One console for every agent in the org.
The Server manages endpoints as a fleet: it distributes policy, collects telemetry, and
keeps provider secrets off laptops. Run it as a dedicated tenant on
app.sixways.ai or self-host it.
Fleet policy that lower levels can only tighten.
Restrictive merge, four levels
Policy is set at org, group, user, and endpoint level. Deny lists union and allow lists intersect, so any level can restrict further and none can undo a restriction from above.
org deny: [transfer.sh]
group deny: [pastebin.com]
user allow: [github.com, npmjs.org]
endpoint allow: [github.com]
─────────────────────────────────
merged deny: [transfer.sh, pastebin.com]
allow: [github.com] Enrollment, heartbeat, push
Endpoints claim a device identity, send heartbeats, and receive policy and container commands pushed from the server. The dashboard flags stale endpoints once the configured interval expires.
Telemetry with context
Session events from every endpoint, correlated per agent and per user, with retention you configure by tier.
SSO from day one
SAML or OIDC with Google Workspace, Microsoft Entra ID, or Okta on Team. No SSO tax. Enterprise adds SCIM provisioning.
SixWays Secrets: centralized credential delivery.
Credentials are encrypted at rest.
LLM provider keys, gateway-routed
Agents authenticate to the Firewall, and the gateway resolves the real provider key server-side. Plaintext never leaves the gateway and server perimeter, so you rotate a key once instead of on every laptop.
Workload credentials, endpoint-injected
Service credentials are injected into the sandbox at launch, scoped to the session, and tracked in a service catalog. Brokers mint short-lived AWS, Google Cloud, and Azure credentials on demand, so the sandbox holds no long-lived cloud keys.
Approvals and evidence.
Hold risky actions for a person, and keep proof that your controls were enforced.
Approvals where you are
A denied change or a held MCP tool call becomes an approval request in the desktop app, the SixWays mobile app, or the Server dashboard. Push notifications carry no content, and the endpoint verifies each device-signed decision.
Exactly once
An approval is bound to the exact payload. The approved retry runs once; a changed payload, an expired grant, or a replay is refused.
Canary probe receipts
After a policy is applied, a probe inside the sandbox checks what it actually allows and denies, and records a signed receipt.
Stale status, clearly marked
When SixWays loses contact with a component, its status is marked stale with the time it was last confirmed. Old protection is never shown as current.
Tamper-evident ledger
Lifecycle events go into an append-only ledger, and an offline verifier detects tampering in any export.
Compliance and SIEM
Fleet compliance reports map to SOC 2, HIPAA, NIST AI RMF, and ISO 42001 controls. Verifiable evidence export and HMAC-signed webhooks send data to your SIEM.
Govern NVIDIA OpenShell too
The Server is the policy authority for OpenShell: it compiles your policy for each gateway, approves governed changes, and collects the evidence. How SixWays works with OpenShell.
Red teaming, built in.
The Server runs adversarial campaigns against your own models and AI applications.
Targets
Register raw LLM endpoints or full AI applications as targets, with credentials handled by the same secrets service used for agent credentials.
Blast Mode and Surgical Mode
Sweep broadly across attack categories, or target one concern precisely. Campaigns run on demand or on a schedule, with a cost estimate up front. A judge model grades Arsenal campaigns against AI applications.
The tools you already trust
Executors for SixWays Arsenal, Promptfoo, DeepTeam, PyRIT, Garak, and Giskard, with results normalized into one report.
Get early access.
Tell us about your agents and your team, and we will set you up.