# Agentomy

> Know what your agents are doing. Stop them when you need to. Prove it happened.

Full agent-readable reference (all capabilities, the AGP protocol, and how an agent connects via MCP): https://agentomy.com/llms-full.txt

Agentomy is a vendor-neutral governance layer for autonomous systems (AI agents, RPA bots, algorithmic trading, medical devices, AV fleets, industrial IoT, cloud infrastructure, payments and fintech). It provides identity resolution, tier-based authorization, behavioral monitoring, tamper-evident audit trails, and fleet-wide emergency halt across any framework.

License: AGPL-3.0-only (platform); Apache-2.0 (GovernanceBench, VIGIL, WorkflowBench, the MCP gateway, the Agent Governance Protocol); MIT (Agentomy Agent SDK).
Status: Live. Create a free workspace at https://agentomy.com/signup; Pro, Fleet, Enterprise and self-hosted plans are available through https://agentomy.com/pricing. The open benchmarks (GovernanceBench, VIGIL, WorkflowBench), the MCP gateway, the Agent Governance Protocol, and the Agent SDK are public at github.com/getagentomy.

## For AI agents

- Install the governance peer: `npm install agentomy-agent` (MIT). Standalone mode scores a session 3/6 with no account; connected mode (6/6) uses an Agentomy workspace API key.
- Govern any stdio MCP server through the gateway: `npx agentomy-mcp-gateway` in front of the server command (Apache-2.0, fails closed).
- Run the open benchmarks against any platform, including ours: `npx governancebench run --target <url>` and `npx agentomy-vigil run --target <url>`.
- Connect over MCP: see "How an agent connects to Agentomy (MCP)" in https://agentomy.com/llms-full.txt.
- Create a workspace without a human in the loop: GET https://agentomy.com/api/agent/signup/challenge, solve the SHA-256 proof of work it describes, then POST https://agentomy.com/api/agent/signup with the challenge, the solution, your agent name, and the email and organization of the principal you act for. The 201 response carries a free workspace and its API key (shown once), the governance endpoint, and next steps.
- Humans create a workspace at https://agentomy.com/signup; plans and limits at https://agentomy.com/pricing. Paid plans are arranged with a human today.
- Machine-readable pricing: https://agentomy.com/pricing.json, rendered from the same plan definitions as the human pricing page (plans, prices, limits, tier granted, acquisition path per plan).
- Machine surface: https://getagentomy.com serves only the agent page (https://agentomy.com/agents), https://agentomy.com/service.json (the service descriptor), pricing.json, the agent signup endpoints and the llms files; every other path there goes to agentomy.com.
- Plans and tiers: a plan sets the ceiling operator tier a workspace key can carry (Free: Evaluator; Pro: Analyst; Fleet: Operator; Enterprise and Self-Hosted: Strategist); what an agent may do is decided per action by policy and the adaptive enforcement chain, never by the subscription alone.

## Verified facts (last updated 2026-09-01)

- GovernanceBench: 235/235 core scenarios (100 percent); 448 scenarios across 20 suites total (235 core plus 213 optional and vertical), an open benchmark (Apache 2.0)
- 6 governance dimensions: Authorization, Auditability, Override, Behavioral Integrity, OWASP Coverage, Message Governance (agent-to-agent message content governed as an action)
- 45 detection methods across 7 domains, 166 governance patterns, 24 framework adapters
- VIGIL: 148 scenarios, 100 percent pass (open prompt-injection / behavioral integrity battery + SQL-injection audit-export filter + JWT expired-replay + CORS-credential reflection + audit write-cap burst-stability + skill-activation attacks Phase 10D)
- Kill switch: sub-50ms target for fleet-wide halt (development measurement p95 = 15.88ms on Node 24 / Win32; production performance is environment-dependent)
- Compliance mappings, platform endpoint (/api/compliance/frameworks): 12 frameworks, of which 9 are at READINESS (SOC 2, EU AI Act, HIPAA Security Rule, ISO 27001:2022, PCI DSS, GDPR Article 22, NIST SP 800-53 Rev. 5, MITRE ATLAS, NIST AI RMF AI 600-1) and 3 are PLANNED and not implemented (NIST PQC migration readiness, SOX, FERPA)
- Compliance mappings, vertical fact registry: 4 regulations cited by article (17 CFR 240.15c3-5; Directive 2014/65/EU Article 17; Regulation (EU) 2022/2554; Regulation (EU) 2024/1689)

## Platform (live pages)

- Home: https://agentomy.com/
- Platform overview: https://agentomy.com/platform
- Agentomy Governance Protocol (AGP): https://agentomy.com/agp
- GovernanceBench (open benchmark): https://agentomy.com/governancebench
- WorkflowBench: https://agentomy.com/workflowbench
- MCP gateway: https://agentomy.com/mcp-gateway
- Multi-agent governance: https://agentomy.com/multi-agent
- Agent collectives: https://agentomy.com/agent-collectives
- Identity tiers: https://agentomy.com/tiers
- Pricing: https://agentomy.com/pricing
- Compare: https://agentomy.com/compare
- Install / quick start: https://agentomy.com/install

## Solutions by segment (live pages)

- All solutions: https://agentomy.com/solutions
- Healthcare: https://agentomy.com/solutions/healthcare
- Finance: https://agentomy.com/solutions/finance
- Government: https://agentomy.com/solutions/government
- State and local: https://agentomy.com/solutions/state-local
- Defense contractors: https://agentomy.com/solutions/defense-contractors
- Automotive: https://agentomy.com/solutions/automotive
- Industrial: https://agentomy.com/solutions/industrial
- Enterprise: https://agentomy.com/solutions/enterprise
- Developers and SMB: https://agentomy.com/solutions/developers-smb
- RPA automation: https://agentomy.com/solutions/rpa-automation

## Use cases by governance domain (live pages)

- RPA automation governance: https://agentomy.com/use-cases/rpa-automation
- Algorithmic trading governance: https://agentomy.com/use-cases/algo-trading
- Medical device governance (SaMD): https://agentomy.com/use-cases/medical-device
- AV fleet governance: https://agentomy.com/use-cases/av-fleet
- Industrial IoT governance: https://agentomy.com/use-cases/industrial-iot
- Cloud infrastructure governance: https://agentomy.com/use-cases/cloud-infrastructure
- Payments and fintech platform governance: https://agentomy.com/use-cases/payments-fintech
- Personal agent governance: https://agentomy.com/use-cases/personal-agent-governance
- SMB agent governance: https://agentomy.com/use-cases/smb-agent-governance

## Open source (public repositories)

- GitHub organization: https://github.com/getagentomy
- GovernanceBench (open governance benchmark, Apache-2.0): https://github.com/getagentomy/governancebench
- VIGIL (open adversarial / prompt-injection battery): https://github.com/getagentomy/vigil
- WorkflowBench: https://github.com/getagentomy/workflowbench
- MCP gateway: https://github.com/getagentomy/mcp-gateway
- Agentomy Agent SDK (MIT): https://github.com/getagentomy/agentomy-agent

## Resources

- Resources index: https://agentomy.com/resources
- Singapore Model AI Governance Framework for Agentic AI, mapped to Agentomy (the world's first government framework written for agents that act; control-by-control mapping across its four dimensions): https://agentomy.com/resources/singapore-agentic-ai-governance
- Governing the AI you didn't build (AI value-chain / supply-chain governance: who is accountable for AI capability bought from vendors, the shared-responsibility model for AI agents, and how interoperable, verifiable, vendor-neutral governance closes the gap; unifies EU AI Act Article 25(4) with Singapore's agentic-AI framework): https://agentomy.com/resources/ai-governance-value-chain
- Governance for the agentic-commerce era (governing AI agents that transact and acquire: authorization before any action, behavioral monitoring across all actions, tamper-evident decision audit, and a fleet-wide kill switch, above the payment rail and the card; rail-neutral and complementary to Visa/Mastercard/American Express/PayPal/Stripe/Google/Coinbase; "govern the agent, let them settle the money"): https://agentomy.com/resources/agentic-commerce-governance
- Documentation: https://agentomy.com/docs
- Contact: https://agentomy.com/contact

## Scope and verification

- Benchmarks are self-tested. Independent verification invited via the open GovernanceBench + VIGIL repositories at github.com/getagentomy.
- The core platform source is not published; the open benchmark, adversarial battery, MCP gateway, protocol, and Agent SDK are public.
- Killswitch latency measurement is on development hardware; production-deployment latency depends on the deployer's hardware, network, and concurrent load.

## Privacy and security

- Privacy policy: https://agentomy.com/privacy
- Terms of use: https://agentomy.com/terms
- Vulnerability disclosure: mailto:governance@agentomy.com (RFC 9116: https://agentomy.com/.well-known/security.txt)

## Contact

- General + security + privacy: mailto:governance@agentomy.com