How the pieces fit.
Every SixWays component works on its own. Together they share one policy model, one telemetry stream, and one place to sign in. Adopt them in any order.
The Firewall passes agent traffic to model providers; the Server distributes policy to every machine. The open-source Endpoint works without either component.
Layer by layer.
Endpoint, sandbox, IDE extension
The Endpoint runs agents in hardened Wolfi container images with eBPF monitoring and enforcement sidecars, governed by one YAML policy. The IDE extension attributes activity to the agent that caused it and launches agents into sandboxes from the editor.
The AI Firewall
The Firewall is a reverse proxy between agents and LLM providers. It scans prompts and responses in-flight while responses keep streaming. Provider keys are stored on the gateway, which resolves them so plaintext keys never reach the agent or the laptop.
Server
The Server manages endpoints as a fleet: four-level policy with restrictive merge, heartbeats and telemetry, encrypted secrets delivery, and red teaming for your own LLM applications. Run it as a dedicated SaaS tenant or self-host it.
Cloud and the intel feed
SixWays Cloud issues signed licenses, meters usage, and hosts the customer portal. The intel feed delivers the behavioral profiles that Pulse uses on each endpoint. Pulse is included in Pro, Team, and Enterprise.
Design rules.
Enforcement outside the agent
Prompt-level instructions can be overridden or ignored. SixWays enforces policy at the kernel, the container runtime, and the network edge, outside the agent process.
Local first
The open-source endpoint keeps sessions in local SQLite and contacts SixWays only to check for signed updates. It sends fleet telemetry only when connected to a Server.
Signed everything
Updates, licenses, lifecycle commands, agent profiles, and checkpoints are all signed, so their origin can be verified after they leave the machine they were made on.
Visible enforcement failures
If the enforcement sidecar isn't available, the endpoint reports that your deny lists are inactive. It never reports enforcement as active without the required component.
Get early access.
Tell us about your agents and your team, and we will set you up.