Get Free API Key

Secure Enterprise Agent Control Plane

Bring your AI agents.
We provide the control plane.

Stop the Confused Deputy: validate where tool commands come from mid-loop, sever access with one switch, and keep the audit trail that survives the incident.

Get Free API Key Documentation

Kimss AI — Secure Enterprise Agent Control Plane: registry, gateway, identity, audit, and agents

what kimss is

The control plane, in one paragraph

Bottom line: Kimss AI is the Secure Enterprise Agent Control Plane — a model-agnostic gateway in front of your vaulted providers. It registers agents, binds identity, enforces an Authority Boundary against the Confused Deputy (OWASP ASI03), meters governed requests, and keeps gateway-verified audit. It does not host models and is not Kimi (Moonshot AI).

Secure Enterprise Agent Control Plane
Product layer for registry, SSO/RBAC, kill switch, governed-request metering, and audit above customer-owned inference.
Authority Boundary
Validates the origin of tool arguments mid-loop and blocks disallowed actions before execution — beyond caller authentication that basic gateways stop at. See OWASP ASI03 deep dive.
Invisible Proxy
OpenAI-compatible https://api.kimss.ai/v1 and Anthropic listeners that accept a Kimss Gateway key and forward to Provider Vault endpoints.
Agent Discovery + kill switch
Gateway-routed traffic becomes inventory; a disabled agent is refused at the edge while the audit trail remains.

basic gateway vs kimss

ConcernBasic gatewayKimss
Caller authYesYes
Tool-argument provenanceNoAuthority Boundary mid-loop
Stop dangerous actions in-processEdge onlyKill switch + intercept before tool fires
Pricing meterOften per-token / custom quotePublished governed requests

developer hub

Start building

Quickstart guide

Add governance to your app

Route agent traffic through the control plane. Identity-tied keys, spend caps, and logged calls from day one.

Quickstart

Secure agents with guardrails

Tool-level authorization at the gateway. Content safety, kill switch, and Threat Intercepts when traffic is blocked.

Guardrails docs

Build with your coding agent

Paste one prompt into Cascade, Cursor, or Claude Code. The agent fetches the public control-plane contract and rewires this repo. New Python agents start from Kimss Forge.

Route your traffic

integrations

Works with your stack

Model-agnostic control plane. Keep the OpenAI or Anthropic client you already ship, or start from Kimss Forge. Coding agents onboard from the public control-plane contract.

See all docs
Control plane Kimss Forge (OSS) Forge on GitHub Guardrails REST API Internal MCP Cursor Claude Code Azure Foundry OpenAI GitHub Actions

control plane

Three pillars. No soft promises.

01

Centralized Registry & Governance

Register externally built agents and map each one to a human Entra identity. Provision the fleet with SCIM.

02

Authoritative Execution Guardrails

Tool-level authorization at the gateway. Flip one switch and Kimss severs the agent’s access for routed traffic.

03

Immutable Audit Trails

Append-only telemetry and audit records for governed requests. Optional APIM GatewayLogs into Log Analytics when the compliance gateway path is enabled.

product

The control plane you actually open every day

Not a slide deck — the same Vault, Agents, and Gateway views your team uses after signup. Identity-tied keys, spend caps, and logged calls in one shell.

Open the workspace
  • BYO models (vaulted)
  • Logged API calls
  • Governed-request caps
  • Identity-tied keys

architecture

Separate AI intelligence from the body that executes it

Stateless LLM providers stay yours. Memory, tools, and security run through Kimss — identity, guardrails, and audit in the gap.

The Brain

Your keys. Your tenancy.

  • Azure OpenAI
  • OpenAI
  • Anthropic
  • Any OpenAI-compatible endpoint
Kimss Identity Kill Audit

The Body

Execution you can govern.

  • Registered agents
  • Memory & checkpoints
  • Tools & MCP
  • Runtime authorization

security

You hold the keys. We enforce the rules.

Kimss is a control plane, not a second model vendor. Provider credentials stay yours. The proxy meters the hop without archiving proprietary text.

  • Key Vault envelope encryption. BYO API keys are AES-GCM sealed with a per-secret DEK, then wrapped RSA-OAEP-256 by Azure Key Vault. The API is client-write-only.
  • No default prompt retention. The proxy records correlation IDs, identity claims, and token counts — not full request/response bodies in the telemetry pipeline.
Read the Trust Center

compliance

Built for regulated industries

Microsoft Entra SSO SCIM 2.0 APIM GatewayLogs Retention controls Article 12–oriented

Gateway-verified records

When APIM gateway mode is enabled, diagnostics feed Log Analytics for gateway-level records alongside app-side telemetry.

Your providers, your regions

Inference stays on the vaulted endpoints you registered (OpenAI-compatible or native Anthropic). First use: vault a model, create an agent, then POST /v1/agents/run with an API key. Kimss does not host or relocate your models.

Identity-bound agents

Human access via Entra ID. Agents map to people. The kill switch severs gateway access.

pricing

Unlimited workspace members. Priced on governed requests.

Priced per governed request — not per model token, no hidden enterprise quote for standard tiers. Inference on your vaulted endpoints remains your provider bill.

Meter what the control plane governs — register, report, and routed calls.

  • Is a governed request: register, report, and gateway-routed calls the control plane governs.
  • Is not: your provider’s model-token invoice, seat licenses, or an unpublished enterprise quote for Developer / Production / Scale.
DeveloperFree · 25k Production$49 · 100k Scale$199 · 1M EnterpriseCustom

Ship governed agents today

Get Free API Key Documentation

Free tier includes 25,000 governed requests/month. No credit card required.