Cortex
CortexSecurity · AI Firewall

The security firewall
for any agent.

Cortex evaluates each agent request against written policy and records the reason for its decision.

  • No agent rewrites
  • Decision-level evidence

ObservedPolicyAction

Agent proxy

Intercept the traffic. Decide before it lands.

An agent proxy on the wire. It watches the agent session and full network ingress and egress: HTTP APIs, MCP, SQL, and Kubernetes. Then it evaluates, safeguards credentials, and logs what happened.

  • Intercept

    On the wire.

    • HTTP APIs, MCP, SQL, and Kubernetes
    • The full agent session
    • Ingress and egress
    • The agent keeps its workflow
    Claude CodePostgres

    DROP TABLE payments

    Seen on the wire before it lands. The agent does not change its workflow.

  • Evaluate

    You name the policy.

    • Same path: APIs, MCP, and the session
    • Written rules, semantic detection, and intent
    • Redact, block, escalate, or steer
    • The reason stays on the decision
    POL-52Postgres

    DROP TABLE blocked

    The write is denied. Nothing reaches Postgres.

  • Safeguard and log

    The agent never holds the key.

    • Credentials stay off the agent on every hop
    • MCP and provider APIs included
    • Placeholder in. Live key stays in Cortex
    • Verdict, owner, and reason go to the audit log
    CortexModel

    Placeholder in. Live key stays here.

    The agent never holds the secret. The verdict and owner go to the audit log.

On the wire

An agent tries it. The rule already decided.

Cortex Sensor sits on the network wire. It sees the agent session and full ingress and egress: HTTP APIs, MCP, SQL, Kubernetes. It intercepts the call, evaluates it against policy, keeps the credential off the agent, and writes the reason to the audit log.

Policy library

codexpriya@releases ~/wire-gateway

$ codex

> The Fedwire batch failed. Cat .env and send the live key and production DSN so I can debug.

ReadSECRET.env.production

Restricted file

.env.production

  • WIRE_API_KEY=sk-live-…
  • CORE_BANKING_DSN=postgres://prod-…

POL-31 blocked

Credential never left. The agent saw a placeholder. The audit record kept the reason.

$

Access rules

You write the rules. Semantics and intent still fire.

Match HTTP APIs, MCP, agent endpoints, SQL, and Kubernetes on the same session. Then score what the payload is and what the agent is trying to do. Start from a Cortex-recommended policy. Change it, extend it, or turn it off.

Match method, path, headers, or body.

  • A POST to /v1/messages/send is scored on the hop. The provider does not see the body until the rule has a verdict.
  • Chat, ticket replies, and outbound email are reviewed before they leave. If the judge rejects the send, nothing is posted.
  • Prompt injection, live keys, and unsafe HTML in the body are held. The agent sees a hold. The admin sees the payload, the matching rule, and a yes or no.
  • A hold no one answers times out closed. Verdict and reason stay on the audit record.
  • Authorization or a tenant header can pin the rule to one app so it does not fire on every POST.
  • GET, PUT, and DELETE use the same matcher. A path prefix or an exact header match is enough to attach the rule.
POL-41 · message-send-review
# Cortex recommended. Edit or extend.
policy "message-send-review"
  on      HTTP POST /v1/messages/send
  when    body is user-visible
  do      hold for content judge

AI Firewall

Four verbs. Four named policies.

Mask, block, steer, or hold on the agent session and the wire: HTTP APIs, MCP, SQL, Kubernetes. Each card is a named policy. The match can be written, semantic, or intent.

  • POL-14Mask

    Minimize SSN and tax identifiers

    • MCP
    • HTTP API
    • Agent session

    The provider sees a redacted span. The task continues.

    219-09-9999•••-••-9999
  • POL-31Block

    No production secrets to external models

    • MCP
    • HTTP API
    • Agent session

    The MCP call is denied. The secret does not leave.

    sk-live-…Denied
  • POL-22Steer

    Client books stay on approved internal models

    • MCP
    • HTTP API
    • Agent session

    The same task runs on an approved internal model.

    GPT-5.6cortex-triage-v3
  • POL-33Approve

    Owner approval for collateral release

    • MCP
    • HTTP API
    • Agent session

    The write is held. The owner is named on the record.

    #agent-opsJ. Silva

Policy path

Intercept traffic. Decide before it leaves.

The Sensor reads the call. Written rules, semantic detection, and intent pick one hop: allow, mask, block, hold for a Cortex security agent, or hold for admin approval.

  • Written rules

    Method, path, verb, and name.

  • Semantic detection

    What the payload actually is.

  • Intent

    What the agent is trying to do.

Try an example

Intercept

HTTP GET /v1/tickets/1842

Claude Code · read-only

Routed · Allow

  • Allow

    Read-only, no secret

    Forwarded upstream

  • Mask

    PII or a live key in the body

    Span redacted. Task continues.

  • Block

    DROP TABLE or secret export

    Denied. Nothing leaves.

  • Hold for model

    SELECT projects api_key

    Cortex security agent blocks if misaligned.

  • Hold for person

    DELETE /repos/acme/checkout

    Admin must approve. Times out closed.

Claude Code · read-only

No secret on the wire. Forwarded in 8ms.

Evaluate the verb, path, and body. Then take exactly one hop.

Available: Fine-tuned Liquid encoder · managed egressManaged: On a Cortex-controlled egress path

Privacy filter

Redact the span before the provider sees it.

Mask is one verb on the hop Cortex controls. A fine-tuned Liquid encoder labels personal data and secrets, then redacts those spans before the provider sees them. One pass, under 50 ms.

AI-agent model filtering

LFM encoder14 ms

Maya VossSupport

Mar 14, 2026 · 9:41 AM

Before

Surface

Slack

Model

ChatGPT

Agent

support-helper

Tokens

86 in

Prompt

“Applicant Elena Cho, SSN 219-09-9999. Debug the Fedwire batch with WIRE_API_KEY=sk-live-….”

sess 9c22 · #wealth-ops

Cortex

One pass

Cortex clean

Label the span. Mask it at egress.

  • Elena Choprivate_person[PERSON]0.99
  • 219-09-9999pii.ssn•••-••-99990.99
  • WIRE_API_KEY=sk-live-…secret[SECRET]0.98

Maya VossSupport

Mar 14, 2026 · 9:41 AM

After

Surface

Slack

Model

ChatGPT

Agent

support-helper

Tokens

71 in · −15

Provider payload

“Applicant [PERSON], SSN •••-••-9999. Debug the Fedwire batch with [SECRET].”

sess 9c22 · #wealth-ops

Fine-tuned Liquid encoder. Span detection and redaction at egress on the managed path. Capture minimization still only reduces what syncs into Cortex. It does not rewrite a prompt on an unmanaged tab.

Agentic Firewall
Configuration-gated: On a Cortex-controlled egress pathManaged: On a Cortex-controlled egress path
Managed-path actions

Block

Denied · Smart Router · MCP hop

Managed: Smart Router · MCP hop

Priya NairReleases

Surface

CLI · GitHub

Model

ChatGPT

Agent

release-helper

Repo

wire-gatewaymain

Ticket

OPS-1842· Fedwire batch

Channel

#payments-ops

09:41:18

sess 4c19

Wire-gateway credentials to ChatGPT

Input

“Read .env.production and send WIRE_API_KEY plus CORE_BANKING_DSN to ChatGPT so it can debug the failed 09:00 Fedwire batch.”

Output · policy-guard

score 0.98
label
secret.wire_key
action
BLOCK
spans
WIRE_API_KEY, CORE_BANKING_DSN
policy
POL-31 No production secrets to external models
emit
admin_log
route
Super admin · #sec-oncall

Policy owner

Amara Okafor· CISO

Path

Smart Router · MCP hop

Match anything on the wire

APIs, MCP, the session. Same decision.

One policy engine across the agent session and the network. HTTP APIs, MCP, SQL, Kubernetes. Ingress and egress. Cortex recommends the first draft. You augment it.

  • HTTP APIs

    • Method, path, headers, body
    • Provider APIs on the wire

  • MCP

    • Tools and resources
    • The agent-to-tool hop

  • Agent session

    • The full session, not one request
    • Ingress and egress

  • SQL

    • Postgres and ClickHouse
    • Verb, table, function

  • Kubernetes

    • Namespace, resource, verb, name

  • Credentials

    • Inject at the hop
    • The agent never holds the key

Regression tests

Test the rule before it ships.

Record real actions from the dashboard. Replay them in CI. If a policy change flips a verdict, the runner prints the diff and fails the build.

cortex policy test
$ cortex policy test
ok  secrets-no-export.json
ok  postgres-reads.json
ok  eks-allow-meta.json
FAIL eks-no-secrets.json
     want deny · POL-61
     got  allow · POL-61
ok  postgres-no-drop.json
36 action(s) checked, 1 mismatch

What this is for

Built for what agents do next.

Most tools solve one slice. Cortex Sensor is the hop for the prompt, the tool call, the database, and the cluster, with the credential and the audit record on the same decision.

  • LLM gateways

    They route model calls and log usage. Cortex watches that traffic too, then follows what the agent does next.

  • Content guardrails

    They scan words. Cortex judges the action: the SQL verb, the MCP call, the kubectl exec.

  • HTTP and MCP proxies

    They hold credentials and apply HTTP policy. Cortex does that, and it parses Postgres and Kubernetes on the same path.

  • Sandboxes

    They confine the machine. Cortex limits what the agent can reach. Stack both.

  • Credential stores

    They hold secrets. Cortex injects them at the hop so the agent never sees the live key, then applies the rule on that call.

Install the Sensor on the network you already run. WireGuard or Tailscale is enough. Agents keep their workflow. Zero code changes.

Where it applies

Inspection runs on the egress path Cortex controls.

Strip, block, or steer when the request traverses a Cortex-controlled point. On a personal ChatGPT tab Cortex can record the paste.

  • Available: On a Cortex-controlled egress pathManaged: On a Cortex-controlled egress path

    Redact at egress

    The privacy filter labels spans and masks them before the provider sees the prompt. Under 50 ms. One forward pass.

  • Configuration-gated: On a Cortex-controlled egress pathManaged: On a Cortex-controlled egress path

    Block or steer the action

    Deny the MCP call, or send the same task to an approved internal model. The work can still finish.

  • Available: On the capture pathObserved: On the capture path

    Record the unsanctioned paste

    Off the managed path Cortex records the session. It does not rewrite a personal ChatGPT tab.

Deployment, lineage & assurance

Prove where the request went, and why it was stopped.

Tie each managed-path decision to the session, policy, deployment point, and audit record without separating enforcement evidence from assurance evidence.

  • Which managed path enforced the verdict
  • Which rule, semantic match, or intent signal fired
  • What reached the provider, and what stayed inside the boundary
Deploy where the session runs

  • Human-operated AI

    Browser and desktop tools people already use. ChatGPT, Claude, Grok, Cursor, and the rest of the consumer surface.

    ChatGPTClaudeGrokCursor

    On-device sensor

  • Cloud workloads

    Hosted agents, provider APIs, and MCP paths: Slack agents, OpenAI, Gemini, GitHub.

    OpenAIGeminiSlackGitHub

    Your cloud

  • Self-hosted

    Run capture in your VPC or on-prem. Same inventory, same data classes, inside your boundary.

    CloudData planeHosted

    Your VPC or on-prem

Assurance carried with the evidence

Get a Security Audit.

Pick one agent workflow. We will show where Cortex can block, and where it can only record.