Your agents stay in your VPC. Your audit log stays on your disk.
AgentGuard ships as a single container or a Helm chart. The runtime enforcer and the evidence-builder both run entirely inside your perimeter — no outbound calls required, no SaaS dependency at request time. Suitable for ISM-aligned and air-gapped environments.
Single container.
The control-plane and policy engine ship in one image. Mount your policy directory, point your agents at the local socket, and you’re governed. Suitable for staging, single-node prod, or development — with the same enforcement guarantees as the clustered build.
services:
agentguard:
image: ghcr.io/thebotclub/agentguard:0.4
ports:
- "7474:7474" # control plane
- "7475:7475" # event ingest
volumes:
- ./policies:/etc/agentguard/policies:ro
- ./evidence:/var/agentguard/evidence
environment:
AG_LICENSE: ${AG_LICENSE}
AG_ANCHOR: btc
AG_FLEET_ID: bnb-prodKubernetes-native.
The Helm chart deploys a 3-replica control plane, a persistent event-store StatefulSet, and a CronJob that builds the evidence pack on your audit cadence. Compatible with EKS, GKE, AKS, and on-prem k3s / OpenShift.
# Add the chart repo helm repo add agentguard https://charts.agentguard.tech helm repo update # Install helm install agentguard agentguard/agentguard \ --namespace agentguard --create-namespace \ --set license=$AG_LICENSE \ --set anchor=btc \ --set fleetId=bnb-prod \ --set retention.days=365 # Confirm $ kubectl -n agentguard get pods agentguard-control-plane-0 1/1 Running agentguard-control-plane-1 1/1 Running agentguard-control-plane-2 1/1 Running agentguard-store-0 1/1 Running
Air-gapped, ISM-aligned, or VPC-only?
That’s the Enterprise tier. Talk to us — we’ll walk you through the install in your environment.