, LLM Gateway, and Python, TypeScript, and Go SDKs. Fail-closed by default: when Shrike can't decide, the agent stops.
Runs in our cloud, your VPC, or no cloud at all.
The enforcement boundary is yours to place. The same policies and the same evidence record follow it — moving between deployment models changes nothing in your integration. Model choice stays yours as well: hosted, local, or sovereign, the policy, the scope, and the evidence record hold when the provider changes.
Cloud SaaS
Managed on Google Cloud — us-central1 by default, EU region on request. No content retention by default: safe interactions are stored as a hash plus metadata, never the content.
Your VPC
The enforcement plane deploys inside your network boundary. Prompts, tool calls, and verdicts stay behind your perimeter — your data never leaves your control.
Air-gapped
Zero outbound. Signed images and signed pattern and policy updates delivered under the engagement. Built for government and defense environments, with US-personnel-only support available.
Sovereign & TEE
In-region processing for data-residency mandates. Hardware-enclave isolation (AMD SEV-SNP) is available under engagements that require enforcement to execute outside the model's reach.
GCP live today · AWS planned · on-prem under Enterprise engagement. Procure through your existing Google Cloud commitment on the GCP Marketplace. Deployment & data-residency details →
Start free. Self-serve through Team. Procurement-ready Enterprise.
Best for one developer putting a first agent under governance. No card.
- 1,000 scans / month
- Real-time threat detection
- MCP server + REST API + SDKs (Python, TypeScript, Go)
- Community support (GitHub Discussions)
Best for one production agent, or a coding agent, that needs approvals and an evidence record.
- Everything in Community, plus:
- 25,000 scans / month
- Full 9-layer pipeline: LLM analysis, response intelligence, multi-turn session memory
- Human-in-the-loop approval workflows
- Compliance dashboards + audit trail
- Priority email support
Best for a security team governing agents across several squads, with SSO and a SIEM.
- Everything in Pro, plus:
- 150,000 scans / month
- SSO via Google Workspace + GitHub OAuth
- Multi-user RBAC up to 25 seats
- 90-day audit log retention
- Splunk + webhook SIEM connectors
- Slack + email alert routing
- Priority email support (8-hour SLA)
Best for procurement, data residency, and enforcement inside your own boundary.
- Everything in Team, plus:
- 1M+ scans / month + custom seat count
- All SIEM connectors (Splunk, CrowdStrike, Sentinel, custom)
- SAML SSO + custom IdP federation (Okta, Azure AD, Auth0)
- Air-gapped, VPC, sovereign, and TEE deployment options
- Custom policy authoring: regex rules live on every channel within 60s, no redeploy
- Compliance evidence package (SOC 2, HIPAA, ISO controls mapping)
- Dedicated support engineer + SLA
- Available on GCP Marketplace
Straight answers to what buyers ask us most.
What is action governance for AI agents?
Action governance evaluates what an AI agent is about to do (each tool call, shell command, SQL query, API request, and agent-to-agent message) against your policy, and allows, blocks, or escalates it in real time before it executes. It goes beyond scanning the prompt to governing the action the prompt triggers.
How is Shrike different from a prompt scanner?
Prompt scanners inspect input text for known-bad patterns. Shrike does that too (it's the deterministic floor), then adds the action plane: it governs the tool calls and side effects an agent takes, correlates threats across a full multi-turn session, and enforces scope and human-in-the-loop, server-side where the model can't talk its way around it.
What does Shrike cost?
Community is free: 1,000 scans/month, real-time threat detection, no credit card. Pro is $99/month (adds LLM analysis + multi-turn session memory (the full 9-layer pipeline) plus human-in-the-loop approvals and a compliance dashboard). Team is $499/month (SSO, RBAC, SIEM connectors). Enterprise is custom (SAML, air-gapped/VPC/sovereign deployment, DPA).
Can I restrict which tools an AI agent is allowed to use?
Yes. Declare a scope for any agent: a purpose, a named-tool allowlist, and an expiry. Tool calls outside the scope route to human approval before they execute, expired scopes stop acting silently, and the declared purpose also grounds Shrike's semantic analysis so in-scope work isn't flagged as an attack. Available today via the REST API, the SDKs, and the MCP scan_declare_scope tool.
What happens when Shrike refuses an action?
The refusal comes with its way back. Every scan returns a recovery block naming the reason and the next legitimate step: refresh a lapsed scope, ask a person, or change the approach. A held action waits for an approver on the dashboard; a locked session can be released by an operator, or, under a live scope, by the agent itself a bounded number of times, and every release is audited. Agents that read the recovery block correct course instead of retrying or giving up.
Can I write my own detection rules?
Yes, on the Enterprise tier. A custom policy is a pattern, an action (observe, warn, require approval, or block), a severity, and the scan stages it applies to. Test it against a sample in the dashboard, save it, and it is enforced on every integration channel within about a minute with no redeploy. Every hit lands on the same evidence record as the built-in layers.
Which AI providers does Shrike work with?
Any of them, hosted or local. Shrike is model- and vendor-agnostic: it works across OpenAI, Anthropic, Google, Mistral, and open-source models, over MCP, REST, and A2A, and the same SDK governs a local model served by Ollama, vLLM, or LM Studio through its OpenAI-compatible endpoint. Policy, scope, and the evidence record belong to you, not to the provider, so changing models changes nothing in your controls. Drop-in SDK wrappers ship for Python, TypeScript, and Go.
Does a local model need governance?
More than a hosted one. A team that moves to a local model for data residency or cost loses the provider guardrails at the same time: no content safety, no approval step, no record of what the agent did. Shrike is the control that survives the move. Point the SDK at the local endpoint and the same policy, scope, and evidence record apply. See the local models guide in the docs.
Where does Shrike deploy?
Cloud SaaS, inside your VPC, air-gapped, or sovereign/in-region. Hardware-enclave isolation (AMD SEV-SNP) is available under Enterprise engagements that require it. Adding or switching a model provider requires no changes to your Shrike policies.
Does Shrike retain my data?
No content retention by default. Safe interactions are stored as a cryptographic hash plus metadata; the original content isn't kept. Full violation records are retained, encrypted at rest, for audit. We don't keep what we don't need.
Is Shrike SOC 2 certified?
Not yet. Shrike is built to SOC 2-aligned controls, with certification targeted for 2026. Shrike helps you document your own compliance posture (GDPR, HIPAA, ISO 27001, SOC 2, NIST); it is not itself a certification. See the Trust Center for current status.
Begin where trust begins: just watching.
Find out what your own agents do. No policy to write first, nothing blocked, nothing to undo if you stop. Enforcement is a per-agent switch with an audit row and an end date, and observe mode is always one save away.