ZNYX AI
The open-source AI security platform for LLM and agentic apps.
ZNYX secures the whole surface of an AI application: prompts, model output, tool calls, retrieval and every agent step. Each is evaluated against your policy and returns a decision inside your own perimeter: allow, warn, redact or block. Local-first, no database, no egress. The engine and the client SDKs are open source.
Three ways to run it, one policy model.
Start in-process with a library import, move to a service when more than one application needs it, and add the console when the estate needs central policy and evidence. The policy file does not change as you move.
Detectors, policy resolution, scoring and orchestration as an importable library. No server, no HTTP hop, no network dependency.
A deliberately thin FastAPI service wrapping the engine. No database, no heavy ML libraries, auth required by default.
Serves model-backed detection over HTTP. Boots dependency-free on a stub runner; lean ONNX CPU extra with no torch or CUDA. Weights are never bundled.
Central management for a fleet of runtimes in managed mode. Talk to us for the current capability set.
Seven evaluation points, not just the prompt.
Most guardrail layers check the input and call it done. Agentic systems fail in the middle: a poisoned retrieval chunk, a tool call with the wrong scope, a plan that quietly escalates its own agency.
Forty detectors, every one configurable per tenant.
Each detector runs a deterministic rules path by default, so the runtime is fully functional with no models installed. Model-backed detection is an optional sidecar.
One YAML file, resolved down five levels.
A default posture for the organisation, overridden per tenant, per application, per agent and per environment. Central security sets the floor; a product team can only tighten it, and every override is visible in one file rather than scattered across prompts.
Industry packs ship for finance, healthcare, legal, customer support and code assistants, so most teams start from a reviewed baseline rather than an empty document.
The defaults are the ones you would have set anyway.
Six languages, honestly labelled.
The SDKs are thin HTTP clients: they call a running ZNYX runtime and do no detection themselves. Python and TypeScript are the most complete. We mark the alpha clients as alpha rather than letting you discover it in production.
Runs where your application already runs.
A thin FastAPI service with no database and no heavy ML libraries. Where you already pay for a cloud moderation service, ZNYX can call it as one detector among many rather than replacing it.
How GuideLite inherits it→Where the line sits, in plain terms.
The engine that makes the security decision is open source and always will be. You can run ZNYX indefinitely without paying us.
What security teams ask first.
ZNYX is the control point between your applications and the models they call. If your question is not here, ask it directly and you will get a straight answer.
Talk to us→Yes, on an open-core model. The detection engine and SDKs are open and inspectable, which matters for a security tool: you should not have to take a guardrail's behaviour on trust.
Any of them. ZNYX sits between your application and the model, so the same policies apply across OpenAI, Anthropic, Google, Mistral, open-weight models and anything self-hosted.
Detectors run in parallel and typical overhead is in the tens of milliseconds. Policies can also run asynchronously in monitor mode where blocking is not wanted.
Prompt injection and jailbreaks, PII and secret leakage, toxicity, off-topic drift and hallucination beyond a configured threshold, together with custom detectors you define for your own domain.
Yes. ZNYX can be self-hosted in your cloud or data centre, so prompts and outputs never leave your boundary, which is usually what residency and compliance reviews come down to.
You choose per policy: block the response, redact the offending span, or allow and log it. Every decision is recorded with the matched rule and its evidence, so an audit can reconstruct what happened.
Works closely with
Run it this afternoon. Decide about the console later.
One Docker command puts the runtime beside your application with the default policy loaded. Nothing phones home, nothing needs a contract, and you can point one application at it before anyone has to approve a purchase.