The immune system
for AI agents.
Agent security that gets smarter with every tool call. Runtime governance, AI-powered threat intelligence, and coverage that compounds — autonomously. 2.7 µs overhead.
Navil sits between your AI agents and MCP servers — inspecting, enforcing, and learning from every request in real time.
custom agents
delegation
enforcement
detection
intel
resources
Every anomaly detected locally is anonymized and shared. Every proxy protects every other proxy.
Static scanners check code before it runs — and miss 98.3% of threats. Navil intercepts every tool call at the moment of execution.
| Static Scanning | Navil Runtime Interception |
|---|---|
| Checks source code before deployment | Inspects every tool call in real time, as it happens |
| Misses runtime attacks (tool poisoning, credential exfiltration, session manipulation) | Catches tool poisoning, data exfiltration, privilege escalation, and novel attacks |
| Rules degrade immediately as new threats appear | 12 anomaly detectors with adaptive baselines that learn from your traffic |
| Catches 1.7% of agent threats | Covers the other 98.3% |
MCP servers expose ALL tools to ALL agents — even tools the agent doesn't need. That's your money burning on unused context.
GitHub MCP alone dumps 90+ tool schemas consuming 50,000+ tokens per session. Most agents use 3–5 tools. You're paying for the other 85. Navil's context-aware tool scoping shows each agent only the tools it needs. Define scopes once, save on every single call.
Define exactly what each agent can and can't do. YAML rules, not hope.
YAML-driven tool/action allow-lists. Per-agent rate limiting. Data-sensitivity gates. Path-based restrictions for secrets and sensitive files. No more "the agent probably won't do that." Now it can't.
824 malicious skills found in the OpenClaw registry. Navil makes sure they can't phone home.
Exfiltration Blocking
Detects and blocks outbound data exfiltration attempts. API keys, SSH keys, and environment variables never leave your machine.
Credential Scanning
Every tool response is scanned in real time for plaintext credentials, tokens, and secrets — intercepted before they reach the network.
Permission Flagging
Flags over-privileged tool permissions and suspicious data access patterns as they happen, not after the fact.
for your agent stack.
Navil doesn't just detect threats — it learns from them, generates new defenses, and distributes immunity across every node in the network.
Runtime Monitoring
568 detection patterns across 36 attack categories. Static scanning catches 1.7% of threats. Navil catches the other 98.3% — at execution time.
Self-Improving Intelligence
Novel threats automatically become new defenses. The engine discovers, learns, and deploys — autonomously. Coverage improves every week without a single engineer touching it.
Coverage Scoring
Run navil test and get a real number: "84.7% of known patterns blocked." See gaps by category. Measure your posture, don't guess.
Community Threat Network
Every anomaly detected locally is anonymized and shared. Every proxy protects every other proxy. More users, more signal, better detection.
AI Policy Builder
Closed-loop policy engine: observe → detect → suggest → approve → enforce. AI writes governance rules from your agents' actual behavior. You sign off.
Credential Governance
OIDC token exchange with scope narrowing and cascade revocation. No more API keys hardcoded in configs or shared across agents.
Know your coverage score.
Not just "we're secure."
navil test runs 568 detection patterns across 36 categories against your proxy and tells you exactly what's covered and what's not. CI/CD integration via --threshold 90.
Closed-loop governance: observe → detect → suggest → approve → enforce.
Navil's AI features work with any LLM — Claude, GPT, local models. Bring your own API key or use the built-in engine.
When Navil finds a problem, it fixes it — automatically.
Config Drift Detection
Monitors your MCP configuration continuously. Detects when it drifts from your approved security baseline — exposed ports, missing auth, new unvetted servers.
Auto-Remediation
Misconfiguration detected? Navil automatically fixes it or proposes a fix. No ticket queue. No waiting for the next sprint.
Anomaly Response
When an anomaly detector fires, Navil doesn't just alert — it automatically tightens policies, quarantines the suspicious agent, or blocks the tool call chain.
Continuous Learning
Every remediation action feeds back into the policy engine. Future detections get faster. False positives decrease. The system sharpens itself.
Full audit trail. Every tool call. Every file touched. Searchable.
Audit Log
Complete record of every tool call, file access, and response. Filter by agent, server, time range, or threat category.
Trust Scores
Per-agent trust scores based on behavioral analysis. Anomaly timelines show when and why trust dropped.
Dashboard
Real-time fleet visibility. Policy violation alerts. Coverage trends over time.
of agent security.
568 detection patterns. 36 attack categories. 1M+ combinatorial scenarios. Published as open data.
Take the Security AssessmentLive threat intelligence.
From the entire network.
See what the community is detecting in real time. Every Navil proxy contributes anonymized threat signals — filtered by MCP, CLI, or all protocols. The radar is the immune system's nervous system.
One command. Zero config changes.
Any MCP Client
Navil wraps your mcp_config.json — if your agent uses MCP, Navil works. No plugins, no adapters, no vendor-specific setup.
CLI Tools
gh, kubectl, aws, and any CLI binary. PATH-prefix shims extend governance beyond MCP to everything your agents touch.
CI/CD
GitHub Actions integration. Every PR that touches an MCP config gets scanned automatically. Results in the Security tab.
Invisible overhead.
Real numbers.
| Per-message pipeline | Mean / p99 |
|---|---|
| Full pipeline | 2.7 µs / 6.1 µs |
| JSON parse | 0.9 µs / 2.0 µs |
| Policy lookup | 0.5 µs / 1.2 µs |
| Anomaly scan | 0.3 µs / 0.8 µs |
| Session wall-clock | Overhead |
|---|---|
| Light (5 calls) | +0.5 ms |
| Medium (50 calls) | +1.4 ms |
| Heavy (500 calls) | +12.3 ms |
< 0.1% of total session time on real workloads.
No credit card required. The open-source core is Apache 2.0 forever. Commercial tiers add scale, not lock-in.
- 25 agents / 25 API keys
- 60 req/min
- 11 anomaly detectors
- 568 threat patterns
- 48h-delayed threat patterns
- 50 agents / 50 API keys
- 1,000 req/min
- Real-time threat feed
- CI/CD SARIF output
- Slack & Discord webhooks
- 100 agents / 100 API keys
- 5,000 req/min
- Basic OIDC
- 5 custom threat rules
- Email support (48h SLA)
Security that gets smarter
while you sleep.
Self-improving AI threat intelligence. 568 detection patterns. 36 attack categories. Coverage that compounds. One pip install.
Start Free — No Credit Card