Your logs show what agents report. RAXE records what they actually do – and seals it as evidence you can verify. The flight recorder for your AI agents.
Today it lets you see it. Next, it lets you stop it.
No staged dashboards. The four-minute walkthrough below was recorded on a live RAXE deployment – real detections, sealed evidence, and an audit chain verified Intact. The AWS view uses clearly-labelled sample data.
Bring your own agents – we’ll show you what they’re actually doing, live on your stack, in a 30-minute walkthrough.
/etc/passwd in-process
– invisible to proxies and log files. The kernel-level sensor caught it and pinned it
to the exact agent session. The evidence stayed sealed until an analyst supplied a purpose
and clicked Reveal – and the reveal wrote its own audit row.
Agents report what they chose to write down. RAXE records what happened – then seals it so it holds up when someone asks hard questions.
RAXE Lineage Lens – the RAXE console – puts coding agents, your in-app SDK,
gateway LLM traffic and AWS cloud activity on one screen, with one triage queue.
Cross-source lineage ties it together: what the agent claimed at RAXE Gateway,
what your application saw through RAXE Sensor [sdk], and what the host
sensor observed at the kernel – one continuous timeline per agent.
A kernel-level eBPF host sensor catches in-process file and secret access – an agent
reading /etc/passwd – invisible to proxies and log files, pinned to the
exact agent session. The record is what the kernel observed, not what the agent chose to
report.
Evidence is sealed by default: sensitive fields stay hidden until an analyst supplies a purpose and clicks Reveal – and the reveal writes its own audit row: actor, field, outcome. Every row joins a tamper-evident, hash-chained ledger you can verify on demand: Intact.
Four surfaces, one queue – coding agents, in-app SDK, gateway LLM traffic and AWS cloud activity land in the same console, laptop to cloud account.
Claude Code and OpenCode are watched live, with explicit session attribution – provably this session. Codex sessions arrive via ingest and are labelled the way the evidence deserves: inferred. Attribution grades are part of the record, not a footnote.
Which agent role read that secret? CloudTrail knows. Now you do.
Your agents don’t stop at the model call – they assume IAM roles, read secrets and call AWS services under identities your SOC rarely watches. RAXE reads your live CloudTrail and raises detections as agent activity lands: an agent role reading a secret becomes a data-exfiltration alert in the console, on the same timeline as gateway claims and kernel-observed file access. Bedrock AgentCore telemetry joins that timeline too.
Self-hosted in your environment, watching your own AWS accounts – no vendor cloud receives your CloudTrail Correlation, not exact attribution Demo views use clearly-labelled sample data Early access – design partner programme
Most tools see what agents report. The gap between what an agent said and what it did is where incidents live – and where RAXE looks.
| Capability | Gateway-Only | SDK Scanners | Cloud Posture | RAXE |
|---|---|---|---|---|
| Sees gateway LLM traffic | Yes | No | Partial | Yes |
| Kernel-observed file & secret access | No | No | No | Yes |
| Watches your cloud accounts from inside your environment (live CloudTrail agent-activity detection) | No | No | Posture, not runtime | Yes – early access |
| One lineage across gateway, app and kernel | No | No | No | Yes |
| Sealed evidence with audited reveal | No | No | No | Yes |
| Tamper-evident, hash-chained audit ledger | Varies | No | Varies | Yes |
| Runs self-hosted in your environment | No | Yes | No | Yes |
| Original threat research programme | Varies | Varies | No | Yes |
Pick the entry point that fits your role – executive briefing, hands-on deployment, or the evidence model itself.
A strategic briefing on runtime AI risk and the evidence gap. Forwardable, no form gate.
Read the briefing →Self-hosted in your environment – VPC or on-prem. Docker Compose, systemd and the Python SDK are validated today; Kubernetes is on the roadmap.
See how it deploys →Sealed evidence, audited reveals, and a hash-chained ledger you can verify on demand – the evidence model auditors ask about.
See the evidence model →No single detector is trusted alone. Five named signals score every event, and every verdict opens into the evidence behind it – threat probability, per-family scores, out-of-distribution signal, nearest known attack patterns.
Open, auditable detection signatures, every one mapped to MITRE ATLAS and OWASP ASI. Fast rules answer in single-digit milliseconds.
A local ML scorer grades prompts and responses: threat probability, per-family scores, and an out-of-distribution signal for inputs that match nothing known.
Inspects tool-call arguments, detecting SQL injection, shell injection, path traversal and credential leakage inside the calls your agents make.
Reconstructs what the agent process actually did – process lineage, file access, connections – as a graph pinned to the session.
A heavier second opinion on borderline calls, running in your environment. Evidence, never authority – it never changes the decision.
Rollout posture: observe-and-log. Every would-block decision is logged with evidence, so you know exactly what it caught and why. Today it lets you see it. Next, it lets you stop it.
Original threat research feeds directly into the detection stack. Every advisory, every technique mapping, every new signature makes the platform sharper.
Your LLM API router may be stealing your credentials and rewriting your tool calls.
Data-driven analysis of AI threat patterns, attack techniques, and emerging vectors across the AI-agent threat landscape.
When the questions come, evidence beats assurances. Our compliance posture and framework mapping live on our trust centre →
Bring your own agents – we’ll show you what they’re actually doing, live on your stack, in a 30-minute walkthrough.