Your team is already using AI agents.
Guard is how you govern them.
Most governance stops at day one. Guard gets smarter every session. It learns your codebase, your team's patterns, and your risk profile over time.
Other AI governance tools want you to import an SDK and wrap every model call. Guard installs in 10 minutes. One policy enforces across every AI tool your team already uses — Claude Code, Claude.ai, Claude Desktop, Codex CLI, Codex Desktop, ChatGPT, Cursor, Copilot, and Windsurf.
GitHub gives the CISO a setting. ConductGuard gives them enforcement.
The agent inherits the permission. It doesn't inherit the caution.
Guard evaluates runtime admissibility before every agent action executes — applying refusal rails at the execution boundary, not in a policy document. Without runtime enforcement, agents experience permission drift, accumulating authority across tool calls that no single approval authorised.
Free tier · No infrastructure changes · Works in minutes
Real data · 1 developer · 18 days · annualized
One policy. Every AI tool.
Works where your team already codes.
Install once. ConductGuard enforces the same policy across every AI coding tool — no per-tool config, no gaps.
Claude Code
hook + MCPClaude.ai
MCPClaude Desktop
MCPCodex CLI
hookCodex Desktop
MCPChatGPT
MCPCursor
MCPVS Code + Copilot
MCPWindsurf
MCP# Install, sync, discover, validate
$ pip install conduct-cli
$ conduct guard sync
↳ hook installed · MCP registered · policy active
$ conduct guard discover
↳ Guard covers 9 of 11 agents · 2 uncovered (instructions shown)
$ conduct guard lint
↳ 12 rules · no issues · policy is valid
Also discoverable via the MCP Registry — install directly from VS Code or any MCP-compatible client.
The enforcement layer
Whatever your team runs in Claude, Guard sits in front of it.
Teams are building operating systems inside Claude — deal desks, security audits, engineering autopilots. The prompts are good. The reviewer is a suggestion.
ConductGuard is structural enforcement. Policies are evaluated against real rules, not prompt instructions. A block exits with code 2 — Claude stops. The audit trail is in your dashboard, not the chat history.
Segregation of duties only holds at the moment an agent acts. ConductGuard is the only governance layer that enforces it at runtime — not in a quarterly review, not in a policy doc.
See how Guard enforces →Prompt-based reviewer
Model can ignore it or hallucinate compliance
ConductGuard policy
Refusal rails evaluated against real rule set — block exits with code 2. Refusal conditions are structural, not advisory.
Chat history audit
No structured search, no team visibility
Conduct audit log
Every run, every block, every output — searchable
Spend as an afterthought
You see the bill at end of month
Guard spend limits
Hard stops per user, per project, enforced in real time
Guard Proxy
One env var. Enforcement on every LLM call.
Point your AI tools at the Guard Proxy instead of Anthropic or OpenAI. Policies apply before the request forwards. Nothing changes in your code.
Before
ANTHROPIC_BASE_URL=https://api.anthropic.com
OPENAI_BASE_URL=https://api.openai.com/v1
After
ANTHROPIC_BASE_URL=https://api.conductai.ai/proxy/anthropic
OPENAI_BASE_URL=https://api.conductai.ai/proxy/openai/v1
Or run conduct guard sync to apply automatically.
Policies enforced before forwarding
Block secret leaks, restrict models, cap spend — evaluated against your workspace rules before the request ever reaches the provider.
Route through your own gateway
Set Portkey, Helicone, LiteLLM, or Azure OpenAI as upstream. Guard sits in front and applies policies regardless of where traffic ends up.
Every call in your audit trail
Developer, tool, model, prompt summary, decision, cost — all in Guard Activity alongside your hook-layer events.
Why Guard Proxy
Observe or enforce — pick one. Unless you use Guard.
Portkey and Helicone sit beside the call and observe. Guard sits in front and can stop it. Set an LLM upstream in Proxy Settings to keep Portkey's routing with Guard's enforcement on top.
| Direct LLM | Portkey / Helicone | Guard Proxy | Guard + BYO | |
|---|---|---|---|---|
| LLM calls reach the model | ✓ | ✓ | ✓ | ✓ |
| Observability / logging | — | ✓ | ✓ | ✓ |
| Cost tracking | — | By API key | By agent | By agent |
| Policy enforcement (block / warn) | — | — | ✓ | ✓ |
| Blocks the call before it sends | — | — | ✓ | ✓ |
| Agent identity on every call | — | — | ✓ | ✓ |
| Audit trail tied to run + workflow | — | — | ✓ | ✓ |
| Spend budget per agent / workflow | — | — | ✓ | ✓ |
| Custom routing / caching | — | ✓ | ✓ | ✓ |
Custom routing in Guard Proxy: set any LLM upstream (Portkey, LiteLLM, Azure OpenAI) in Settings → Proxy.
GitHub Copilot Enterprise
One API key. Every developer covered.
GitHub Copilot for Business supports hosted MCP servers. Add the ConductGuard URL to your org settings once — every developer in your org gets policy enforcement automatically. No CLI install. No per-developer setup.
MCP server URL
https://api.conductai.ai/guard/mcpAuthorization header
Authorization: Bearer cond_live_xxxGenerate from conductai.ai → Settings → API Keys
Works with GitHub Copilot for Business, Cursor, Windsurf, and any MCP-compatible AI tool.
Month 1
You can't govern what you can't see. Now you can see everything.
Within 10 minutes of install, you see every AI agent your team is running, what tools it has access to, and who owns it. Guard is your organization's memory of its AI — not a spreadsheet, not a quarterly review.
Shadow AI discovered in seconds
conduct guard discover scans your machine and shows coverage instantly — "Guard covers 9 of 11 agents." Every uncovered tool gets step-by-step remediation instructions.
Spend by developer, by day, by tool
No more waiting for the invoice. See exactly where AI budget is going in real time.
Full audit trail from day one
Every tool call logged with decision, developer identity, and timestamp. One place, always current.
Validate policy before it hits prod
conduct guard lint checks every rule locally — unique IDs, valid regexes, correct actions. Ship with confidence, not a prayer.
Month 3
It caught things your team would never have seen.
Policies enforced at the tool layer, not in a doc. At the moment the agent runs, not the morning after.
Force-deploy to production, intercepted
AI attempted vercel deploy --prod --force at 3:11pm on a Friday. Guard blocked it before it executed.
Secret embedded in git commit, caught
AI tried to commit code with a credential token in the commit message. Fired twice in the same session.
971 PII events in a single day
Jun 19 spiked 30× the 32/day baseline. Without Guard, every one of those calls would have sent raw credentials to an LLM.
What would've happened without Guard?
The production deploy would have executed. Average cost of a prod incident at a mid-market company: $15K–$50K. $235 saved on tooling is nice. $50K in a prevented outage is a different conversation.
Month 6–12
Guard learns as it runs. Every session makes the next one more accurate for your team.
Two memory systems work together. One knows your codebase. One knows your team. No other governance tool has either.
Per-workflow, per-repo. Every agent template reads what worked before it acts, then writes what it learned when it finishes.
- Knows which files are fragile. Run 1 explores. Run 10 goes straight to the right file.
- Avoids repeating past mistakes. If a fix caused a regression last time, the agent knows.
- Compounds across every run. A workflow that has run 50 times on your repo is more valuable than a fresh install anywhere else.
How it works
Before every run → reads prior outcomes. After every run → writes what happened.
Per-developer, across every AI tool. The CLI hook captures sessions passively. Zero extra effort from your team.
- Knows how each developer works. Sarah always requires tests. The security lead flags credential exposure.
- Captured across all AI tools. One CLI hook. Every session adds to the team's shared context.
- The agent behaves like a team member. Not a contractor who just showed up. An engineer who's been here for months.
How it works
conduct login installs a hook. Each session is captured silently. Patterns accumulate. Templates draw on this automatically.
An agent that knows your codebase and your team.
No other automation tool has either. GitHub Actions has zero memory. Copilot has no team context. Conduct compounds both: silently, continuously, from day one.
Start FreeMCP-native governance
If your AI agent speaks MCP,
ConductGuard already governs it.
No CLI install. No hook. No code changes. Any agent that connects to conductguard-mcp inherits your team's policies the moment it starts.
How it works
- 1
Agent connects
Any MCP-capable agent adds conductguard-mcp as a server — one URL, one API key.
- 2
Policy syncs
Your active ConductGuard policy propagates instantly. No redeploy required.
- 3
Every tool call checked
guard_check fires before the agent acts. Block, warn, or audit — your rules, enforced.
- 4
Audit trail written
Every decision logged to the same Flight Recorder your security team already uses.
What gets enforced
- Prompt injection — Malicious instructions in external content intercepted before the model sees them.
- Credential exposure — API keys and secrets blocked from leaving your network in LLM calls.
- PII in prompts — Patient data, PII flagged before it reaches the provider.
- Spend limits — Per-developer token budgets enforced across every connected agent.
- Blast radius tracking — Every action scored by scope — local / repo / network / destructive.
- Human sovereignty — Approval gates are first-class workflow blocks, not optional add-ons. Conduct preserves human sovereignty at every step that matters.
- Custody proof — Every decision cryptographically logged at the execution boundary — not reconstructed after the fact. SOC2 auditors get proof, not promises. Every allowed action produces a Governance Authorization Artifact: replay-verifiable evidence that authorisation was confirmed before execution.
Add to any MCP client
{
"mcpServers": {
"conductguard": {
"url": "https://api.conductai.ai/guard/mcp",
"headers": { "Authorization": "Bearer <your-api-key>" }
}
}
}Works with Claude Desktop, Cursor, Windsurf, VS Code, Codex CLI, and any MCP-compatible agent.
Connect from any language
import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic();
const response = await client.beta.messages.create({
model: "claude-opus-4-5",
max_tokens: 1024,
tools: [{
type: "mcp",
server_url: "https://api.conductai.ai/guard/mcp",
server_name: "ConductGuard",
authorization_token: process.env.CONDUCT_API_KEY,
}],
messages: [{ role: "user", content: "..." }],
});
// Every tool call is now governed by your Guard policySame Guard policy enforced regardless of language. Java and C# use the MCP HTTP/SSE transport directly.
Agent Identity
Every agent gets an identity.
Every call is attributed.
Guard issues scoped tokens to every agent. Short-lived for interactive tools, long-lived for CI and integrations. Both enforce the same proxy rules and write to the same audit trail.
Guard validates authority at the execution boundary — short-lived run tokens mean permissions expire with the action, not the session. Conduct uses short-lived run tokens: every run mints fresh credentials. There are no stale approvals.
cond_agt_*Session tokenconduct logincond_api_*API tokenAgent Identity pageRFC 8693 compliant
Token exchange follows the same standard as Okta and Entra. Your security team already knows the protocol.
Auto-refresh
Session tokens refresh 5 minutes before expiry. No manual re-login during long coding sessions.
Workspace-scoped
Tokens are enforced to a single workspace. Cross-workspace reuse is rejected at the proxy.
Built for enterprise security
Six decisions that separate
governance from compliance theater.
Every tool claims to govern AI. These are the choices that show we actually thought about what happens when things go wrong.
Fail-closed by default
If the Guard API is unreachable, tool calls are blocked — not silently allowed. Every new workspace starts fail-closed. Fail-open is available but you have to choose it.
30-second policy propagation
When you revoke a rule, every developer's machine picks it up within 30 seconds — automatically, with no manual sync. The background drain daemon refreshes policy on every active session.
SHA-256 hash chain, one-click verification
Every audit event is linked to the previous one via a SHA-256 chain. A CISO can open the Governance page, click Verify integrity, and confirm the log has not been altered — no CLI needed.
Real-time incident feed
The activity feed streams new events within two seconds of each tool call. Click Go Live during an incident and watch blocks appear across your team in real time, without refreshing.
Daemon health visible in guard status
The background event daemon self-heals: stale processes are detected, killed, and replaced on the next tool call. `conduct guard status` shows running, stale, or not running — not a silent gap.
Proxy coverage check in every status call
`conduct guard status` shows which AI providers are actually routed through the Guard proxy in the current shell — and flags the ones that are not, with the exact command to fix it.
All six shipped in the same week. None were on a roadmap — they came from asking what a CISO would ask during a board demo.
How ConductGuard is different
A gateway governs what the model costs.
Guard governs what the agent does.
Provider gateways sit between your team and the LLM. They cap spend, enforce SSO, and log model requests. That's the right layer for cost control.
Provider gateway
- ✓Caps LLM spend per user
- ✓SSO sign-in
- ✓Model selection controls
- ✗Sees tool calls (Bash, Write, Read)
- ✗Blocks destructive commands before they run
- ✗Detects credential leaks in tool input
- ✗One policy across Claude, Codex, ChatGPT, Cursor, Copilot
- ✗Custody proof audit log
ConductGuard
- ✓Caps LLM spend per user
- ✓SSO sign-in
- ✓Model selection controls
- ✓Sees tool calls (Bash, Write, Read)
- ✓Blocks destructive commands before they run
- ✓Detects credential leaks in tool input
- ✓One policy across Claude, Codex, ChatGPT, Cursor, Copilot
- ✓Custody proof audit log
Use a provider gateway for spend control. Use ConductGuard for everything the model touches after it decides what to do.
Guard is Layer 2. Start at Layer 0.
Team OS
FreeCLAUDE.md, REVIEW.md, and standards files — the quality bar Guard enforces, written down so every agent on your team starts from the same place.
Get the templates →
Spec-Driven Development
Generate a SPEC.md before agents touch code. Guard enforces spec compliance at runtime — blocking actions that diverge from approved architecture.
Generate your spec →
Your team is already using AI agents.
Guard is how you govern them.
One platform. Two problems solved.
Free tier · No infrastructure changes · Works in minutes
Need on-premise or cloud deployment? See deployment options →