The say/do gap, recorded
An agent that reads a credentials file in-process never sends that file through a proxy. There is no API call to inspect and nothing in the application log. The kernel still saw the syscall. RAXE Sensor records it, links it to the session that did it, and seals it as evidence.
Three things only the host sensor can do
Invisible to proxies and logs
In-process file and secret access–an agent reading /etc/passwd, a token file, a private key–generates no API traffic. Kernel-level eBPF observation catches what network and application layers structurally cannot.
Pinned to the exact session
A raw kernel event says "some process touched a file". The sensor attributes each observation to the specific agent session, so the finding lands in the same timeline as the gateway claim and the SDK record.
Sealed by default
Sensitive fields such as file paths stay sealed until an analyst supplies a purpose and clicks Reveal. The reveal writes its own audit row–actor, field, outcome–into the hash-chained ledger.
One sensor, two vantage points
Host sensor (eBPF)
A kernel-level host sensor. It observes file and secret access at the syscall level and submits sealed observations for scoring. It watches from the kernel–it does not sit in your request path.
Python SDK
An embedded library (pip install raxe) that records what your application saw: prompts scored in-process, decisions logged locally. The in-app leg of cross-source lineage.
Gateway claim, SDK record, kernel observation–one continuous timeline per agent session.
The same discipline, in your cloud account
The kernel closes the say/do gap on the host. Your AWS control plane has the same gap: agent roles read secrets and call services under identities your SOC rarely watches. RAXE reads your live CloudTrail from inside your environment–no vendor cloud receives it–and raises detections on the same timeline, correlated to agent sessions rather than exactly attributed. Demo views use clearly-labelled sample data. Early access–design partner programme.
Agents on AWS →What it hooks, what it needs
The parts a platform engineer asks about first–stated plainly, with the qualifiers left in.
| Event classes | File access, process execution, and outbound network connections–observed at the syscall level and attributed to the agent session that caused them. |
| Kernel baseline | Linux with eBPF and BTF (BPF Type Format) available–standard on mainstream distribution kernels for several years. |
| Privilege model | The sensor runs as a privileged host service so it can load its eBPF probes. Your agents and applications run unchanged and unprivileged. |
| No kernel module | No kernel module, no kernel patch. eBPF programs are checked by the kernel's own verifier before they load, and unload cleanly. |
| Overhead | Built to observe, not intercept: the sensor watches events–it does not sit in your agents' execution path. We publish overhead numbers when we have earned them on a reference workload, not before. |
What the sensor observes is scored by the same five-signal detection stack as everything else in the platform.
Deployment-flexible from day one
Self-hosted in your environment–VPC or on-prem. We badge what we have exercised on fresh deploys, and label the rest roadmap.
| Pattern | Use Case | Status |
|---|---|---|
| Docker Compose [host] | The reference deployment–full stack including the eBPF host sensor | Validated |
| systemd Service [host] | Standalone host sensor for VM-based infrastructure | Validated |
| Python SDK [sdk] | In-application integration via embedded library | Validated |
| K8s DaemonSet [host] | Cluster-wide rollout | Roadmap |
| Sidecar [host] | Per-pod deployment alongside AI services | Roadmap |
Validated means exercised on a fresh deploy as part of our hardened acceptance runs–2× 12/12 passes–not "it should work".
*Absolute claims deserve footnotes: metadata telemetry details are on our trust page.