Meet VETO! Mostly harmless, mostly decisive

Every tool call
checked before it executes.

AI agents act faster than any review loop. Control Zero evaluates every action against your policy before it runs — allow, warn, or block — and every decision is recorded.

Get Started Free Read the Docs

Open source SDKs · No account required · 5,000 governed actions free

Control Zero SDK

Works with any agent

$ pip install controlzero
Claude Code Cursor Gemini CLI Codex CLI Kiro Antigravity Windsurf GitHub Copilot Cline JetBrains AI

Hook-governed agents: 6 · MCP-cooperative: 4 · SDK languages: 2

Policy evaluate

Full visibility into every decision

Trace any action back to the call, the rule, and the outcome that produced it. Every evaluation lands in your audit trail — searchable, exportable, compliance-ready.

  • ✓ Pre-execution checks for every tool family
  • ✓ Allow, warn, or block — decided before the call runs
  • ✓ Cryptographically signed policy bundles
controlzero · policy evaluate LIVE
$ controlzero evaluate --policy bundle_v42.signed
evaluating against signed policy bundle…
tool_call bash "rm -rf /var/data/customer-exports"
rule block_destructive_shell
decision DENY ▸ pre-execution
reason destructive shell pattern matched
audit decision recorded → #48291
shell call blocked before it ran.
$
gateway · zero code changes
$ export OPENAI_BASE_URL=https://gw.controlzero.ai
request → gpt-5.5 · scanned for PII + secrets
decision ALLOW · cost cap ok · policy v42
Private by design

Policies evaluate where your data already is.

A compiled policy engine runs in your process — or at your gateway. Signed bundles, local evaluation, no external calls. Sensitive data never has to leave your infrastructure.

[ local ]

In-process evaluation

Decisions happen before anything leaves the machine. Air-gap friendly, no phone-home.

[ signed ]

Tamper detection

Policy bundles carry cryptographic signatures. Tamper handling: warn, deny, or quarantine.

[ redacted ]

Built-in DLP

64 detectors for PII and secrets. Deny, mask, or warn — matched values rewritten in place.

Why Control Zero

Guardrails that fire before the action.

01

“Why did the agent do that?”

Every decision gets a record: the call, the rule that matched, and the outcome. Look at any action and the reasoning is right there in the audit trail.

02

“Where does governance actually run?”

In your process. Enforcement happens in the SDK or at the gateway — not in a model that guesses. No data movement, no probabilistic review loop.

03

“Why do guardrails keep missing the action in between?”

Because they're probabilistic. Control Zero is deterministic: every tool call is checked against your rules before it executes. The rule fires, or it doesn't.

The Shift

AI agents are autonomous.
Your governance should be too.

Every week, agents gain new capabilities: writing code, managing infrastructure, touching production. MCP and tool use create trust boundaries traditional security can't see. Control Zero governs the gap between the model and the tool call.

0+
Framework integrations
0
Code changes for gateway mode
0s
Policy refresh TTL
0
Built-in DLP detectors
Pick your starting point

What do you want to govern?

>_ GA

Govern Claude Code, Cursor, etc.

Pre-execution policy checks for coding agents. Every tool call evaluated before it runs; Cursor CLI covers shell commands.

Get started →
{ } GA

Govern an AI app I'm building

Wrap your Python or Node agent with the SDK. Per-tool enforcement and audit in three lines.

Get started →
⇄ GA

Govern an existing app, no code changes

Point the API base URL at the gateway. Zero code changes across 12 providers — Anthropic, OpenAI, Google, Bedrock and more.

Get started →
▓▒░ BETA

Block PII in chat UIs

A deny rule cancels the paste before it lands and the send before it leaves. A mask rule rewrites the match in place.

Get started →
⌖ SOON

Discover where AI is used in my org

Scout will find ungoverned AI usage from network traffic, running processes, and exposed API keys on enrolled hosts.

Join the waitlist →
▣ PREVIEW

Run fully offline (air-gap)

Deploy Control Zero in your own infrastructure. Policies evaluate locally. No external calls, ever.

Contact sales →
Three modes · Two integration patterns

Pick where it runs. Pick how you wire it in.

SaaS — Actions flow through Control Zero cloud. Dashboard, audit log, and policy sync managed for you. Zero ops.
Gateway Proxy 12 providers · 1 config change
zero code changes
# change one environment variable
$ export ANTHROPIC_BASE_URL=https://gw.controlzero.ai
policy enforcement · request DLP · model access control
cost caps · full audit trail · response DLP (opt-in)

Transparent proxy with enforcement on every request. Supports Anthropic, OpenAI, Google, Bedrock, Vertex, Azure OpenAI, Ollama, DeepSeek, Mistral and more.

SDK Integration 3 lines · fine-grained control
python · per-tool governance
$ pip install controlzero
import controlzero
controlzero.wrap(agent, policy="bundle_v42.signed")
policy loaded ✓ · evaluation is in-process

Wrap your AI calls with the open source SDK for per-tool governance, on-demand secret retrieval, and local policy evaluation. Works without an API key in local-only mode.

Every combination ships on the free tier. Local mode works without an account.

One policy · Every surface

Hooks on six agents. One policy.

Install once and one policy engine evaluates every call that reaches it — decided before the call runs, or cooperative where the host is.

HOOK-GOVERNED (6)
decided before the call runs
Claude Code Cursor Gemini CLI Codex CLI Kiro Antigravity
MCP-COOPERATIVE (4)
the client may ask first
Windsurf GitHub Copilot Cline JetBrains AI

Logos and trademarks are property of their respective owners. Listed for integration reference only.

How It Works

Three steps to a governed agent.

01

Install

Install the SDK or point your API base URL at the gateway. One package, one line of config. No infrastructure changes.

$ pip install controlzero
02

Define policies

Set rules from the dashboard, via API, or in a local JSON file. Model allowlists, cost caps, tool restrictions, PII filters.

{
  "rules": [
    { "tool": "bash", "pattern": "rm -rf",
      "action": "deny" }
  ]
}
03

Enforce & audit

Every request is evaluated before it executes. Allow, deny, or warn — and every decision lands in a searchable, exportable audit trail.

$ controlzero audit search --outcome deny
Coverage across AI surfaces

Governance spans SDKs, APIs, tools, and browsers.

Coding Agent Hooks

GA

On Claude Code, Gemini CLI and Cursor IDE a deny rule stops the call before it runs, across every tool family.

Browser Extension

BETA

DLP for AI chat interfaces. A deny cancels the paste before it lands; a mask rewrites the match in place.

Shadow AI Discovery

SOON

Scout discovers ungoverned AI usage from network traffic, running AI processes, and exposed API keys.

Secrets Vault

BETA

Provider keys encrypted at rest. SDK reads are policy-gated and can require human approval.

DLP Scanning

GA

64 built-in detectors across 12 pattern packs — PII, secrets, and sensitive data in every request.

Policy Signing

GA

Published bundles carry cryptographic signatures. Tamper handling: warn, deny, or quarantine a machine.

Air-Gap / Self-Managed

PREVIEW

Gateway, engine, audit store, and dashboard on your infrastructure. Licensing works offline.

RBAC

BETA

Granular permissions for policies, audit logs, agent management, and enforcement modes.

Append-Only Audit Trail

GA

Searchable, exportable decisions with append-only enforcement. The audit record is the durable evidence.

Start governing

Join the enforcement.

Regular updates from the control plane. Policy drops, integration news, early access, and exclusive releases for people who got here first.

5,000 governed actions per month free. No credit card required.