Orchestration
for the Agentic Era
Stop running "leaky" Python scripts. AEGIS is a self-hosted orchestrator that runs autonomous agents in isolated, policy-enforced runtimes with durable FSM state.
curl -fsSL https://get.100monkeys.ai | bashFive products, to put to work
Three are hosted services: Grill My Idea, Carbon SCM and Your Zaru. Two are open source: Zaru CLI, a terminal coding agent, and AEGIS, the workflow engine Your Zaru runs on.
AEGIS
The runtime for autonomous agents that engineering teams run themselves: isolated runtimes, deny-by-default policy, signed tool calls and durable state. Your Zaru runs on it.
Open source, AGPL-3.0. Beta.
Carbon SCM
A source control system for AI development at any scale: a commit is an MCP call that lands one atomic, sealed changeset, and lanes and cuts replace branches and tags.
Public workspaces free. Pro from $12 a month.
Your Zaru
A personal AI companion that works alongside you, remembers you and shows its work.
Free plan. Pro from $29 a month.
Zaru CLI
A terminal coding agent that keeps its execution loop in view, with a transcript pane and a permission prompt before its tools act.
Free and open source, Apache-2.0. Pre-alpha: build from source.
Grill My Idea
Market research for a startup idea, before you build it
Type an idea and get back a Confidence Score from 0 to 100, the competitors already selling it and the reasons the score dropped. The first verdict needs no account.
Rare verdict free. Medium $29, Well Done $99, one-time.
Code EARLYBIRD makes the first full report free.
- GRILLEDIdeas grilled
- 111
- SERVEDVerdicts served
- 106
- SOURCESSources read
- 1,158
- MARKSTrademarks checked
- 196
- PATENTSPatents checked
- 149
The platform for agents in production
AEGIS bounds what an agent can do at the infrastructure layer rather than in the prompt. The membrane comes first, then the lifecycle in six parts, then the governance model and the primitives.
UNTRUSTEDAGENTNo Root AccessEliminate the
Blast Radius
Standard agent frameworks run LLM-generated code directly in your environment. AEGIS enforces a Semipermeable Membrane. Every system call is an RPC. Every file operation is proxied.
Network Gating
Agents have zero default egress. Network policies are enforced at the container layer, not the application layer.
AegisFSAL Storage
A user-space NFSv3 gateway intercepts all POSIX calls. No direct mount = no path traversal.
Credential Blindness
The orchestrator resolves secrets from OpenBao JIT. The agent never sees the API key it's using.
Semantic Judges
Pre-execution tool validation via secondary agents. Reject dangerous intents before the container even boots.
Six parts of one lifecycle
Stimulus-to-Artifact
The Lifecycle of a Mixed-Mode Autonomous Workflow
Webhook Security
Native HMAC-SHA256 verification for GitHub, GitLab, and Stripe. Incoming payloads are ingested directly into the stimulus buffer.
Hybrid Pipeline
Deterministic route matching for known signals, falling back to a RouterAgent for natural language classification of ambiguous intents.
100monkeys Loop
Probabilistic agent execution with iterative refinement. The orchestrator injects validation errors back into the prompt until exit criteria are met.
Deterministic Build
Switch to a ContainerRun state. Deterministic execution of compiler/test suites in isolated environments using shared AegisFSAL volumes.
image: rust:1.75-alpine
Consensus Audit
Parallel judge agents review artifacts. Enforce weighted consensus strategies or human-in-the-loop approval before final deployment.
Zero-Trust Deploy
Just-in-time secret resolution via OpenBao. Artifacts are pushed to registries without the agent ever seeing the credentials.
Architected for Governance
| Pillar | Legacy "Leaky" Agents | The AEGIS Standard | SRE Benefit |
|---|---|---|---|
| Process Isolation | Python scripts in local shell | Container-isolated runtimes with POSIX interception | Blast radius containment |
| Tool Security | Direct API access / unverified calls | SEAL Ed25519-signed envelopes | Zero-trust tool routing |
| Storage Access | Direct disk mounts (dangerous) | AegisFSAL User-space NFS proxy | Authorized POSIX operations |
| State Management | In-memory / volatile | Temporal-backed Durable FSMs | Restartable, long-running workflows |
| Secret Resolution | Environment variables (leaky) | OpenBao JIT resolution | Credential blindness |
| Observability | Stdout logs only | OpenTelemetry + Prometheus | Unified system-reasoning traces |
Production-Grade Primitives
Replacing brittle agent scripts with robust, declarative infrastructure components.
Security & Isolation
Container Isolation
Process-level container isolation per execution.
AegisFSAL
User-space NFSv3 proxy with POSIX call interception.
SEAL Envelopes
Ed25519-signed tool calls with Cedar policy gating.
Durable Orchestration
Temporal.io FSM
Fault-tolerant, restartable agent state machines.
Swarm Coordination
Hierarchical parent-child agent lifecycle management.
Just-In-Time Secrets
Credential resolution via OpenBao Transit Engine.
Platform Operations
OTLP Observability
Native OpenTelemetry tracing and structured logging.
Keycloak OIDC
Enterprise identity federation & multi-tenant realms.
Prometheus Metrics
Real-time performance and consumption telemetry.
Compliance & Attestation
Built to satisfy the attestations
AEGIS answers regulated buyers with the artifact their attestations ask for: a signed, chained, non-repudiable record of every change and every execution. The remaining work is the attestation itself, not the engineering.
SOC 2 Type II
The de facto cross-sector bar for US enterprise buyers.
The sealed record is the audit evidence the Type II report requires.
HIPAA + BAA
The legal baseline for hospitals and health data.
Every access to protected data traces to a signed changeset and its execution.
FedRAMP + FIPS 140-3
The federal bar for government workloads.
Ed25519 signing and SEAL envelopes are the cryptographic posture FIPS 140-3 describes.
PCI DSS
In scope where card data flows, and only there.
The record shows where data lives and which execution touched it.
ISO 27001
An important baseline, not an absolute gate.
The audit trail a certification body reads is the native record.
HITRUST CSF
A consolidating bar for healthcare, beyond HIPAA alone.
The same evidence chain serves the CSF controls.
What the sealed record proves
Hash-chained history
Every revision links to its parent. The record is append-only and tamper-evident.
Signed changesets
Every change carries an Ed25519 signature and the execution that made it.
SEAL envelopes
Every tool call is a signed envelope, gated by Cedar policy, traced to its execution.
The honest gaps, stated plainly
- 01Node attribution lives in the orchestrator mapping, not in the record itself.
- 02Out-of-band, non-MCP network calls are not sealed.
Verdict: we got it. The objections are attestation programs, not cryptography. The sealed record is the evidence those programs demand, and the gap that remains is the attestation, not the engineering.
Orchestrate the
Agentic Data Plane
AEGIS is built for production engineering. Container-isolated compute, durable state machines, and a zero-trust tool architecture.
Talk to the architect