# IT-RAT

> Open-source governance for AI agents: runtime spend control, policy decisions,
> identity and delegation, egress, memory with provenance, cryptography posture,
> quality scoring, pre-production drills, alerting and an auditable record.
> Each plane installs on its own, self-hosted on infrastructure the operator
> owns, plus Genaryx, the console over them. Every part of it is Apache-2.0.

Every page below is available as markdown at the same path with a .md extension.

## Guides

- [Guides index](https://it-rat.com/guides.md): Sixteen guides: seven on the field of AI agent governance, and nine on running this stack, from a first alert to what changed in October.
- [AI agent governance](https://it-rat.com/ai-agent-governance.md): What AI agent governance means in practice: budgets, policy, identity, delegation, egress, provenance, quality, drills and an auditable record.
- [FinOps for AI](https://it-rat.com/finops-for-ai.md): FinOps applied to LLM and agent spend: the unit of work, per-run budgets, reserve-then-settle, FOCUS showback and cost per resolved case.
- [AI agent security](https://it-rat.com/ai-agent-security.md): The failure modes an autonomous agent introduces, the runtime guardrail that answers each one, and how to rehearse them in CI. Defensive practice.
- [MCP security](https://it-rat.com/mcp-security.md): What changes when tools arrive over the Model Context Protocol: descriptions the model reads, servers nobody sanctioned, tools that change later.
- [Agent identity and authentication](https://it-rat.com/agent-identity.md): Static keys are not identity. What an AI agent needs to be nameable, attributable, attestable and revocable, and when to demand a signature.
- [Glossary of agent-governance terms](https://it-rat.com/glossary.md): Plain definitions for this field: agent passport, attestation, delegation chain, blast radius, per-run budget, rug pull, CBOM, FOCUS, drift.
- [AI observability vs governance](https://it-rat.com/ai-observability-vs-governance.md): The record explains what an agent did, the control decides what it may do next, and both meet on one run id. What each one answers and what it cannot.
- [One incident, end to end](https://it-rat.com/one-incident-end-to-end.md): A single runaway agent followed through spend, policy, identity, memory, mail and evidence: what each plane sees, what it emits, and who is told.
- [What runs where and what it costs](https://it-rat.com/what-runs-where.md): One machine, a five-node cluster, or three clouds: the measured shapes of this stack, their throughput, and the storage line that changes by 108x.
- [From zero to your first alert](https://it-rat.com/first-alert.md): One command, one address, one mail: the shortest honest path from nothing to a governed agent that writes to you when it crosses a line.
- [Two sites, one control plane, no VPN](https://it-rat.com/two-sites.md): Sites reach one hub over outbound HTTPS through one narrow door: every site by name, one policy everywhere, and a quiet site never mistaken for a dead one.
- [What is proven and what is not](https://it-rat.com/what-is-proven.md): How to read a validation claim: what was measured on this stack, what the measurement does not cover, and the conclusions we published and had to withdraw.
- [Three shapes of agent tooling](https://it-rat.com/agent-tooling-compared.md): The controls that answer before a call: what each one does, what it does not do yet, and how to check it.
- [Security by design](https://it-rat.com/security-by-design.md): An agent can be persuaded, so its controls sit where persuasion cannot reach. Eight design decisions in the stack, and what happened when we broke each one.
- [How the numbers were produced](https://it-rat.com/stack-guide.md): The eight figures on the home page: how each was measured on real infrastructure, the bugs the live runs caught, and where the rest of the record is.
- [Install the stack, all of it or one service at a time](https://it-rat.com/install.md): One command for the whole stack on a box you own, a cluster or your laptop, and how each service installs and runs on its own.
- [What changed in the stack, 1 to 15 October 2026](https://it-rat.com/changes-2026-10.md): Prices that match the bill, money that is never forgotten, tool calls judged before they run: what changed in the stack from 1 to 15 October 2026.
- [Genaryx guide](https://it-rat.com/genaryx-guide.md): How the Genaryx console works, how Felyx is held, what every frame shows, how to take it, and what is not yet in the record, in full.
- [TokenFuse guide](https://it-rat.com/tokenfuse-guide.md): How TokenFuse works, how to install and configure it, what changed from 1 to 15 October 2026, and what the default install does not do, in full.
- [CostCrew guide](https://it-rat.com/costcrew-guide.md): How CostCrew works, how to install and configure it, what changed from 1 to 15 October 2026, and what it does not prove yet, in full.
- [TokenFuse Pocket guide](https://it-rat.com/pocket-guide.md): How TokenFuse Pocket is designed to work, how it differs from Heraldyx, where it sits in the stack, and why it is not wired into a running stack yet.
- [Wardryx guide](https://it-rat.com/wardryx-guide.md): How Wardryx decides allow, deny or hold, how to run it, what changed from 1 to 15 October 2026, and what is open by default or not proven yet.
- [Idryx guide](https://it-rat.com/idryx-guide.md): How Idryx builds one identity graph and what its detectors look for, how to run it, what it answers, and what it does not do or prove yet.
- [Scopyx guide](https://it-rat.com/scopyx-guide.md): How Scopyx decides an agent's web egress, how to run its two images, what changed from 1 to 15 October 2026, and what it will not do, in full.
- [Vouchryx guide](https://it-rat.com/vouchryx-guide.md): How Vouchryx proves and ends an agent's delegation, its six endpoints, how to run and configure it, what changed in October 2026, and its limits.
- [Qryx guide](https://it-rat.com/qryx-guide.md): How Qryx finds every key and grades its post-quantum risk, the risk model, how to run it, what changed in October 2026, and what it leaves out.
- [Keyryx guide](https://it-rat.com/keyryx-guide.md): How Keyryx signs, publishes and witnesses keys and the record, its routes, how to configure, run and verify it offline, its releases, and its limits.
- [Verdryx guide](https://it-rat.com/verdryx-guide.md): How Verdryx turns agent spend into cost per resolved case, its six graders, how to run it offline, what changed in October 2026, and its limits.
- [Typryx guide](https://it-rat.com/typryx-guide.md): How Typryx works, its measured runs in full, how to choose a data mode at install, what changed, and what it does not prove yet.
- [Mockryx guide](https://it-rat.com/mockryx-guide.md): How Mockryx fire drills work, how to run and download it, the drills on main not yet released, and what it does not prove yet.
- [Trailryx guide](https://it-rat.com/trailryx-guide.md): How Trailryx proves an answer complete, how erasure leaves the chain intact, the durability runs, the offline verifier, and its limits.
- [Heraldyx guide](https://it-rat.com/heraldyx-guide.md): How Heraldyx decides what reaches a human, what its mail may carry, what its dispatch record proves, what changed in v0.7.0 and v0.8.0, and its boundaries.
- [Engram guide](https://it-rat.com/engram-guide.md): How Engram works, the live runs against real Claude, how to install it, what changed on main, and what it does not do yet, in full.
- [Platform guide](https://it-rat.com/platform-guide.md): How the Agent Passport contract works, how to run the stack on a laptop, one box or a cluster, and what it does not claim, in full.

## Services

- [TokenFuse, the money plane](https://it-rat.com/services/tokenfuse.md): A drop-in gateway that gives every agent run a budget and answers 402 when it is crossed. Anthropic and OpenAI wires, proven on three clouds and on premises.
- [CostCrew, the finops plane](https://it-rat.com/services/costcrew.md): A crew of agents takes your cloud, SaaS and AI bill apart: allocation, chargeback, unit economics, anomalies. Nothing is published until a person stamps it.
- [Vouchryx, the delegation plane](https://it-rat.com/services/vouchryx.md): RFC 8693 token exchange with nested act, bound to the caller's key by DPoP. A delegation an agent can prove it holds, ended early wherever the list is polled.
- [Wardryx, the policy plane](https://it-rat.com/services/wardryx.md): The policy plane your agents ask before acting: allow, deny or hold for a human, with signed approval tokens and a hard ceiling that outranks approvals.
- [Idryx, the access plane](https://it-rat.com/services/idryx.md): One identity graph for humans, keys, service accounts and AI agents: delegation chains, blast radius, 27 deterministic detectors and a CycloneDX Agent-BOM.
- [Engram, the knowledge plane](https://it-rat.com/services/engram.md): Embeddable agent memory in one SQLite file: bitemporal facts, hybrid BM25 and vector recall, why() provenance and GDPR forget. No server, no API key to start.
- [Qryx, the crypto plane](https://it-rat.com/services/qryx.md): Inventory every key, certificate and algorithm you actually run, grade the post-quantum risk against the NCSC 2028, 2031 and 2035 dates, sign the evidence.
- [Keyryx, the key custody and witness plane](https://it-rat.com/services/keyryx.md): Key custody and a separate witness for the agent-governance record. Custody signs for granted consumers; the witness reads the record without writing to it.
- [Verdryx, the quality plane](https://it-rat.com/services/verdryx.md): Cost per correctly resolved case, not cost per token: six graders, statistical drift detection and a metered LLM judge, scored on your own outcome tags.
- [Mockryx, the pre-production plane](https://it-rat.com/services/mockryx.md): Fire drills for your guardrails: YAML scenarios fired at a real gateway, asserting the 402, the 403 and the downstream reaction. Zero real spend, CI-native.
- [Heraldyx, the alerts plane](https://it-rat.com/services/heraldyx.md): The part of the agent stack that writes to you: it reads the event log, decides what is worth a human tonight, and mails it with links into your console.
- [Scopyx, the egress plane](https://it-rat.com/services/scopyx.md): Your agents already reach the web and nothing governs it. Scopyx decides every destination before anything leaves, and keeps origins rather than URLs.
- [Trailryx, the record](https://it-rat.com/services/trailryx.md): A record of what your AI agents did that nobody can quietly change or shorten, where every answer says whether it is proved complete.
- [Platform, the shared contract](https://it-rat.com/services/platform.md): One agent:// passport, one event envelope, one Go binding and a Terraform provider: the contract every service in the stack shares. Apache-2.0.
- [TokenFuse Pocket, the out-of-band kill switch](https://it-rat.com/services/pocket.md): Our iPhone and Apple Watch app for TokenFuse: the fleet's burn live, and a kill signed by the Secure Enclave. Built, and not wired into a running stack yet.
- [Typryx, typed answers](https://it-rat.com/services/typryx.md): A typed answer, choice, score or yes/no, with a probability, never a guess: capped, journaled, and calibrated against real outcomes.

## Other

- [IT-RAT, open-source governance for AI agents](https://it-rat.com/index.md): Open-source runtime governance for AI agents: budgets, policy, memory, identity, cryptography, quality and pre-production drills. Apache-2.0, self-hosted.
- [The stack: every service, with its room and its guide](https://it-rat.com/stack.md): Every service in the stack, grouped by the ring it belongs to, each with a room that shows it working and a guide with the full story.
- [Genaryx, the console over the stack](https://it-rat.com/genaryx.md): Genaryx: one browser control room over the whole agent stack, on your own box. Passkey-signed kills, WireGuard-only reach and signed evidence packs.

## Optional

- [Everything, concatenated](https://it-rat.com/llms-full.txt): all guides in one file.
- [Machine index](https://it-rat.com/mcp-index.json): the same map as JSON, used by the docs MCP server.
- [Docs MCP server](https://it-rat.com/mcp-security.html): these docs are also served over MCP; the server is in the site repo under mcp/, stdio, no dependencies.
- [Source](https://github.com/TAIPANBOX): the services themselves.