v2026.8.1 is out. The first full release: security-reviewed, hardened, and out of beta. What's new →
For platform and infrastructure teams

One binary to run, not a fleet of sidecars

You are the 1 who gets paged when it breaks, so the question is not what it detects but what it costs you to operate. One process, 37MB resident, no runtime to patch, and metrics on day one.

  • Single Go binary
  • 37MB resident
  • Prometheus · OTel · Jaeger
The problem

What tends to keep you up

Another service to babysit

Every new component is a deploy pipeline, a runtime to patch, a dashboard to build, and a pager rotation nobody volunteered for.

Latency budget in the request path

Anything inline is a tax on every single request. A proxy that adds the sum of its checks rather than the slowest 1 is not viable.

One bad provider taking everything down

A guardrail vendor having a slow afternoon should not turn into your incident, and it should not cascade into unrelated traffic.

Where the data lives

Audit logs and token usage grow forever. Someone has to answer where they are retained, how they are backed up, and how they get restored.

What you get

Built to be boring to operate

One file, no runtime

A pre-built Go binary for Linux, macOS, and Windows. No interpreter, no virtualenv, no dependency resolution on the host, and no second CVE stream to track alongside the application.

Read the guide

Concurrent checks, not sequential

Policy engine, guardrail providers, identity verification, and redaction all run at the same time across all cores in 1 process, so added latency tracks the slowest check rather than the sum.

Read the guide

Blast radius control

Per-proxy circuit breakers and a shared upstream transport with configurable response-header timeouts, so 1 failing provider cannot take the rest of your traffic with it.

Read the guide

Metrics on day one

Native Prometheus metrics, OpenTelemetry and Jaeger spans with p50, p95, and p99, Grafana dashboards, and Langfuse traces. No custom instrumentation to write first.

Read the guide

Retention that is someone else's disk

Replicate audit logs, alerts, and token usage to an external PostgreSQL or MySQL database, in real time, in batches, or both, while the hot path stays on local SQLite.

Read the guide

Backups you can actually restore

Scheduled snapshots from hourly to weekly with compression and a retention cap, browsable in the dashboard, restorable in 1 click. Backups use a consistent copy rather than a raw file copy.

Read the guide

Browse all 46 capabilities

Getting started

Your first half hour

Nothing here is irreversible, and every control is opt-in. You can run the whole sequence against a throwaway proxy before you point anything real at it.

  1. 01

    Extract and run

    Download the release for your platform, run the installer to generate the JWT and encryption keys, and start it. The dashboard is on port 8080.

  2. 02

    Create a proxy and confirm it bound

    Proxy start confirms the port has actually bound before reporting success, and port conflicts are caught at create time with a suggested free port.

  3. 03

    Wire up metrics

    Point Prometheus at the metrics endpoint and import a Grafana dashboard. You have request rates, error rates, and latency percentiles before you have any policy configured.

  4. 04

    Set the operational guardrails

    Configure the circuit breaker thresholds, the backup schedule, and external database replication. These are the settings you will wish you had set before the first incident, not after.

Run it and see what it costs you

Extract, install, start. If it is not worth the 37MB, delete 1 file and nothing is left behind.

Download v2026.8.1 Browse the docs