Five jobs teams hire RAXE for
Secure coding agents
The transcript says README.md. The kernel says /etc/passwd.
Coding agents run on developer machines with repo access, credentials and a shell. Their transcripts are self-reported – what the agent says it did.
RAXE watches Claude Code and OpenCode live with explicit session attribution: every prompt, tool call and file touch pinned to the exact agent session. Codex sessions arrive via ingest, attribution honestly labelled INFERRED. Add the kernel-level eBPF host sensor and you also see what the process actually opened – file and secret access invisible to proxies and logs.
- Claude Code + OpenCode live Explicit session attribution – not a guess
- Codex via ingest Attribution labelled INFERRED, in plain sight
- Kernel-observed file & secret access eBPF host sensor – catches what proxies and logs miss
- One timeline per agent session Gateway claim, SDK event, kernel observation – side by side
Govern AI traffic
Every prompt, every response, every declared tool call – recorded and scored.
Your agents talk to Anthropic, OpenAI and Azure OpenAI all day. Someone has to be able to answer: what was sent, what came back, and what looked wrong.
RAXE Gateway takes one base-URL change and records the claim side of every exchange – what the agent said it would do – scoring each one with the five-signal detection stack. Every verdict is explainable, down to which signal fired and why.
- One base-URL change Your application code stays the same
- Five-signal detection stack ATLAS + ASI-mapped rules · ML text scorer · tool-call analysis · behaviour graph · opt-in advisory judge (evidence, never authority)
- Explainable verdicts Threat probability, per-family scores, nearest known patterns
- Would-block decisions logged with evidence See what later postures would have done – before turning them on
Tool-call arguments get read, not trusted
A tool call is where an agent stops talking and starts doing. RAXE inspects tool-call arguments, detecting injection attacks, credential leakage and path traversal – SQL injection in a query argument, shell metacharacters in an exec, a secret pasted into a URL. Detection, recorded as evidence on the session timeline.
tool: db_query
args: {"sql": "SELECT * FROM users; DROP TABLE audit;--"}
verdict: tool-call risk – SQL injection pattern in arguments
Agents on AWS
Which agent role read that secret? CloudTrail knows. Now you do.
Your agents don't stop at the model call – they assume IAM roles, read secrets and call AWS services under identities your SOC rarely watches.
RAXE reads your live CloudTrail and raises detections as agent activity lands: an agent role reading a secret becomes a data-exfiltration alert in the console, on the same timeline as gateway claims and kernel-observed file access. Bedrock AgentCore telemetry joins that timeline too.
- Self-hosted, watching your own AWS accounts No vendor cloud receives your CloudTrail
- Correlation, not exact attribution Findings correlate to agent sessions – and are labelled that way
- Demo views use clearly-labelled sample data Nothing staged as live
- Early access – design partner programme Shaped with the teams running it first
Surface shadow AI
You can't govern usage you can't see. Start with what you can.
Teams adopt models faster than security reviews run – and no, this is not a magic scanner that finds every AI endpoint on your network.
RAXE surfaces the AI usage it can genuinely see: provider traffic routed through your gateway – per app, per team, per model – labelled for exactly what it is. The paths that matter first.
- Gateway-visible provider usage Who is calling which model, from which app
- Agent activity inside your AWS account is its own job See Agents on AWS above
- Not claimed: network-wide endpoint discovery We say what we see – and what we don't
SOC evidence & compliance
Evidence your auditor can re-verify. Not screenshots.
When an incident review or an audit lands, “the agent seemed fine” is not a record. Your SOC needs what happened, who looked at it, and proof nothing was edited after the fact.
RAXE Lineage Lens – the RAXE console – keeps evidence sealed by default: sensitive fields stay sealed until an analyst supplies a purpose and clicks Reveal, and the reveal writes its own audit row – actor, field, outcome. The ledger is tamper-evident and hash-chained; verify the whole chain on demand and it answers Intact. Detections map to MITRE ATLAS and OWASP ASI, and everything exports as CEF, syslog or JSON to the SOC stack you already run.
- Sealed-by-default evidence Reveal needs a purpose – and writes its own audit row
- Hash-chained audit ledger Verify the chain on demand → Intact
- MITRE ATLAS + OWASP ASI mapping 13 threat families · 41 techniques · 10 harm types
- CEF · syslog · JSON export Formats your SIEM already ingests
Observe-first, from day one
RAXE deploys observe-and-log. Nothing about how your agents run changes – and every would-block decision is logged with the evidence behind it, so you can see exactly what would have been blocked before you turn anything on. Today it lets you see it. Next, it lets you stop it.
Who runs it, and why
For security leaders
See the risk before you have to explain it.
- Observe-first rollout – nothing changes on day one
- Evidence that re-verifies: sealed, audited, hash-chained
- Prompts and detections stay in your boundary
For platform engineers
Boring to run. That's deliberate.
- Docker Compose, systemd and Python SDK – validated deploy paths
- K8s DaemonSet and sidecar on the roadmap
- Fast rules answer in single-digit milliseconds; the full multi-signal verdict in ~150 ms – all local
For AI engineering teams
Adopt it without a rewrite.
pip install raxe– scan at your call boundary- Generic Python integration with your framework
- Observe-first: verdicts land in the console, app behaviour doesn't change
Pick the job. We'll show it running.
Book 30 minutes with an engineer. Tell us which of the five jobs is yours and we'll walk that exact path – live console, honest labels, no theatre.