Compliance at the gateway is necessary, but the apps those teams deploy still need the same skepticism on the other side of the fence. Auth bypasses, open storage and loose table rules do not show up in a FedRAMP checklist the way a missing control on the model path does. What has helped on small stacks is hitting the live URL as an anonymous visitor and as a second user. I built https://rowly.me to run that pass on AI-built apps automatically (sign-in, APIs, storage, database rules).
This is great, question though, since you support coding agents like Claude Code and Codex, they run MCP servers, plugins, web search/fetch and their own telemetry from the dev's machine. Do you give customers guidance or controls for that side, or is it out of scope for the gateway?
We had a lot of problems letting finding a balance giving technical coworkers acces to live data and AI tools. And there are multiple companies in this space that solve things in multiple ways, we happen to use https://gluondb.com which is what you describe plus BI.
Food for thought, tool and MCP calls run locally, but every request carries the tool list and every response carries the model's tool calls, both of which pass through you. You could strip non-approved tools from the request and block calls to them in the response, based on an org allowlist. That gives you org-approved MCP/tool calls without touching the dev's machine.
Great call. We already block certain tool schemas and flag URLs in tool-call arguments, and since we enforce org allowlists for models on every request, extending that to tools/MCP is a natural next step.
Interesting that the pitch is density: $0.37/month per sandbox implies a lot of them packed onto shared hardware. My sandbox experience is the malware kind: at Fortinet I ran NSS Labs testing on a sandbox engine, and a key question was whether results held as throughput tiers went up, with sample loss tracked per tier. Same question seems worth asking here: do isolation and agent performance hold at peak packing, not just average utilization?
How does ZDR work with requests that trip security measures in the model provider? Do the providers retain those requests for analysis or is that too guaranteed?
The infra providers call this "abuse monitoring" or "abuse detection" and we've worked with them to turn it off. We don't serve models like Fable that require it. We have one case remaining for OpenAI's GPT-5.x models in AWS. AWS's automated classifier can retain a flagged request for up to 30 days. Per AWS, that review is automated with no human access, the data stays in AWS GovCloud, and it's never shared with OpenAI. We are actively working to turn that off as well. Everything else is covered.
Correct. We have contractual agreements to ensure no data that passes through our platform will be used for model training purposes. In addition, we have in our contracts that we (Consus) will also not use any data for training purposes. We couldn't if we wanted to since we do not store any prompt data.
We've been focused on defense, so we haven't set up HIPAA (BAAs) yet. The underlying controls are essentially FedRAMP High, so it wouldn't be a big lift on our side. If you have a specific use case in mind, drop me a note at founders@consusindustries.co and we can talk more about it.
Compliance at the gateway is necessary, but the apps those teams deploy still need the same skepticism on the other side of the fence. Auth bypasses, open storage and loose table rules do not show up in a FedRAMP checklist the way a missing control on the model path does. What has helped on small stacks is hitting the live URL as an anonymous visitor and as a second user. I built https://rowly.me to run that pass on AI-built apps automatically (sign-in, APIs, storage, database rules).
This is great, question though, since you support coding agents like Claude Code and Codex, they run MCP servers, plugins, web search/fetch and their own telemetry from the dev's machine. Do you give customers guidance or controls for that side, or is it out of scope for the gateway?
We had a lot of problems letting finding a balance giving technical coworkers acces to live data and AI tools. And there are multiple companies in this space that solve things in multiple ways, we happen to use https://gluondb.com which is what you describe plus BI.
Seems like a pretty crowded space.
We do give our customers guidance to make sure they are thinking about this properly. This typically happens during on-boarding.
We also built out pre-defined controls for common tools so they can click a button and not think about it.
Food for thought, tool and MCP calls run locally, but every request carries the tool list and every response carries the model's tool calls, both of which pass through you. You could strip non-approved tools from the request and block calls to them in the response, based on an org allowlist. That gives you org-approved MCP/tool calls without touching the dev's machine.
Great call. We already block certain tool schemas and flag URLs in tool-call arguments, and since we enforce org allowlists for models on every request, extending that to tools/MCP is a natural next step.
Interesting that the pitch is density: $0.37/month per sandbox implies a lot of them packed onto shared hardware. My sandbox experience is the malware kind: at Fortinet I ran NSS Labs testing on a sandbox engine, and a key question was whether results held as throughput tiers went up, with sample loss tracked per tier. Same question seems worth asking here: do isolation and agent performance hold at peak packing, not just average utilization?
How does ZDR work with requests that trip security measures in the model provider? Do the providers retain those requests for analysis or is that too guaranteed?
The infra providers call this "abuse monitoring" or "abuse detection" and we've worked with them to turn it off. We don't serve models like Fable that require it. We have one case remaining for OpenAI's GPT-5.x models in AWS. AWS's automated classifier can retain a flagged request for up to 30 days. Per AWS, that review is automated with no human access, the data stays in AWS GovCloud, and it's never shared with OpenAI. We are actively working to turn that off as well. Everything else is covered.
I love this. Will this guarantee that proprietary/ sensitive/ CUI data won't leak to model training or other parties?
Correct. We have contractual agreements to ensure no data that passes through our platform will be used for model training purposes. In addition, we have in our contracts that we (Consus) will also not use any data for training purposes. We couldn't if we wanted to since we do not store any prompt data.
Does this work with HIPAA data ?
We've been focused on defense, so we haven't set up HIPAA (BAAs) yet. The underlying controls are essentially FedRAMP High, so it wouldn't be a big lift on our side. If you have a specific use case in mind, drop me a note at founders@consusindustries.co and we can talk more about it.