# SixWays Server

> Centralized policy with restrictive merge, fleet telemetry, encrypted secrets delivery, and automated red teaming. SaaS tenant or self-hosted.

Source: https://sixways.ai/server/

## One console for every agent in the org.

The Server manages endpoints as a fleet: it distributes policy, collects telemetry, and keeps provider secrets off laptops. Run it as a dedicated tenant on `app.sixways.ai` or self-host it.

[Get early access](mailto:beta@sixways.ai?subject=Early%20access%3A%20Server)

### Fleet policy that lower levels can only tighten.

#### Restrictive merge, four levels

Policy is set at org, group, user, and endpoint level. Deny lists union and allow lists intersect, so any level can restrict further and none can undo a restriction from above.

org      deny: \[transfer.sh\]
group    deny: \[pastebin.com\]
user     allow: \[github.com, npmjs.org\]
endpoint allow: \[github.com\]
─────────────────────────────────
merged   deny:  \[transfer.sh, pastebin.com\]
         allow: \[github.com\]

#### Enrollment, heartbeat, push

Endpoints claim a device identity, send heartbeats, and receive policy and container commands pushed from the server. The dashboard flags stale endpoints once the configured interval expires.

#### Telemetry with context

Session events from every endpoint, correlated per agent and per user, with retention you configure by tier.

#### SSO from day one

SAML or OIDC with Google Workspace, Microsoft Entra ID, or Okta on Team. No SSO tax. Enterprise adds SCIM provisioning.

### SixWays Secrets: centralized credential delivery.

Credentials are encrypted at rest.

#### LLM provider keys, gateway-routed

Agents authenticate to the [Firewall](https://sixways.ai/firewall/), and the gateway resolves the real provider key server-side. Plaintext never leaves the gateway and server perimeter, so you rotate a key once instead of on every laptop.

#### Workload credentials, endpoint-injected

Service credentials are injected into the sandbox at launch, scoped to the session, and tracked in a service catalog. Brokers mint short-lived AWS, Google Cloud, and Azure credentials on demand, so the sandbox holds no long-lived cloud keys.

### Approvals and evidence.

Hold risky actions for a person, and keep proof that your controls were enforced.

#### Approvals where you are

A denied change or a held MCP tool call becomes an approval request in the desktop app, the SixWays mobile app, or the Server dashboard. Push notifications carry no content, and the endpoint verifies each device-signed decision.

#### Exactly once

An approval is bound to the exact payload. The approved retry runs once; a changed payload, an expired grant, or a replay is refused.

#### Canary probe receipts

After a policy is applied, a probe inside the sandbox checks what it actually allows and denies, and records a signed receipt.

#### Stale status, clearly marked

When SixWays loses contact with a component, its status is marked stale with the time it was last confirmed. Old protection is never shown as current.

#### Tamper-evident ledger

Lifecycle events go into an append-only ledger, and an offline verifier detects tampering in any export.

#### Compliance and SIEM

Fleet compliance reports map to SOC 2, HIPAA, NIST AI RMF, and ISO 42001 controls. Verifiable evidence export and HMAC-signed webhooks send data to your SIEM.

#### Govern NVIDIA OpenShell too

The Server is the policy authority for OpenShell: it compiles your policy for each gateway, approves governed changes, and collects the evidence. [How SixWays works with OpenShell](https://sixways.ai/openshell/).

### Red teaming, built in.

The Server runs adversarial campaigns against your own models and AI applications.

#### Targets

Register raw LLM endpoints or full AI applications as targets, with credentials handled by the same secrets service used for agent credentials.

#### Blast Mode and Surgical Mode

Sweep broadly across attack categories, or target one concern precisely. Campaigns run on demand or on a schedule, with a cost estimate up front. A judge model grades Arsenal campaigns against AI applications.

#### The tools you already trust

Executors for SixWays Arsenal, Promptfoo, DeepTeam, PyRIT, Garak, and Giskard, with results normalized into one report.

### Get early access.

Tell us about your agents and your team, and we will set you up.

[Get early access](mailto:beta@sixways.ai?subject=Early%20access) [Talk to us](https://sixways.ai/contact/)