Discover
See every AI call
Decrypted inspection of OpenAI, Anthropic, Copilot, Gemini, Bedrock, Ollama and 30+ endpoints — classified on the fly, including ones not yet named.
Kilasec inspects every AI call leaving your network — discovers shadow models, redacts secrets and PII before they cross the wire, holds runaway agents for approval, and scans the replies coming back. Agentless by default — no endpoint agent required. It lives where you already enforce policy.
The current crop asks you to integrate an SDK, run a sidecar, or rewrite your agents — which works right up until someone pastes an API key into ChatGPT, or a vendor tool you've never heard of starts calling a model from a finance laptop.
Decrypted inspection of OpenAI, Anthropic, Copilot, Gemini, Bedrock, Ollama and 30+ endpoints — classified on the fly, including ones not yet named.
Secrets, credentials, customer PII and card numbers are masked before they cross the wire — even deep inside a long, oversized coding-agent conversation — and model replies are scanned on the way back for reverse shells and poisoned package installs.
Map each request to a user and directory group — synced from AD by the collector itself, with agentless User-ID polling your domain controllers, or from CSV. Write allow group:eng → api.anthropic.com.
Every admin change and blocked request, retained 30 days to 7 years. Export for SOC 2, HIPAA, or your own change control. Admins sign in with SSO on DNS-verified domains, and every signed-in session can be seen and cut off.
Built for the sysadmin who has to live with it. No endpoint agent required, no application changes, no new box to rack — a single hardened container on hardware you already have. (Optional lightweight sensor/SDK only if you need to tell co-located agents apart.)
Runs read-only, non-root, --cap-drop=ALL, no-new-privileges. amd64 or arm64 — a mini-PC, a VM, or a spare NUC is plenty.
Browsers and fleets follow the collector's auto-generated PAC; agent hosts run a one-line config script that sets the proxy and trusts the CA — configuration only, no resident software. Roll back with --uninstall or by pointing clients away.
Only the model endpoints you scope get decrypted and inspected. Everything else routes direct, untouched — so the vast majority of traffic sees zero added hops. And AI CLIs and SDKs skip interception entirely: they're handed a local gateway endpoint, so inspection happens without a second TLS handshake — near-zero added latency.
Keeps enforcing locally if the cloud blips and drains cleanly on shutdown. Its local management API answers only to authenticated callers — even from the same host — and request bodies are never written to disk.
Kilasec Connect is the device client — a notarized menu-bar app on macOS, push it zero-touch through your MDM; on Windows the tray app installs with enrollment and updates itself from signed releases. The app is deliberately small — status, sign-in, restart — while the detail lives in your console. The same policies follow people off-network.
The console's Health page runs each collector's self-checks, and every failure carries an AFW-### code with its fix attached. On the box, the kilasec CLI gives you firewall-style show and test verbs and a redacted support bundle. Or connect Claude to the console's MCP server with a browser sign-in — read-only Troubleshoot or policy-editing Configure, on access that expires.
# the entire deployment — one service services: collector: image: ghcr.io/blox-24/kilasec-collector:latest network_mode: host # sees the edge read_only: true cap_drop: [ALL] security_opt: ["no-new-privileges"] ulimits: nofile: 65536 env_file: .env # token from enrollment restart: unless-stopped # bring it up $ docker compose up -d # … and to remove it entirely $ docker compose down
Secrets and PII masked, destructive and shadow-AI calls blocked, runaway spend capped, the risky ones held for a human. Tap a control — or watch them cycle.
Illustrative replay of real policy decisions.
The exact event patterns Kilasec's policy engine detects and acts on — the everyday ways sensitive data, shadow AI, and runaway cost leave a network through model APIs, and the ways trouble rides back in on the replies.
An engineer asked for help debugging a script with a hardcoded access key and secret. Both would have left the network in the prompt body.
A support team's AI agent received raw transcripts containing SSNs and card numbers. None of it should have reached the provider.
A new vendor tool started reaching api.deepseek.com from a finance laptop. Nobody in IT had heard of it.
A misconfigured QA agent kept re-running evals on a frontier model. At that rate, tens of thousands by morning.
A coding agent asked for an install script. The reply came back with a download-and-exec one-liner and a typosquatted package name — threats that travel toward your network, not out of it.
Coding agents resend the whole conversation every turn, so naive counters cry wolf. Kilasec counts unique exposures — one per session — and three in an hour is an incident, not noise.
Drop the logs you already have — DNS, proxy, or a packet capture — and see every AI service on your network, which machines are calling it, and the private LLM gateways nobody registered. The analysis runs entirely in your browser; nothing is uploaded.
We're onboarding a small number of networks each week. Drop your work email and we'll reach out with an invite.
Not sure what's on your network yet? Run the free shadow-AI audit → It analyses logs you already have, entirely in your browser — nothing uploaded.