The trust boundary
every agent
reports into.
Multisynapse is the governance and observability layer that sits between your agent runtimes and the rest of your stack. Agents register here, get evaluated here, get promoted here, talk to external services through here, get stopped here when a rule says so, and leave an audit trail here.
Already have access? Sign in.
The agent runtime is somebody else's job. Multisynapse is the platform every runtime reports into. Built on A2A, OpenTelemetry GenAI, and MCP, the standards your agents already speak.
Inside Multisynapse
Screens from a demo workspace. Every number on them was observed by the platform, not typed into it.
One place every runtime reports into
System health, registered agents, trace volume, experiments, and spend on a single screen. Trends break inference cost, error rate, and latency down by agent and by model, so a drift shows up before a bill does.
Every model call, costed from real tokens
Cost is computed from observed token usage and model prices, never estimated. Roll it up by agent, project, or organization over a day, a week, or a month, and set monthly budgets for alerting.
Default-deny, written as code
Every write, ingest, and eval run is evaluated against an OPA Rego bundle. A request is forbidden unless an enabled policy explicitly allows it. Policies hot-reload on save, and each one can be switched off without touching the others.
NIST AI RMF posture, frozen and signed
Automated checks and human attestations roll up into a posture score per function. Each snapshot freezes that posture at a point in time, verifies the audit chain, and exports as a report or an evidence bundle an auditor can check offline. Scheduled weekly, or on demand.
What Multisynapse provides
Govern
Seven of the seventeen, which is the honest shape of the product.
Rules about what the run already did, enforced at the call
Authorization asks who may call a tool. A behavioural rule asks a different question — given what this run has already done, may it do this next — and answering it needs the run's own ledger at the moment of the call. Write the rule in Rego, run it in shadow against live traffic to see what it would have stopped without stopping anything, replay it over your own recorded runs call by call to find the exact call it would have refused, then arm it. Set per organization and overridable per agent. A rule can also require a person instead of refusing outright: approval takes a signed-in human, never an API token, and a run nobody is attending is refused rather than silently queued.
Inspect the text, in five directions
A chain of detectors over the task input, tool results before the model sees them, retrieved knowledge, replayed history, and the model's own output. Deterministic patterns run in process; a self-hosted in-cluster service or your own endpoint can be added to the chain, each entry with its own mode, so one detector can enforce while another runs in shadow on the same traffic. Streamed output is held back until it has been inspected. A refused knowledge passage is dropped rather than failing the run, so one poisoned document cannot become an outage.
Know which agent is calling
Bind an agent to a credential — an attested workload identity, or an API token — and the platform knows which agent is calling at the moment it decides. A delegation rule can then name the source, so “only the approvals agent may call the payment tool” is expressible rather than only “nobody may”. A bound credential may file runs under its own agent and no other. Attested identities and shared secrets are shown as what they are, never rendered as equivalent.
Hash-chained log, default-deny OPA
Every write, eval run, and tool invocation flows through OPA Rego. Audit rows are hash-chained per org and project: tamper-evidence you can verify with a single API call. Role split available for true authority separation. Audit history has a hard seven-year floor; everything else follows retention policies you set, and absent a policy nothing is deleted.
A risk tier that changes what the platform allows
Each agent carries an owner of record, intended and out-of-scope use, data sensitivity, and a risk tier. The tier is not a label: it tightens the promotion gate, requiring an independent and aligned judge and refusing automatic promotion at the top tier — better evidence and “a person decides” being different controls. It can only ever tighten, so classifying an agent is never a way to weaken its gate. A review cadence raises an alert when a review falls due. A printable agent record states the measured posture, every figure read from what the platform observed, with anything unmeasured left blank rather than printed as zero.
Self-modification in infrastructure, not policy
Agents propose changes to their own prompts, skills, and code artifacts through MCP tools. The platform holds the gate. No self-approval. Stale-but-passing verdicts are rejected at approve time. Kill-switchable per agent.
Three frameworks, backed by evidence
Automated checks run against your live platform and map to NIST AI RMF 1.0, ISO/IEC 42001, and an agentic control set covering identity and authority, operating bounds, and agent lifecycle. That third set is not a published standard and is issued by no standards body; it exists because the 2026 model-risk guidance that supersedes SR 11-7 explicitly does not address generative or agentic systems, leaving institutions a gap rather than a framework. Controls, attestations, findings, and reports live in one place, and an attestation written once counts in every framework sharing its evidence topic. Posture snapshots freeze the state at a point in time, signed when a key is configured and anchored into the audit log. Statuses describe alignment posture, not a certification.
Operate
What the agents did, how well they did it, and who said so.
Native GenAI telemetry
Point any OpenTelemetry SDK at Multisynapse and every prompt, tool call, and token spend lands in a structured trace tree. Search inside a trace, watch new traces arrive in a live tail, describe a filter in plain English, and save the views you use. Cost rollups and budgets are derived from real observations, not estimates.
Frozen golden sets, forking scorers
Score with LLM judges, classifiers, exact and semantic matchers, or your own sandboxed code. Grading surfaces freeze on first claim. Edits fork rather than mutate, so past experiments stay reproducible. LLM judges can abstain on cases they cannot fairly score. Head-to-head comparison uses true pairwise judgment, with win rates and confidence intervals surfaced where the promote-or-don't decision is made. Tournaments run N-way variant races, and the champion becomes a proposal, never a silent promotion.
Attack the agent, not just the filter
A versioned probe set expanded by deterministic mutations, so a suite reproduces byte for byte and a failure is a regression rather than a coincidence. Probes that target your detection are distinguished from those that target the agent's judgement, because a suite made only of the first kind flatters any platform with a good filter. Several arrive as a poisoned tool result rather than a poisoned prompt: injection through a result the agent asked for is the attack that lands in production, and testing it requires owning the mock layer. Over-refusal is scored separately — refusing everything is not a pass. Evaluations can be driven by a goal-directed simulated user over multiple turns, which can never satisfy an approval a policy reserved for a person.
Judgment as a record, not a margin note
When a person overrides a score, that is an event of record with full provenance: who scored what, and when. Overrides can be deliberately undone, with the undo itself on the record. Review campaigns show per-item assignment, so who is looking at a case is a query, not a thread.
Alerts that respect the read policy
Link your account, get notified by direct message, and share trace links that unfurl into previews. An unfurled preview enforces the same read policy as the application, so a link pasted into a channel can never reveal a trace the sharer could not open. A daily digest summarizes how conversation topics are shifting.
Build
Register an agent, try it, and see what it would do before it does it.
Versioned, eval-gated agent cards
Every agent registers an A2A Agent Card. Each upsert creates an immutable snapshot. Promotion flips the active version only after the eval gate passes: regression check, cost p95 cap, and no self-approval.
Test before you ship
Run prompts, models, and registered agents side by side against your datasets, scored live as results stream in. Promote a promising run straight into a tracked experiment: same eval gate, no copy-paste.
See what an agent will do before it does it
Run any agent with every tool call simulated. The reasoning executes and the intended actions are recorded, but nothing touches a real system. Preview a browser or integration agent end to end with zero side effects.
Connect
Two surfaces your existing runtimes and clients already speak.
One policy surface for all tools
Claude, Cursor, Cline, and Claude.ai clients add Multisynapse as a single MCP server. Upstream integrations, including GitHub, Slack, Google Drive, and Salesforce, are aggregated, namespaced, and individually kill-switchable.
Every model call, costed and capped
Point your app at a drop-in OpenAI- or Anthropic-compatible endpoint. Each call lands as a trace, is costed from real token usage, and is held to per-tenant budgets and kill-switches. Bring your own key, with automatic failover.
How to connect
Three integration points. No new protocols.
Register your agents
POST an A2A Agent Card to the registry. Multisynapse versions it, lints it for completeness, and makes it discoverable to other agents over MCP.
Wire up observability
Get full visibility into every AI call, from latency and cost to failures and model behavior, so your team always knows what's happening inside your agents, and your compliance team has the audit trail to prove it.
Add the MCP server
Add Multisynapse as an MCP server in your client config. Your agents gain access to the full tool catalog, subject to OPA policy, with every call logged.
No lock-in, by construction
A system of record asks to sit in the execution path of everything you run, and to become the place your evidence accumulates. That is a lot of trust to ask for. So the things that pile up here stay in formats you can take elsewhere: your telemetry is OpenTelemetry, your policies are Rego, your agents are A2A cards, your tools speak MCP, and the gateway is drop-in compatible with the APIs you already call. Nothing here is a format only we can read.
Standards are the on-ramp, not the product. What you cannot export is the thing worth paying for: the accumulated record, and a platform that was in the path to refuse something.
Ready to govern your agents?
Multisynapse is built and ready to deploy. Reach out to see it running against your agents, or to talk through a design partnership.
Already have access? Sign in. Is it up? Check the system status page.