The Firewall for AI agents.
Intercept every tool call before it executes. Enforce runtime policies with ALLOW, DENY, or ESCALATE - in milliseconds.
Edit the arguments. The engine re-evaluates every change - these are real verdicts, not canned responses.
Evaluating…
Drop the amount below $1,000 and verify the payee to get an ALLOW.
This is a demo of the policy engine, not the product itself - the real Verdicter is an SDK you install in your own agent, plus a dashboard for policies and audit trails. Try your own prompt
How it works
Now put it in your agent.
Three steps. No infrastructure to run.
Step 1
Install the SDK
Add @verdicter/sdk (npm or pip) to your agent's codebase. A few lines, no infrastructure to run.
Step 2
Write policies
Define what your agents can and can't do - in the dashboard or in code. Test them in the sandbox first.
Step 3
Every tool call is evaluated
Verdicter intercepts each call your agent makes and returns ALLOW, DENY, or ESCALATE before it executes.
Works with every agent framework
Mistral
Groq
Hugging FaceMistralGroqHugging FaceThe hard truth
System prompts are
not security.
A system prompt can influence an AI's behavior. It cannot reliably enforce what's allowed once that output starts causing real-world side effects - a tool call, a database write, an API request, an outbound email.
System prompts were never designed to be a security boundary. A prompt injection, a hallucinated argument, or a sufficiently persistent user can bypass them. When that happens, the only thing standing between your agent and a serious incident is the enforcement layer you built around it.
Verdicter adds that layer - between the model and execution.
Why now
Agents are shipping.
Guardrails aren't.
LLM agents call tools, send emails, move money, and touch production. A prompt injection or hallucinated argument is one tool call away from a serious incident. Verdicter sits between your agent and the world.
Tool calls outpace review
Agents make thousands of decisions per minute. Human review doesn't scale.
Prompt injection is real
Adversarial inputs bypass system prompts. You need enforcement at the boundary.
Auditors are asking
SOC 2 and emerging AI regulations require provable controls on agent actions.
Start here
What can your agent
actually do?
Paste your tool definitions for a per-tool risk breakdown, the exfiltration paths across them, and a starter policy that closes the gaps. No account, nothing stored.
The verdict
Every tool call gets
a decision.
A verdict on every action your agent takes, written to an immutable log the moment it happens. Three outcomes, one boundary.
Policies
Write the rule once.
Every agent obeys it.
A policy is a set of rules - a condition, then a verdict. Every tool call is evaluated against them and returns ALLOW, DENY, or ESCALATE in 0.02ms. Test changes in the sandbox before they go live.
action_type == 'issue_refund'thenallow_if payload.amount <= 500Auto-approve small refunds
action_type == 'issue_refund'thenescalate_if payload.amount <= 5000Send mid-size refunds for review
action_type == 'issue_refund'thendenyBlock anything larger
Escalations
When it matters,
a human decides.
High-stakes actions don't get blocked or blindly allowed - they pause for review. Approve or reject from the dashboard, or wire a webhook to get alerts in Slack, email, or your own tools. Unanswered escalations auto-reject on timeout, and every decision is logged.
Agent
billing-agent · prod
Risk
Reason
Refund of $1,240 exceeds the $500 auto-approve threshold.
Payload
{ "amount_usd": 1240, "order": "ord_9f2a" }Observe
Every session, as a timeline.
Each agent run is a full execution trace - every tool call, decision, and policy hit, in the order it happened. Trace an incident to the exact action, without grepping logs.
Shadow mode
Don't take our word for it.
Watch first.
Run production traffic with enforcement off. Every policy still evaluates and every verdict is recorded, but nothing is blocked.
The report shows what would have been stopped: the exact calls, tools and agents.
Start in shadow modeIllustrative figures. Your report is built from your own traffic.
Platform
Everything you need to ship agents safely.
One platform, three jobs: decide at the boundary, prove what happened, and ship policy changes without breaking production.
Decide
A verdict on every action, before it runs.
Enforce
Policy engine returns ALLOW, DENY, or ESCALATE in 0.02ms.
Shield
Prompt-injection and jailbreak detection on inputs and tool arguments.
Escalations
High-stakes actions pause for approval in Slack, Teams, or PagerDuty.
Budgets
Cumulative spend and rate ceilings that catch the loop a per-call rule can't see.
Prove
An immutable record of what happened.
Observe
Full session traces with replay - every call, decision, and policy hit.
Comply
SOC 2, GDPR, and HIPAA-ready reports from a signed audit log.
Identity
Track which credential each tool call used. Rotate, scope, revoke.
Kill switch
Freeze every tool call instantly, workspace-wide or one environment.
Ship
Change policies without breaking prod.
MCP Adapter
One line puts any MCP server behind Verdicter.
Sandbox
Test policies against multi-step scenarios before you ship.
Verdict regression
CI replays real traffic and fails any PR that would break a working call.
Policy library
Two dozen tested policies, mapped to SOC 2, PCI, HIPAA and GDPR.
Security & trust
Built to sit in the critical path.
Verdicter sits in the critical path for every agent action. Here's how that position is protected.
Includes the controls we don't have yet.
Account isolation
Every evaluation, policy, and audit record is scoped to your API key. No data crosses account boundaries - enforced at the database query level, not just the application layer.
Keys stored as hashes
Your API keys are never stored in plaintext. Only a one-way hash is persisted, so even a database read can't leak a usable key.
Immutable audit log
Every evaluation decision is written as an append-only record. You can export the full log at any time - useful for internal reviews, incident response, or compliance evidence.
Latency you can accept
A full API call - auth, policy fetch, decision and audit write - completes in 23ms at the median, 36ms at p95. The policy decision itself takes 0.02ms of that.
Encrypted in transit
All traffic to the API and dashboard is served over HTTPS. There is no unencrypted path to your evaluation data.
You can see everything
The full trace for every evaluation - which rules ran, what matched, how the decision was reached - is visible in your dashboard and returned in the API response.
Pricing
Simple, transparent pricing
Hobby
For personal projects and exploring Verdicter.
- 10,000 evaluations / month
- npm + Python SDK
- 3 registered agents
- 5 active policies
- 7-day audit log retention
- Runtime enforcement
- Shield prompt scanning
- Sandbox (5 scenarios)
- GitHub Actions integration
- MCP adapter (@verdicter/mcp)
- Identity: credential tracking (20 credentials)
- Escalation approvals (dashboard)
- Community support
Starter
For solo developers shipping agents to production.
- 50,000 evaluations / month
- npm + Python SDK + direct REST API
- 10 registered agents
- 20 active policies
- 30-day audit log retention
- Runtime enforcement
- Observe: session tracing + replay
- Time-based policy scheduling
- Cumulative budgets
- Shield: custom injection rules
- Sandbox (50 scenarios)
- GitHub Actions integration
- MCP adapter (@verdicter/mcp)
- Identity: credential tracking (100 credentials)
- Escalation approvals (dashboard)
- Email support
Pro
For teams running AI agents in production.
- 250,000 evaluations / month
- npm + Python SDK + direct REST API
- Unlimited agents
- Unlimited policies
- 90-day audit log retention
- Runtime enforcement
- Observe: session tracing
- Cumulative budgets
- Shield: custom injection rules
- Comply: SOC 2, GDPR, HIPAA reports
- Sandbox: unlimited scenarios
- GitHub Actions integration
- MCP adapter (@verdicter/mcp)
- Identity: credential tracking (unlimited)
- Team members (shared workspace plan)
- Escalation approvals (dashboard)
- Escalation routing (Slack, Teams, custom webhooks)
- Email support
30-day money-back guarantee
FAQ
Common questions
The things teams ask most before wiring Verdicter into the critical path.
Do I need an autonomous agent to use this?
No. Wrap the call between your LLM and whatever it triggers - a database write, an email, an API request. One call, no loop required.
What counts as an evaluation?
Every call to verdicter.evaluate() - or a direct POST to /v1/evaluate - counts as one evaluation, regardless of the decision (ALLOW, DENY, or ESCALATE).
Does Shield scanning count toward my quota?
No. Shield scans for prompt injection are tracked separately and never deducted from your evaluation quota.
What's the difference between the SDK and the REST API?
Verdicter ships official SDKs for TypeScript/Node.js (npm) and Python (pip) - both available on all plans. The SDKs wrap the REST API with types, retries, and adapters for LangChain and Vercel AI SDK. The raw REST API is available on Starter and above for teams using Go, Ruby, or any other language.
What happens when I hit my monthly limit?
Additional evaluations are blocked until your quota resets on the 1st of the month. You can upgrade at any time to restore access immediately.
Is my agent payload data stored securely?
Yes. All evaluation data is logically isolated per account - every record is scoped to your API key and no other customer can access it. API keys are stored as hashes and never in plaintext. Every evaluation is written as an immutable audit log entry that you can inspect and export from the dashboard.
Can I upgrade or downgrade at any time?
Yes. Changes take effect at the start of your next billing cycle.
Start in five minutes.
Install the SDK, wrap one tool call, and start securing your agents - before your coffee gets cold.