Open sourceSelf-hostedAny model, any framework
The control plane for your AI agents
Quilzo gives every AI agent an identity, a policy, a budget and a signed record, whichever model or sandbox it runs on, and asks a person before the actions that matter. One binary, on your own servers.
returns-editor.jsondeclaration{ "purpose": "Keep the Returns page accurate", "capabilities": ["search_pages", "read_page", "write_page"], "ask_first": ["write_page"], "autonomy": "draft", "budget": { "steps": 25, "tool_calls": 15 } }
returns-editor wants to change the Returns page. It read content somebody else wrote first, so nothing goes ahead until you decide.
The problem
AI agents do what they read. Including what somebody else wrote.
Prompt injection turns reading into acting
Most agent frameworks hand a model your tools and a system prompt asking it to behave. Then it reads a web page, an email or a support ticket, and follows the instructions hidden in it.
Nobody can say what an agent did
Agents call tools, spend money and touch personal data across models and vendors. When something goes wrong, there is no record of who allowed it, what the agent read, or what it sent out.
Rules arrive faster than controls
The EU AI Act, ISO/IEC 42001 and your own security team ask for human oversight, logs and an inventory of every AI system. A prompt is not a control, and a dashboard is not evidence.
How Quilzo solves it
The model never holds the authority. Quilzo does.
-
Declare
Each agent is one reviewable document: its purpose, the tools and content it may use, its budget and its autonomy, answered for by a named person.
-
Enforce
One gate checks every action against the declaration, whether a model, the agent's own program or another vendor's agent decides. A hijacked agent can only do what it declared.
-
Ask
Actions that matter stop for a person, who sees the exact call. A run that holds private data and has read untrusted text cannot send anything out on its own.
-
Prove
Every step lands in a hash-chained log signed with Ed25519 and post-quantum ML-DSA, and every run comes with a receipt anybody can verify.
Measured, not asserted
26/26
prompt-injection attacks from the AgentDojo benchmark refused, assuming the model is already fully hijacked and emitting the attacker's calls word for word. An attack the gate refuses cannot succeed for any model. See the method.
- Tasks done without a person71/97
- Tasks refused outright0
- Third-party dependencies0
- Binaries to run1
What it does
Everything an organisation running agents needs, in one place.
Agents with limits
Declarations, budgets in steps, time and money, earned autonomy, evaluations with planted attacks, and every run kept step by step.
Identity and receipts
Every agent is a principal with a human sponsor and an end date, and every action it takes can be proved later.
Human in the loop
Ask-first actions, an exfiltration breaker, and an approvals inbox showing each call exactly as it will run.
Model gateway
Any OpenAI-compatible model, local or hosted, with fallback, budgets per caller, and personal data masked before it leaves.
MCP gateway
Your MCP servers and REST APIs offered to agents through Quilzo, with pinned tools, per-role access, approvals and every call recorded.
Governed memory
Agents remember per person, with trust tiers; anything learnt from untrusted text waits for a person, and anyone can see or erase what is kept about them.
Chatbots that cite
Retrieval-augmented answers from your own pages, with a source on every sentence and planted instructions screened out.
Compliance evidence
EU AI Act deployer duties, ISO/IEC 42001 Annex A, NIST AI RMF and an AI bill of materials, read from what your agents actually did.
Fleet and shadow AI
A map of every agent, app, tool server and model, who answers for each, and the AI services reached around Quilzo.
Security console
Collect, detect, triage and respond: logs from your identity and cloud tools, findings, cases and vulnerabilities in one queue.
Self-defence
Playbooks that act the moment an attack starts on Quilzo itself, from slowing a source to pausing an agent, and end on their own.
Content platform
The pages and records your agents read and write: immutable content, review, scheduled publishing and instant rollback.
Inside Quilzo
See every agent, every call, every decision.
Why Quilzo
Control that does not depend on the model behaving.
- Limits outside the model
- Rules are enforced in the program, the same way from the browser, the command line, MCP and A2A. A clever prompt cannot talk its way past them.
- Your servers, your data
- Self-hosted from a laptop to a data centre. Prompts, memories and logs stay with you, and it runs fully offline with a local model.
- Any model, any framework
- Works with OpenAI, Anthropic, Ollama and any OpenAI-compatible endpoint, and with agents built in LangChain, CrewAI, Google ADK, Microsoft Agent Framework or the OpenAI Agents SDK.
- A small attack surface
- One static Go binary built only on the standard library: no third-party dependencies to audit, patch or trust.
- Evidence, not screenshots
- Receipts with inclusion proofs against a signed log head, checkable by anybody, so an auditor can verify what happened instead of taking your word for it.
- Open source
- Apache-2.0, so you can read every line that decides what your agents may do, run it anywhere and build on it.
- OpenAI
- Anthropic
- Ollama
- LangChain
- CrewAI
- Google ADK
- Microsoft Agent Framework
- OpenAI Agents SDK
- MCP
- A2A
- Okta
- Microsoft Entra
Get started
Your first governed agent in minutes.
Build it, install the demonstration shop, and run an agent against its declaration. No model needed to start; point it at one when you are ready.
# Go 1.27 or later; nothing else to fetch go build -o quilzo ./cmd/quilzo ./quilzo init ./quilzo demo ./quilzo agent new helper --kind retrieval ./quilzo agent run helper ./quilzo serve --open # the admin, in your browser
Questions
What people ask first.
What is an AI agent control plane?
It is the layer that governs AI agents from outside the model: who each agent is, what it may do, how much it may spend, when it must ask a person, and a record of everything it did. Quilzo is a self-hosted control plane that does this for any model or agent framework.
How does Quilzo stop prompt injection?
It does not rely on the model resisting. Every action an agent takes is checked against its declaration by one gate, actions that matter wait for a person, and a run that has read untrusted text while holding private data cannot send anything out on its own. Against the AgentDojo benchmark, with the model assumed fully hijacked, the gate refused all 26 attacks.
Does it work with my model and my agent framework?
Yes. Quilzo routes to any OpenAI-compatible endpoint, local or hosted, and offers OpenAI- and Anthropic-compatible APIs plus MCP and A2A, so agents built with LangChain, CrewAI, Google ADK, Microsoft Agent Framework or the OpenAI Agents SDK can run through it.
Can it run on my own servers, or offline?
Yes. Quilzo is self-hosted: one binary on Linux, macOS or Windows, or in a container. With a local model such as one served by Ollama, it runs without any connection to the internet.
How does it help with the EU AI Act?
It records human oversight, logs and the inventory of AI systems as they happen, then reads them out as evidence: the EU AI Act's deployer duties, ISO/IEC 42001 Annex A as a statement of applicability, NIST AI RMF and an AI bill of materials in CycloneDX.
Is Quilzo free?
Yes. Quilzo is open source under the Apache License 2.0. You can use it, change it and run it commercially at no cost.