Pick the surface that fits where you are.

GitHub Action / GitLab CI runner that fires the 556-payload regression corpus against your agent code on every PR. Snyk-shaped product for AI agent security testing in CI. Coming after the launch wave.

Clampd Discover: shadow AI inventory. A command-line scanner that maps your AI surface in seconds. clampd scan <path> walks any repo, monorepo, or directory and finds every place an LLM SDK, framework, or agent runtime is used: OpenAI, Anthropic, Gemini, Bedrock, Vertex, Mistral, Cohere, LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, Semantic Kernel, Ollama, Transformers, vLLM, llama.cpp, and MCP servers (Cursor, Claude Code, Continue, Aider). For each finding, Discover names the model, identifies whether the call is already wrapped with Clampd or running as shadow AI, and recommends a Clampd bundle that would govern it. Output is JSON, SARIF (GitHub Code Scanning), or human-readable.

Wire Mode: Universal AI Egress Governance. Intercept every LLM call leaving your environment at the network edge. No SDK wrap, no code changes. Set HTTPS_PROXY once, install the per-org Clampd CA cert, and every prompt, tool call, and response from OpenAI, Anthropic, Gemini, Bedrock, Vertex, or self-hosted models passes through your governance pipeline. Same rules, same Cedar policies, same bundles as the SDK path. Streaming responses re-encoded in flight without buffering. The defence against shadow AI: discovered ungoverned agents auto-flow through the same enforcement that governs your wrapped ones.

Maintained compliance evidence: HIPAA, GDPR, SOC 2, PCI-DSS templates kept current as the regulations evolve. Scheduled monthly/quarterly delivery. Activity inventory: agents observed, tool descriptors observed, MCP endpoints with traffic, policy violations grouped by agent/time/category. Source-available under BSL-1.1. The raw audit data lives in your own ClickHouse on every tier and is queryable directly. clampd-reports is the maintained alternative for teams who don't want to keep their templates current as compliance frameworks evolve.

Pick any historical agent decision and reconstruct the full call: tool descriptors, params, matched rules, session-pattern flags, scope token issued, LLM-as-Judge verdict (if fired), final policy decision, downstream response. When an alert fires (kill, repeated denials, behavioural anomaly), Clampd auto-assembles every related decision, agent activity, scope grant, and delegation hop into a single timestamped, signed incident packet ready for legal hand-off, insurance claims, or regulator review. Multi-cluster federation across distributed deployments. Long-term retention beyond dashboard defaults. Source-available under BSL-1.1. The underlying ClickHouse audit data is yours on every tier; clampd-replay is the templated workflow plus chain-of-custody signing infrastructure on top.