A control plane that sits between AI agents and anything real.
Agents never hold credentials or touch systems directly —
they ask the gateway, and the gateway decides.
agent ──▶ org halt ──▶ capability grant ──▶ rate ceiling ──▶ policy ──▶ detection ──▶ execution Six checks run on every action, in order, and none can be skipped. Policy: ordered rules, first match wins, deny by default. Detection: 11 signals scored 0–100. Can only tighten the outcome.
Dashboard auth is an httpOnly cookie no JavaScript can read. API keys are HMAC'd with a pepper the database never contains. Agents exchange a key for a 15-minute session-bound token.
Org halt, capability grant, rate ceiling, policy, detection, execution. Every action passes through all six. A denial at any stage is final. Detection can only make an outcome stricter.
Every action is recorded in a hash-chained, append-only log enforced by database triggers. Periodic Merkle roots are Ed25519-signed and can be published anywhere you don't control.
DNS resolved up front, every address checked. Cloud metadata endpoints blocked. Address pinning closes DNS rebinding. Redirects re-validated at each hop. 5 MB response ceiling.
Novel tools, rate spikes, sensitive content, encoded payloads, exfiltration sequences, new destinations, probing, off-hours use, budget burn, and prompt injection — all scored independently.
Secrets are AES-256-GCM encrypted. The data key is wrapped by a KEK in AWS KMS or HashiCorp Vault. Plaintext exists only in gateway memory, only for one call.
Ordered rules with glob+regex matching. First match wins, deny by default. Dual-control for high-risk operations. Justification requirements.
Per-org sliding window. Org-wide halt switch. Circuit breaker: 3 quarantines in 15 minutes trips the whole org.
Argon2id passwords. TOTP with replay protection. Recovery codes. Lockout after 5 failures.
Real-time dashboard with live gate tape, session monitoring, approval queue, risk histogram, alert feed, and command palette.
Configurable per-policy. High-risk actions need two different operators to approve. Both decisions are in the audit trail.
ISO 27001 SoA (93 controls), CRA Annex I conformity, GDPR Art 15/17/20 handling, SBOM generation. One call exports evidence.
API keys can be bound to a CIDR. Agents can be restricted to an egress allowlist. No implicit access.
Every fetched response is scanned for content addressing an AI system. Flagged responses carry a warning that reaches the agent.
Statement of Applicability covering all 93 Annex A controls. Each mapped to a specific implementation: database triggers, KMS backend, network isolation, audit signing.
Annex I Part I conformity mapping. Part II vulnerability handling with statutory clocks: 24h early warning, 72h notification, 14d final report. Incident table with generated deadlines.
Art 5(1)(e) storage limitation via retention jobs. Art 15/20 subject access export. Art 17 erasure with pseudonymisation that preserves audit integrity. Data request handling with 30-day clock.
These are prepared documents, not certifications. CRA conformity requires assessment. ISO 27001 requires an accredited audit. Around a quarter of Annex A controls are marked operational — yours to run.
One command. Docker Compose brings up the gateway, MySQL, and Caddy.
curl -fsSL https://mona.expert/install.sh | bash
You'll be asked for an admin email, password, and org slug. After the build, the bootstrap API key is shown exactly once. Copy it to a process environment.
Then point an A record at the host so Caddy can issue TLS and set MONA_KEK_BACKEND=aws-kms before production use.
| Method | Path | Description |
|---|---|---|
| POST | /v1/auth/token | Exchange a long-lived API key for a 15-minute session token |
| POST | /v1/auth/login | Dashboard sign-in with password + optional TOTP |
| POST | /v1/auth/logout | Destroy the browser session |
| POST | /v1/actions/request | An agent asks to execute a tool — the gateway decides |
| POST | /v1/actions/{id}/decision | Approve or reject a held action |
| GET | /v1/dashboard/summary | Sessions, pending approvals, alerts, KPIs, compliance clock |
| GET | /v1/dashboard/feed | Recent actions with risk scores and detection signals |
| GET | /v1/dashboard/histogram | Hourly action counts for 24h |
| GET | /v1/policies | All policies for the org |
| GET | /v1/agents | All agents for the org |
| GET | /v1/secrets | Secret names and metadata (never the values) |
| GET | /v1/analytics | 7-day trends, tool usage, per-agent risk breakdown |
| GET | /v1/compliance/export | Evidence pack: SoA, CRA, incidents, vulns, SBOM |
| GET | /v1/compliance/clock | Open obligations with deadlines |
| POST | /v1/org/halt | Halt all agents in the org immediately |
| POST | /v1/org/resume | Resume a halted org |
| GET | /v1/audit/verify | Verify the hash chain and check anchors |
| POST | /v1/audit/anchor | Seal entries under a signed Merkle root |
| WS | /v1/ws/feed | Real-time WebSocket stream of actions, alerts, sessions |
| GET | /healthz | Health check |