Cortex
CortexThe system of record for AI work

Know what runs
where

Cortex runs locally between your tools and providers. It preserves request and response payloads along the selected route. Pinned traffic passes through unchanged; routing mode may choose another eligible model. Capture is reconstructed on-device, and redacted evidence leaves only when you enable it.

Deployment boundaries

Two paths. Clear boundaries.

Tools use the local relay to reach their real provider. Capture runs alongside that request path, stays local by default, and uploads redacted evidence only when enabled.

Fig. 1: System overview

The relay carries model traffic. Capture runs on a separate channel and never changes the model path.

Provider upstream

Your tools continue to use the provider or gateway you choose.

Cortex Capture API

Receives only redacted evidence you choose to upload. It never sits in the model request path.

Fail-closed

If Cortex cannot validate the real upstream, it refuses the request. No silent fallback.

Request flow

The selected route stays intact.

Cortex preserves request and response payloads through the selected route. Pinned traffic keeps its chosen upstream; routing mode may choose another eligible model. Capture runs in parallel and never blocks the answer.

Fig. 2: Request lifecycle

Cortex sends the request through the selected upstream route. Pinned traffic keeps its provider; routing mode may choose another eligible model. Redacted capture is handled separately and never delays the response.

Data flow

You control what leaves the device.

Secrets are stripped on-device. Your redaction profile controls captured bodies; reconstruction stays local by default, and upload is explicit.

Fig. 5: Egress pipeline

Stripped on device

  • Authorization headers
  • Cookies
  • API-key headers
  • Secret query parameters

Governed by your profile

  • Request bodies
  • Response bodies
  • WebSocket frames
  • Production: explicit allowlists

Stays local by default

  • Semantic reconstruction
  • Turn grouping
  • Prompt / response previews
  • Powers the Inspector
POST /captures/{session}/raw-captures · sample payload
{
  "session": "s_8f3ac1…",
  "events": [{
    "surface": "cli",
    "provider": "anthropic",
    "request": {
      "method": "POST",
      "path": "/v1/messages",
      "headers": { "content-type": "application/json" },
      // stripped on device, before anything is written
      "headers_removed": ["authorization", "x-api-key", "cookie"],
      "body": "{ …captured under redaction profile… }"
    },
    "response": { "status": 200, "body": "{ … }" }
  }]
}

Enrollment is required before any upload; retention follows your policy.

Operations

Control is reversible.

Cortex is local-first and easy to unwind if it is not right for your environment.

Fail-closed credentials

Cortex refuses a request if it cannot validate the real upstream. Credentials never go to a guessed destination.

Fully reversible

Restore base URLs, disable the PAC, remove the CA, and stop the sidecar. Your original setup returns.

Local-first

Capture and the Inspector remain on-device, even when upload is disabled.

See the architecture on your own stack.

Bring a real request. We will trace its path, show what stays local, and explain the controls that fit your environment.