The tool that watches
your agents, done right.
Nerve is a managed service. To govern your agents it holds what the job needs — secured, isolated per tenant, and far less of your surface than the GitHub, CI and cloud you already trust. Here's exactly what we store, how it's protected, how you keep control, and the on-premises option if you need it in your own walls.
A managed service — and honest about it.
Nerve is hosted by Dubhlán. To orchestrate and govern your agents, it stores what that takes: the connections to your repositories, the agents' communications — which can include code and other IP — and the task, cost and telemetry data behind every dashboard. It lives in our infrastructure, isolated per tenant and encrypted.
This is the same trust you already extend to GitHub, your CI, and your cloud provider — and Nerve touches less of your surface than any of them. The difference is that Nerve is the thing watching the agents, so the access you granted them doesn't walk out the door.
Keep more to yourself if you want to: point inference at your own models, and your prompts and completions run against your endpoints, not ours.
Need it inside your own walls? On-premises deployment is available as an enterprise engagement — you run Nerve in your infrastructure and the data stays there. It costs significantly more, and for most teams it solves a problem they accepted the day they adopted cloud.
Least privilege, applied to agents.
Encrypted at rest.
Integration secrets are AES-256-GCM encrypted in Postgres. The key comes from your environment. Nothing is stored in plaintext, ever.
Default-deny, per agent.
An agent can only read a secret field if an explicit grant exists for that agent, that integration, that field. No grant, no secret — the resolver returns nothing. Your frontend agent cannot read your production database credentials, and that isn't a rule anyone has to remember to write.
Agents never hold your credentials.
When an agent needs to do something privileged — reach a cluster, push code, call an integration — the platform carries out the action for it and uses the credential only for that one action. The secret is never placed in the agent's environment, its workspace, or anything it can read. An agent can ask for the action; it can't hold the key.
Credentials can't be committed.
If an agent's work ever includes a secret or credential file, the platform refuses it the moment the change is made — before it can reach your repository, not after. Credential material has no quiet path from an agent into your history.
Leaks interrupt generation.
Every stream an agent produces — model output, tool results, chat — is checked for your credentials as it is produced. On a match, generation is interrupted mid-stream, the output is redacted, and a rotation gate opens for a human. Because the check is anchored to your own vault rather than to guesswork, false positives are effectively nil.
Untrusted text is treated as data.
A deterministic firewall runs on every untrusted input.
Before a model ever sees it. It normalises hidden and disguised characters, unwraps common encoding tricks, and checks what's underneath against known instruction-override patterns across more than thirty languages. It adds single-digit milliseconds and makes no model call of its own — which means, unlike a classifier, it cannot be argued out of its answer.
Untrusted content is fenced before it reaches a model.
With a per-session boundary marker and a preamble establishing that fenced text is material to read, never instructions to follow.
Tool inputs are validated against their schemas.
Before execution. Oversized payloads, smuggled URI schemes, embedded scripts and invisible characters are rejected outright.
Optional model-based classifiers can be added as sidecars. They are off unless you deploy them. The deterministic layer above is always on.
Agents cannot change production state.
Infrastructure mutation tools — cluster apply and rollout, image build and push, infrastructure apply, deploy and rollback — are refused at the dispatch layer for every agent. Pushes to main, master and production are refused separately.
The only path is a deployment request that opens a gate for a human, executed by a server-side runner that agent tool dispatch cannot address.
Every refusal is written to the audit log. Every deliberate bypass — there is exactly one, an autonomy level you raise yourself — is written too.
Who did what — including the ones who aren't people.
Authentication
- Signed, expiring, database-backed sessions
- OIDC with PKCE, state, nonce and JWKS RS256 verification
- SCIM 2.0 provisioning for Okta and Entra
Authorisation
- A 79-capability permission model across tenant and function-scoped roles
- A reachability check that refuses to let you lock everyone out
- A shadow mode that reports what enforcement would deny before you switch it on
Audit
- Every administrative action logs on success and on failure, with the actor hashed
- Chat audited by content fingerprint — never raw text — so you can prove what happened without storing what was said
Tenancy
- Isolation is enforced at the database, not just in application queries
- It fails closed: a query that can't prove which tenant it belongs to is refused, not run
- Host-touching tools are refused outside the platform tenant entirely
A bill of materials for your AI, not just your packages.
Nerve generates CycloneDX SBOMs for the platform and for each repository, and ingests real CVE data from OSV against the actual package URLs in those documents.
It also generates an AIBOM — a bill of materials for your AI supply chain. Which models you're running, which agents exist, what tools and MCP servers they can reach, which prompts, and which training-data lineage. When someone asks what AI you have in production, that's the artifact.
And a CBOM — a cryptographic bill of materials: every algorithm, certificate and protocol in use, each with a post-quantum readiness signal and its recommended replacement. So you can plan the migration on your own schedule, before “harvest now, decrypt later” stops being hypothetical.
Cloud posture is evaluated by policies carrying HIPAA and SOC 2 control references, so posture findings double as continuous compliance evidence. Remediation is gated on a human.
You decide the blast radius.
Every powerful thing an agent can do is something you grant, scope, and can take back — and nothing an agent does goes unrecorded.
The autonomy dial
Human-approved by default.
Every deploy waits for a person. If an agent earns your trust, you can raise its autonomy and let it ship within limits you set. The moment you do, nothing goes dark — every deploy it makes stays attributed, audited, and visible in the same trail as a human's. Handing over a little control is a decision you make on purpose, see in full, and reverse whenever you want.
Default: gated · every path tracked, traceable, visible
The spend dial
Ceilings that actually stop.
Cap any tenant, team, project, agent or task in tokens or dollars. Budgets stack — a call must clear every ceiling that covers it. Cross a warning line and you're told; hit the ceiling and work pauses for a human instead of quietly spending more. A runaway agent is a budget line, not a surprise invoice.
Enforced in the model gateway · conjunctive · warn + pause + optional top-up
The access dial
Credentials are grants, not defaults.
No agent reads a secret it wasn't explicitly given — default-deny, per agent, per integration, per field. Grant what a role needs, revoke it in a click, and every grant is on the record. Your frontend agent never holds your production database password unless you decide it should.
Default: deny · every grant explicit and revocable
Security contact
Report a vulnerability, request a security questionnaire, or ask us something this page didn't answer. We'd rather answer than have you guess.
Good-faith research is welcome. Please give us a chance to fix before disclosing.