How ready are your agents for a bad day? Get your score

Self-hosted AI agent platform

The platform for running agents in your company. Safely.

Run Claude Code, Codex, or your own on your Kubernetes — with per-agent isolation, credentials the model never sees, and a record of every run.

Or your cluster — one Helm release. Open source · AGPL-3.0

Control
define & grant
@finance-analystclaude-codefinance-team participant
Chat
your team delegates

Dana: Which suppliers drove the Q3 overspend?

@finance-analyst: Four suppliers account for 82% of the variance…

Execution
contained & guarded
isolated container credentials outside✗ pastebin.com denied
Tracing
every step recorded
llm 2.4s postgres_query 312msdenied on record create_chart
Usage
cost lands on a name
Agents
38
Runs today
1,204
Blocked
3
Spend today
$612
The threat model

Prompt injection turns helpful agents into exploits.

Three real incidents — and the layer of the platform that stops each one.

Credential exfilCVE-2026-21516
GitHub Copilot Codespaces

Injected instructions made Copilot read GITHUB_TOKEN from its own environment and emit it through model output.

Stopped by Egress secret injection
Cross-domain readCVE-2025-32711
EchoLeak — Microsoft 365 Copilot

One crafted email made Copilot read across OneDrive, SharePoint, and Teams and exfiltrate the contents. Zero clicks.

Stopped by Isolation
Egress exfilIDEsaster · 30+ CVEs
AI IDEs, schema-validator leak

Agents wrote files referencing attacker-hosted URLs; the editor's validator fetched them, leaking contents in the request.

Stopped by Egress rules
Why teams choose us

Everything you'd otherwise build yourself.

Each of these is a project someone on your team would spend a quarter on. They ship turned on.

Agent AAgent B

Isolation

Every agent gets its own disk, network, and permissions.

api.github.com+ credential*.pastebin.comdenied

Egress rules

Allow, deny, or authenticate.

agentPRIVATE TUNNELYOUR NETWORKpostgres:5432

Private resources

Reach into your network, securely.

agentPOST /repos/agyn/issuesAuthorization: — none —gatewayHOLDS THE KEYPOST /repos/agyn/issuesAuthorization: Bearer sk-live-••••github

Egress secret injection

The agent never has the token.

RUNNING INSTANCES024

Serverless agents

Nothing runs between messages.

agentgateway84.2M tokproviderMETERED · KEYED · TRACED

LLM gateway

Every model call through one place.

Agent runtime
claude-code:latest
claude-code:latest
codex:latest
your-own-image:v2

Claude Code and Codex

Pick a runtime. That's the whole switch.

agents.tf
resource "agyn_agent" "sre" {
  model          = agyn_llm_model.sonnet.id
  environment_id = agyn_environment.build.id
  availability   = "internal"
}

Agents as code

Declared in Terraform, reviewed in a pull request.

The product

One agent on a laptop is a tool.
Forty across your company is infrastructure.

Agyn is that infrastructure — one platform, four surfaces. Two your teams use, two you control with.

See it on your own cluster.

Thirty minutes, your infrastructure, your stack. Or start it on your laptop right now and skip the call.