Intercis takes the tool call out of the response.
Six things a security reviewer can check on both sides, for Intercis and for the six products we read in September 2026: five from their own pages, and Microsoft's toolkit from its own repository.
| Intercis | The other product, from its own pages | |
|---|---|---|
| ZenityRead 12 September 2026: zenity.io/platform/runtime-boundaries, zenity.io/platform/mcp-security, zenity.io/company/trust-center, zenity.io/pricing. | ||
| In-path proxy or SDK | In-path proxy. Your base URL points at us; the agent's code does not change. | An MCP gateway you register one URL with. Where Boundaries runs is not on the pages we read. |
| What happens to a denied action | The tool_use block leaves the response; one text block naming the policy takes its place. | Boundaries blocks in real time. What the runtime receives is not on the pages we read. |
| What the buyer sees per event | One row per governed tool call, hash-chained per tenant. | Not on the pages we read. |
| Published pricing | Yes. $200 a month for the first agent, $190 for each additional one. | No. zenity.io/pricing returned 404. |
| Certification | No. Not SOC 2 certified, no audit underway. An evidence-package export is a roadmap item without a date. | Yes. Their trust center listed SOC 2 Type II, ISO 27001, ISO 27701 and GDPR. |
| Self-hosted | No. Hosted only today; self-host licensing is undecided. | Not on the pages we read. |
| WitnessAIRead 12 September 2026: witness.ai, witness.ai/product/, witness.ai/control/, witness.ai/pricing. | ||
| In-path proxy or SDK | In-path proxy. Your base URL points at us; the agent's code does not change. | A diagram placing them between AI clients and the LLMs and agents those clients call. |
| What happens to a denied action | The tool_use block leaves the response; one text block naming the policy takes its place. | They govern agent deployments with enforcement at the tool call and MCP server level. What the caller receives is not on the pages we read. |
| What the buyer sees per event | One row per governed tool call, hash-chained per tenant. | They state that every blocked call generates an audit record with user, agent, tool and rule. |
| Published pricing | Yes. $200 a month for the first agent, $190 for each additional one. | No. witness.ai/pricing returned 404. |
| Certification | No. Not SOC 2 certified, no audit underway. An evidence-package export is a roadmap item without a date. | Yes. Two SOC 2 badges, Type 1 and Type 2, dated 2025, in their footer. |
| Self-hosted | No. Hosted only today; self-host licensing is undecided. | Not on the pages we read; they offer a single-tenant environment with your own key encryption. |
| TrinititeRead 12 September 2026: trinitite.ai, trinitite.ai/platform/, trinitite.ai/developers/, trinitite.ai/pricing/, trinitite.ai/security/. | ||
| In-path proxy or SDK | In-path proxy. Your base URL points at us; the agent's code does not change. | Five ways in: an SDK, a proxy, MCP, a CLI and your network. |
| What happens to a denied action | The tool_use block leaves the response; one text block naming the policy takes its place. | The same result every time: a verdict, a plain reason, the fix it made and the rule it followed. |
| What the buyer sees per event | One row per governed tool call, hash-chained per tenant. | A Merkle-chained tamper-evident audit trail and WORM logs. The record shape is not on the pages we read. |
| Published pricing | Yes. $200 a month for the first agent, $190 for each additional one. | Yes, for more plans than we publish: credit packs at $10, $25, $50 and $100, and Emu desktop at $0, $14 and $35 a seat. |
| Certification | No. Not SOC 2 certified, no audit underway. An evidence-package export is a roadmap item without a date. | A compliance block: SOC 2 Type II "Controls Implemented", GDPR "Compliant", HIPAA "Compliant", FedRAMP "Aligned". |
| Self-hosted | No. Hosted only today; self-host licensing is undecided. | Yes. "Self-hosted" is the first card under "Runs where you need it to." |
| LakeraRead 12 September 2026: lakera.ai, lakera.ai/ai-agent-security, platform.lakera.ai/pricing, trust.lakera.ai. | ||
| In-path proxy or SDK | In-path proxy. Your base URL points at us; the agent's code does not change. | Discovery through runtime enforcement. Whether it sits in the request path is not on the pages we read. |
| What happens to a denied action | The tool_use block leaves the response; one text block naming the policy takes its place. | Not on the pages we read. |
| What the buyer sees per event | One row per governed tool call, hash-chained per tenant. | A Risk Posture dashboard with findings mapped to OWASP LLM and MITRE ATLAS. The record shape is not on the pages we read. |
| Published pricing | Yes. $200 a month for the first agent, $190 for each additional one. | Yes. Community at $0 a month with 10k requests, and Enterprise priced "Let's chat!". |
| Certification | No. Not SOC 2 certified, no audit underway. An evidence-package export is a roadmap item without a date. | Yes. Six badges on trust.lakera.ai, among them SOC 2 Type II and ISO 27001:2022. |
| Self-hosted | No. Hosted only today; self-host licensing is undecided. | Yes. The Enterprise hosting row reads "SaaS or Self-hosted". |
| Protect AIRead 12 September 2026: protectai.com, paloaltonetworks.com/ai-security/prisma-airs, paloaltonetworks.com/ai-security/ai-gateway, paloaltonetworks.com/legal-notices/trust-center. | ||
| In-path proxy or SDK | In-path proxy. Your base URL points at us; the agent's code does not change. | protectai.com returns a 301 to Prisma AIRS, whose FAQ names deployment shapes such as Network Intercept and API Intercept. |
| What happens to a denied action | The tool_use block leaves the response; one text block naming the policy takes its place. | They say they stop unauthorized actions. What the caller receives is not on the pages we read. |
| What the buyer sees per event | One row per governed tool call, hash-chained per tenant. | Not on the pages we read. |
| Published pricing | Yes. $200 a month for the first agent, $190 for each additional one. | No. We found no price on the pages we read. |
| Certification | No. Not SOC 2 certified, no audit underway. An evidence-package export is a roadmap item without a date. | Their trust center names no certification on the page and carries a security-report request button. |
| Self-hosted | No. Hosted only today; self-host licensing is undecided. | Not on the pages we read. |
| Microsoft Agent Governance ToolkitRead 18 September 2026: github.com/microsoft/agent-governance-toolkit at commit 8f1d0e1, MIT licence. | ||
| In-path proxy or SDK | In-path proxy. Your base URL points at us; the agent's code does not change. | A library your agent imports, or a sidecar the application has to call explicitly. |
| What happens to a denied action | The tool_use block leaves the response; one text block naming the policy takes its place. | It returns a verdict and the host carries it out. Their security model puts a compromised host out of scope. |
| What the buyer sees per event | One row per governed tool call, hash-chained per tenant. | An append-only log with cryptographic chaining, recording what the agent attempted rather than whether it succeeded. |
| Published pricing | Yes. $200 a month for the first agent, $190 for each additional one. | Free. MIT licence, installed from five package managers. |
| Certification | No. Not SOC 2 certified, no audit underway. An evidence-package export is a roadmap item without a date. | None named. Their OWASP coverage figure is their own self-assessment, not an audit. |
| Self-hosted | No. Hosted only today; self-host licensing is undecided. | Yes. You run it in your own process, offline or air-gapped. |
| Tools that watchArize, HoneyHive, Langtrace and Maxim. We have not read their pages closely enough to quote them, so this group holds the question, not a claim. | ||
| In-path proxy or SDK | In-path proxy. Your base URL points at us; the agent's code does not change. | Ask whether it sits in the request path or inside your process. |
| What happens to a denied action | The tool_use block leaves the response; one text block naming the policy takes its place. | Ask what your code receives when a call is not allowed. |
| What the buyer sees per event | One row per governed tool call, hash-chained per tenant. | Ask to see one record from a real deployment. |
| Published pricing | Yes. $200 a month for the first agent, $190 for each additional one. | Ask what ten agents cost, in writing. |
| Certification | No. Not SOC 2 certified, no audit underway. An evidence-package export is a roadmap item without a date. | Ask which entity and which product any report covers. |
| Self-hosted | No. Hosted only today; self-host licensing is undecided. | Ask whether you can run it yourself, and on what licence. |
What we do to a denied call, and the five costs
When policy denies a tool call, the proxy does not hand a verdict back to your code: it
replaces the provider's response. The model's tool_use block is gone, one
assistant text block naming the policy is in its place, and stop_reason is
end_turn, so the agent runtime has nothing to execute. That is
_make_blocked_response in apps/proxy/main.py, read at commit
87ccd47 on 12 September 2026.
Being in-path is a setting, not a law
Your base URL points at us and a compromised process can point somewhere else, so the control holds only if you also stop the agent reaching the provider directly.
Only the provider API wire is visible
We judge tool calls that cross the Anthropic and OpenAI API wire. A hosted MCP call has already run by the time the response reaches us, so it is observed, not governed: it writes one observe row and is never judged or blocked.
Streaming is buffered before anything is judged
The proxy collects a streamed response in full before judging it, so your agent waits the length of the stream, and nothing in the repository measures that delay.
We are a new place your prompts pass through
Your prompts and tool inputs cross our proxy in plaintext, the classifier call goes out on an Intercis credential carrying the tool name and the full tool input, and how a self-hosted deployment would be licensed is not decided.
The provider routes are ours to maintain
We speak Anthropic's messages route and OpenAI's responses and chat-completions routes, and another provider is engineering work on our side.