Cortex
CortexSecurity · AI Firewall

The security firewall
for any agent.

Cortex evaluates each agent request against written policy and records the reason for its decision.

  • No agent rewrites
  • Decision-level evidence

ObservedPolicyAction

Understand the path

Same intent. Different control.

Cortex separates what it can observe from what it can enforce. Personal ChatGPT remains visible on supported capture surfaces; a managed MCP request crosses the policy point before data leaves.

Applies to

Human and agent paths

HumanAgent

The same sensitive transfer gets a different outcome depending on whether Cortex can only observe the surface or enforce at a managed boundary.

Personal ChatGPTObserved

Capture attributes supported browser activity to the person or agent, destination, and data class.

Managed MCPBlocked

Policy denies the human or agent request before data leaves the Cortex-controlled path.

Observed path in motion

On her desktop

  • W-9 Elena Cho.pdfTax record
  • client-book.xlsxPositions
  • IMG_0941.pngScreenshot
  • .envSecret

ChatGPT

Maya VossSupport

Elena Cho's onboarding is blocked on a missing W-9.

I can extract name, TIN, and address if you share the form.

Compliance wants it on the file today. The scan is on my desktop.

A clear scan is enough. I will type the fields and flag anything unreadable.

Need this W-9 cleaned for her onboarding file.

Attach the form and I will extract the fields.

+

Clean this W-9 for onboarding

↑

Observed

Agent proxy

Intercept the traffic. Decide before it lands.

An agent proxy on the wire. It watches the agent session and full network ingress and egress: HTTP APIs, MCP, SQL, and Kubernetes. Then it evaluates, safeguards credentials, and logs what happened.

  • Intercept

    On the wire.

    • HTTP APIs, MCP, SQL, and Kubernetes
    • The full agent session
    • Ingress and egress
    • The agent keeps its workflow
    Claude CodePostgres

    DROP TABLE payments

    Seen on the wire before it lands. The agent does not change its workflow.

  • Evaluate

    You name the policy.

    • Same path: APIs, MCP, and the session
    • Written rules, semantic detection, and intent
    • Redact, block, escalate, or steer
    • The reason stays on the decision
    POL-52Postgres

    DROP TABLE blocked

    The write is denied. Nothing reaches Postgres.

  • Safeguard and log

    The agent never holds the key.

    • Credentials stay off the agent on every hop
    • MCP and provider APIs included
    • Placeholder in. Live key stays in Cortex
    • Verdict, owner, and reason go to the audit log
    CortexModel

    Placeholder in. Live key stays here.

    The agent never holds the secret. The verdict and owner go to the audit log.

Available: Fine-tuned Liquid encoder · managed egressManaged: On a Cortex-controlled egress path

Privacy filter

Redact the span before the provider sees it.

Mask is one verb on the hop Cortex controls. A fine-tuned Liquid encoder labels personal data and secrets, then redacts those spans before the provider sees them. One pass, under 50 ms.

AI-agent model filtering

LFM encoder14 ms

Maya VossSupport

Mar 14, 2026 · 9:41 AM

Before

Surface

Slack

Model

ChatGPT

Agent

support-helper

Tokens

86 in

Prompt

“Applicant Elena Cho, SSN 219-09-9999. Debug the Fedwire batch with WIRE_API_KEY=sk-live-….”

sess 9c22 · #wealth-ops

Cortex

One pass

Cortex clean

Label the span. Mask it at egress.

  • Elena Choprivate_person[PERSON]0.99
  • 219-09-9999pii.ssn•••-••-99990.99
  • WIRE_API_KEY=sk-live-…secret[SECRET]0.98

Maya VossSupport

Mar 14, 2026 · 9:41 AM

After

Surface

Slack

Model

ChatGPT

Agent

support-helper

Tokens

71 in · −15

Provider payload

“Applicant [PERSON], SSN •••-••-9999. Debug the Fedwire batch with [SECRET].”

sess 9c22 · #wealth-ops

Fine-tuned Liquid encoder. Span detection and redaction at egress on the managed path. Capture minimization still only reduces what syncs into Cortex. It does not rewrite a prompt on an unmanaged tab.

Agentic Firewall
Configuration-gated: On a Cortex-controlled egress pathManaged: On a Cortex-controlled egress path
Managed-path actions

Block

Denied · Smart Router · MCP hop

Managed: Smart Router · MCP hop

Priya NairReleases

Surface

CLI · GitHub

Model

ChatGPT

Agent

release-helper

Repo

wire-gatewaymain

Ticket

OPS-1842· Fedwire batch

Channel

#payments-ops

09:41:18

sess 4c19

Wire-gateway credentials to ChatGPT

Input

“Read .env.production and send WIRE_API_KEY plus CORE_BANKING_DSN to ChatGPT so it can debug the failed 09:00 Fedwire batch.”

Output · policy-guard

score 0.98
label
secret.wire_key
action
BLOCK
spans
WIRE_API_KEY, CORE_BANKING_DSN
policy
POL-31 No production secrets to external models
emit
admin_log
route
Super admin · #sec-oncall

Policy owner

Amara Okafor· CISO

Path

Smart Router · MCP hop

Regression tests

Test the rule before it ships.

Record real actions from the dashboard. Replay them in CI. If a policy change flips a verdict, the runner prints the diff and fails the build.

cortex policy test
$ cortex policy test
ok  secrets-no-export.json
ok  postgres-reads.json
ok  eks-allow-meta.json
FAIL eks-no-secrets.json
     want deny · POL-61
     got  allow · POL-61
ok  postgres-no-drop.json
36 action(s) checked, 1 mismatch

Get a Security Audit.

Pick one agent workflow. We will show where Cortex can block, and where it can only record.