Intercis and Trinitite
Trinitite publishes prices for more of its plans than we do, and publishes a compliance block we cannot match.
| Intercis | Trinitite, from their own pagesRead 12 September 2026: trinitite.ai, trinitite.ai/platform/, trinitite.ai/developers/, trinitite.ai/pricing/, trinitite.ai/security/. | |
|---|---|---|
| In-path proxy or SDK | In-path proxy, out of your process. Your base URL points at us and the agent's code does not change. We govern Anthropic's POST /v1/messages and OpenAI's POST /v1/responses and POST /v1/chat/completions. |
"Five ways in. One control plane." (trinitite.ai/developers/) The five that page lists are an SDK, a proxy, MCP, a CLI and your network. |
| What happens to a denied action | The tool_use block is taken out of the model's response and one text block naming the policy takes its place, so the agent runtime has no tool call to run. |
"A model call, a tool, a command, or network traffic all hand you the same result: a verdict, a plain reason, the fix it made, and the rule it followed." The FAQ on that same page lists five answers: "allow it, fix it, mask it, block it, or ask a human". (trinitite.ai/developers/) |
| What the buyer sees per event | One row per governed tool call: the agent, the tool name, a short excerpt of the target, the verdict, the policy, the wire route, a command fingerprint and the structured tool input. Rows are hash-chained per tenant by a database trigger. | trinitite.ai/security/ carries sections headed Cryptographic Integrity and Immutability, describing a Merkle-chained tamper-evident audit trail and WORM logs. What one event record holds, their pages we read do not say. |
| Published pricing | Yes. $200 a month for the first agent and $190 for each additional agent, on the pilot page. | Yes, and for more plans than we publish. trinitite.ai/pricing/ lists credit packs at $10, $25, $50 and $100 with 1 cent to a credit, and Emu desktop at $0, $14 and $35 a seat. Enterprise is contact sales. |
| Certification | No. Intercis is not SOC 2 certified and no audit is underway. | Their compliance block reads SOC 2 Type II "Controls Implemented", GDPR "Compliant", HIPAA "Compliant", FedRAMP "Aligned". Whether a report exists, and who signed it, is the question to put to them. (trinitite.ai/security/) |
| Self-hosted | No, hosted only today; self-host licensing is undecided. | Yes. trinitite.ai has a section headed "Runs where you need it to." whose first card is "Self-hosted". |
What we do to a denied call, and the five costs
When policy denies a tool call, the proxy does not hand a verdict back to your code: it
replaces the provider's response. The model's tool_use block is gone, one
assistant text block naming the policy is in its place, and stop_reason is
end_turn, so the agent runtime has nothing to execute. That is
_make_blocked_response in apps/proxy/main.py, read at commit
87ccd47 on 12 September 2026.
Being in-path is a setting, not a law
Your base URL points at us and a compromised process can point somewhere else, so the control holds only if you also stop the agent reaching the provider directly.
Only the provider API wire is visible
We read tool calls that cross the Anthropic and OpenAI API wire, and a hosted MCP call
never crosses it: we ran one, and a response body carrying mcp_call and
mcp_list_tools items yields no tool call to judge and no audit row.
Streaming is buffered before anything is judged
The proxy collects a streamed response in full before judging it, so your agent waits the length of the stream, and nothing in the repository measures that delay.
We are a new place your prompts pass through
Your prompts and tool inputs cross our proxy in plaintext, the classifier call goes out on an Intercis credential carrying the tool name and the full tool input, and how a self-hosted deployment would be licensed is not decided.
The provider routes are ours to maintain
We speak Anthropic's messages route and OpenAI's responses and chat-completions routes, and another provider is engineering work on our side.