Nyx Security secures the agent estate on one spine. Agentic Posture maps where you're exposed. Agentic Detection & Response instruments every tool call, model invocation, and MCP action in-process — attributed to the identity and code path behind it — and stops the exploit in-path, in real time.
# ADR is in-process instrumentation — no code change $ pip install nyx-monitor NYX_ENABLED=1 NYX_ENDPOINT=https://nyx/api/ingest python agent.py ✓ nyx installed boundaries=[model_client, tool_dispatch, mcp, effect]
The platform
Posture informs. Detection & Response detects and, where authorized, acts. Sell one plane to a depth buyer or both to a platform buyer — off the same agent-semantic spine.
Read-only · out-of-band
Read-only visibility into your AI agent estate — what agents can reach, what an attacker would actually exploit, validated with closed-loop probing, without ever touching production.
In-process · in-path · real-time
The first D&R category built on an agent-semantic data model — attributes every tool call, model invocation, and MCP action to the identity and code path behind it, with synchronous, in-path response.
The one-way rule — architectural, not a slide: posture findings never become enforcement directives, and runtime telemetry feeds posture's risk model but never reaches back into the runtime path.
The problem
An AI agent reasons, calls tools, reaches the network, and runs code — an autonomous loop your EDR, SIEM, and AI gateways can't attribute or stop. One poisoned input can turn a helpful agent into an exfiltration tool.
Untrusted content the agent fetches carries instructions it then acts on — reaching out to send your data somewhere it shouldn't.
The agent wields real credentials and tools on behalf of an attacker who never had them.
Keys used at runtime that no inventory or scan ever saw — invisible to static posture.
Outbound HTTP, subprocesses, MCP tools — real-world side effects fired from a model's decision.
The category
Instrument the substrate, correlate identity + action + context, detect malicious behavior, respond in real time. That lineage is well-worn — until you reach the agent. A SIEM sees “a process opened a socket,” not “Agent X, invoked by identity Y, called tool Z with tainted input from source W.” That gap is the category ADR opens.
Watches processes and syscalls on the host.
Watches traffic and flows across the wire.
Correlates endpoint and network, plus identity.
Tool calls, model invocations, MCP calls, effect-layer writes — attributed to the identity and code path that triggered them.
How it works
ADR installs inside the agent — injected at interpreter startup with zero code change. It wraps the four boundaries where an agent meets the world, capturing intent and ground truth as native agent events, not retrofitted syscalls or netflows.
The system prompt, messages, tools offered, and the tool_calls the model chose — OpenAI, Anthropic, Bedrock & Vertex.
Which agent ran which tool, with what input — LangChain, LlamaIndex, CrewAI & AutoGen.
Model Context Protocol calls, client and server side — tool, arguments, transport, and the authz assessment point.
The real side effects — outbound HTTP, subprocesses, egress — nested under the decision and identity that caused them.
Every event resolves to agent · identity · tool · args · taint · triggering line — attribution is the product, not a log line.
Two engines, one substrate
The same instrumentation drives both halves of Detection & Response — deterministic control for known risk, autonomous detection for the behavior nobody wrote a rule for.
Written rules — allow, deny, redact, or hold on specific tools, arguments, identities, or taint sources. Start in shadow, promote per rule to enforce. Known-bad and known-risky patterns get a synchronous, in-path verdict before the effect lands.
Behavioral baselining on agent action sequences — detects deviation from an agent's normal tool-use and invocation pattern with no human having written a rule for that specific deviation, and responds (hold, flag, or block, per policy) with no human in the loop at detection time.
This is the structure mature D&R already has — IOC rules plus behavioral ML. A firewall alone can't autonomously respond to behavior nobody wrote a rule for. Nyx does both, on one substrate.
Differentiation
Legacy D&R has the right motion and the wrong data model. AI firewalls have a closer data model and the wrong motion. Nyx ADR is the first with both.
| Capability | Nyx ADR | AI Firewalls / Gateways | Legacy EDR / XDR | CASB / API |
|---|---|---|---|---|
| Agent-semantic actions (tool calls, MCP, model invocations) | ✓ | ◐ prompt I/O only | ✗ | ✗ |
| In-process, in-path (not proxy / out-of-band) | ✓ | ✗ proxy/gateway | ◐ wrong data model | ✗ |
| Attributes action to triggering code path + identity | ✓ | ✗ | ◐ process-level | ✗ |
| Taint tracking across the invocation boundary | ✓ | ✗ | ✗ | ✗ |
| Synchronous real-time response (block / redact / hold) | ✓ | ◐ on content | ◐ on host behavior | ◐ rate-limit / revoke |
| Autonomous anomaly response (no pre-written rule) | ✓ | ✗ | ◐ host / process | ✗ |
Security & trust
ADR is real-time and in-path — which means the monitor must never break, slow, or expose the system it protects. And it complements your SOC: distilled, sanitized findings flow downstream to the SIEM/XDR you already run.
Fail-open by design. If Nyx errors, the agent runs exactly as it would have. ~20µs of overhead per call.
Payloads are hashed at the source by default. Full-content capture is per-agent opt-in — never the default.
Credentials are detected and fingerprinted for reconciliation — the secret itself is never recorded.
Deploy in your own cloud with row-level tenant isolation. BYOC and air-gapped self-hosting supported.
Get started
Land with Agentic Posture — read-only, no trust cost — to see where the risk actually is. Add Detection & Response as the in-path layer once posture has shown you where. Shadow mode available; no architecture change to start seeing detections.
$ pip install nyx-monitor NYX_ENABLED=1 python your_agent.py