Add-ons and included features.

SixWays Pulse

Expected behavior for each supported agent.

Pulse adds behavioral profiles to the endpoint: how each agent normally behaves across filesystem, process, network, MCP, and permission activity, plus noise baselines that cut false-positive alerts.

Signed profiles come from a subscription feed that covers 19 agents and is updated for each new agent release; the endpoint reloads them without a restart. Pulse is part of Pro, with a license key and no server, and bundled with Team and Enterprise.

SixWays AppSec

Catch what the agent introduces, before the commit leaves the sandbox.

AppSec runs dependency scanning (Trivy and OSV-Scanner), static analysis and IaC checks (Opengrep), secrets detection (Betterleaks), and supply-chain checks (GuardDog) in an offline scan sidecar while the agent works. Findings are attributed to the agent and the turn that caused them.

Reachability checks cut noise: call-graph analysis for Go, direct-versus-transitive analysis for other ecosystems. Enforcement options are quarantine, pre-launch blocking, a commit gate, and a push gate. One click sends the fix back to the agent in a CLI sandbox, or copies it for a dev-container session.

SixWays Arsenal

Adversarial test cases for the models you depend on.

Arsenal is an LLM safety evaluation framework: versioned feeds of adversarial test cases mapped to MITRE ATLAS and the OWASP LLM Top 10, spanning direct chat, multi-turn, RAG poisoning, agent tool use, and multimodal attacks.

It evaluates safety classifiers (Qwen3Guard, LlamaGuard, ShieldGemma) and generative models alike, and the same corpus is compiled into the Firewall’s detection rules. The CLI and sample cases are free; the full feed with quarterly releases is Arsenal Pro, bundled org-wide at Enterprise.

MicroVM isolation

A hardware boundary per agent.

When a container is not enough isolation, each agent gets its own hardware-virtualized guest with in-guest enforcement. Required mode runs on libkrun, on macOS and on Linux KVM.

Same policy, same launch flow: SixWays selects the microVM when your license and policy require it. Included in Pro, Team, and Enterprise.

Process sandbox

Host-level containment without a container.

For workflows that cannot move into a container, the process sandbox confines agents with OS-native mechanisms: Seatbelt with a kernel-enforced deny-default baseline on macOS, network namespaces with Bubblewrap mount isolation on Linux, and Microsoft’s process container on Windows 11. A launch the sandbox cannot confine is refused rather than run unsandboxed.

Every baseline blocks access to SSH, GPG, cloud, and browser credential stores. Free for local use; enforcing it across an organization from the Server is part of Team and Enterprise.

Git governance

Trace and reverse changes made by an agent.

Signed provenance checkpoints tie every change to the agent session that made it: sw why shows which session wrote a line, and sw restore undoes a whole session from a shadow snapshot repo.

A git broker controls pushes: fetch is open, every push is checked against policy, force-pushes and protected branches are refused, and remotes are allowlisted. Separate machine and human keys keep agent commits distinguishable. Included with Team and Enterprise; Pro includes local sw restore.

MCP governance & Trusted MCP Catalog

Every tool call, evaluated before it runs.

The daemon governs MCP traffic: each tool call passes policy evaluation, risk scoring, and lateral-movement rules, with human approval holds where you want them, and every decision is recorded as evidence. In-sandbox servers are proxied; shared upstream servers run once on the host and tunnel per-agent sessions. Runtime governance needs no license key and is switched on by policy.

The paid part is the Trusted MCP Catalog, a curated, signed, recallable feed of vetted MCP servers, included in Pro, Team, and Enterprise. Pro gets it from SixWays Cloud; Team and Enterprise get it through the Server.

Zero-trust mesh

Private connectivity without a VPN rollout.

SixWays binaries can join a private WireGuard mesh with mutual authentication at the network layer: no host VPN install, no inbound firewall rules, and a self-hosted control plane with no third-party SaaS. Policy, telemetry, and secrets traffic go through the tunnel automatically.

Cloud Sandbox

Agent execution off the laptop, into your tenant.

Cloud Sandbox moves agent execution into your own cloud account, on a hardened Docker host, NVIDIA OpenShell, or OpenSandbox, for teams with a connected Server. You own the data plane and run the pods; SixWays handles orchestration, governance, and audit.