Govern your AI agents at the request layer
Tiresias-ZT is a self-hosted proxy that sits in front of your agents' memory and MCP backends. Here is what integrating it looks like.
Quickstart
The shape of an integration. Examples are illustrative — design partners get the current reference during onboarding.
// Point your agent's MCP client at the Tiresias proxy
// instead of the backend directly. (Illustrative -
// design partners get the current reference.)
{
"mcpServers": {
"memory": {
"url": "https://tiresias.your-infra.internal/mcp",
"headers": { "Authorization": "Bearer <capability-token>" }
}
}
}Operator API
Plain HTTP against your own proxy instance — govern, audit, and verify from any language.
- ✓ Deterministic decisions with explicit deny reasons
- ✓ SoulKey-signed audit entries you can verify yourself
- ✓ Quarantine review and release
- ✓ Metering and budget status
- ✓ Runs against your instance - no vendor callout
import requests
# Operator API: read the SoulKey-signed audit trail
# (illustrative - full reference for design partners)
resp = requests.get(
"https://tiresias.your-infra.internal/audit",
headers={"Authorization": "Bearer <operator-token>"},
params={"decision": "deny", "hours": 24},
)
for entry in resp.json()["entries"]:
print(entry["agent"], entry["action"], entry["deny_reason"])
assert entry["signature_valid"] # Ed25519 + ML-DSA hybridAPI Surface
Seven domains, RESTful and JSON-native. The full interactive reference ships to design partners during onboarding.
Identity
- Agent identities (SoulKeys)
- Capability tokens
Policy
- Deny-by-default evaluation
- Monitor-first rollout
Admin
- Tenants & RBAC
- Key lifecycle
- OIDC SSO
Detection
- Behavioral baselines
- Anomaly review
Enforcement
- Quarantine / release
- Injection screening
Audit
- Signed audit log
- Signature verification
Metering
- Usage metering
- Budget governor
Operator Tasks
Everything you manage from the terminal or the portal — key lifecycle to audit verification.
issue a SoulKey
Provision a cryptographic identity for a new agent
rotate a key
Rotate credentials without downtime
suspend a key
Temporarily cut off an agent's access
revoke a key
Permanently revoke an identity
validate policy
Check policy files before rollout
monitor mode
Run policies observe-only before enforcing
review anomalies
Triage SoulWatch detections
release quarantine
Restore a quarantined agent after review
verify audit
Check SoulKey signatures on the audit trail
check budgets
Inspect metering and governor status
system status
Health of the proxy and its upstream
export audit
Pull signed evidence for your SOC
Integration Guides
Step-by-step guides for your stack.
MCP Clients
MCP-native: point your client at the proxy — your agent code doesn't change.
Memory Backends
Bring your own backend — the proxy fronts the store you already run.
REST API
Direct HTTP integration for any language or framework.
Docker
Container-first deployment inside your own infrastructure.
Policy-as-Code
Version policies with your code and validate them in your pipeline.
Ready to start building?
Tiresias-ZT is in private beta. Request a design-partner slot and get a direct line to the engineering team.
Request Access