Developer Control Plane for AI Agent Security and Governance
Nasiko is a developer-focused control plane designed to manage, secure, and govern AI agents at runtime. It addresses the operational challenges of scaling agent deployments by centralizing deployment, routing, security, and observability into a single process. Unlike traditional gateways or sidecars, Nasiko eliminates public exposure of agents by proxying all inter-agent traffic through its server, ensuring every hop is subject to rate limits, access controls, and tracing. This architecture enforces security and governance without requiring modifications to existing agent frameworks or proprietary formats, ensuring compatibility with agents built in Python, Rust, Go, or TypeScript—so long as they adhere to the Agent-to-Agent (A2A) protocol version 1.0.
The platform integrates deeply with modern AI workflows, including Large Language Model (LLM) providers, Multi-Tool Composition Protocol (MCP) servers, and custom toolkits. Instead, agents receive short-lived tokens and environment variables that resolve to the appropriate services at runtime, while all routing and authentication occur server-side.
Nasiko’s design prioritizes observability and control. Every agent interaction—whether routed or proxied—generates an OpenTelemetry (OTel) span, enabling end-to-end tracing across the system. Token usage and costs are automatically collected and attributed to specific runs, providing real-time visibility into AI spend. Additionally, Redis-backed flow guards monitor for runaway loops, excessive fan-out, or budget overruns, halting problematic workflows before they escalate. Secrets are encrypted at rest using AES-256-GCM and injected only at deployment time, further hardening security.
The platform’s governance model extends beyond basic access control. Policies are enforced at the gateway level, meaning tools or actions that violate rules are never presented to agents in the first place. This preemptive approach ensures compliance with organizational policies, reduces audit risks, and provides audit-ready logs for executive review. Nasiko also supports tenant isolation, mapping agents to owners, roles, and permissions to maintain clear accountability across multi-team environments.
How Nasiko Works
Nasiko operates as a single control-plane process that sits between agents and external services, acting as the sole ingress point for all inter-agent communication. This architecture ensures that no agent is directly exposed to the public internet, and every request—whether routed or proxied—passes through Nasiko’s enforcement layer. The system is built around three core components: the Nasiko server, backing services, and agent containers, all orchestrated via Docker.
The Nasiko server consolidates multiple functions into a unified process: authentication, routing, proxying, LLM management, and observability. The routing engine employs a three-stage pipeline to determine the optimal agent for a given request: shortlisting candidates based on embedding similarity, reranking using conversation context, and finally selecting the best match via an LLM. This ensures that callers interact with the most relevant agent without needing to know the fleet’s internal structure.
The LLM Router resolves the actual provider, model, and credentials server-side, ensuring no agent or log ever exposes real API keys. Similarly, the MCP Gateway provides agents with a merged, permission-filtered view of available tools and services, abstracting away the need for agents to hold credentials directly.
Backing services include Postgres for durable state storage, Redis for rate limiting and flow control, and RustFS (S3-compatible storage) for an embedded OCI registry. Observability is supported via OpenTelemetry, with traces collected by the OTel Collector and stored in Tempo or Loki. Agents themselves run in isolated Docker containers, pulling images from Nasiko’s embedded registry during deployment.
Flow guards, backed by Redis, monitor for depth limits, fan-out thresholds, token budgets, and cycle detection to prevent runaway agent loops. Secrets are encrypted at rest and injected only at deployment, while audit logs capture every decision—from tool permissions to cost attributions—ensuring transparency and compliance.
Key Use Cases
Nasiko is primarily designed for testing and red teaming of AI agents, but its capabilities extend to production-grade governance, cost management, and security enforcement. One of its most critical applications is in agent security hardening, where Nasiko’s proxy-based architecture ensures that no agent is publicly reachable, mitigating risks like unauthorized access or API abuse.
For organizations deploying multi-agent workflows, Nasiko provides runtime governance that aligns with enterprise policies. Policies such as tool restrictions, budget limits, and approval requirements are enforced at the gateway, ensuring compliance before any action is taken. Nasiko’s audit logs detail every decision—from model selection to cost attribution—providing the evidence needed for compliance reviews.
Cost management is another major use case. Nasiko forecasts the expected cost of a run before execution, routes requests to the most cost-effective model, and monitors spend in real time. By attributing costs to specific agents, teams, or models, organizations can avoid month-end surprises and treat AI spend as an operational metric. The platform’s ability to halt or escalate runs that exceed budgets or violate policies further refines control, ensuring resources are used efficiently.
Nasiko also excels in multi-harness and multi-provider environments, where workflows span different frameworks, vendors, or teams. The platform coordinates handoffs between providers, manages state across steps, and enforces consistent policies regardless of the underlying infrastructure. This interoperability allows organizations to leverage existing tools without replacement, reducing disruption while gaining centralized governance. For example, a workflow might begin with a lightweight model for initial processing and escalate to a more capable model only when necessary, all while adhering to predefined budgets and permissions.
In red teaming and security testing, Nasiko’s observability and control features are invaluable. Security teams can simulate attacks, monitor for policy violations, and validate defenses in real time. The platform’s ability to trace every tool call, retry, or loop provides visibility into potential vulnerabilities, while flow guards prevent malicious or accidental agent loops from consuming excessive resources.
Agent Deployment and Registry
The nasiko deploy command builds, pushes, and runs agents directly from source, using a self-hosted, S3-backed storage system with layer deduplication.
Intelligent Routing Engine
The routing engine uses a three-stage pipeline to match requests with the most appropriate agent. First, it shortlists candidates based on embedding similarity, ensuring semantic relevance. Next, it reranks candidates using conversation context to refine the selection. Finally, an LLM makes the final decision, balancing relevance with performance. This dynamic routing ensures that callers interact with the best-suited agent without needing to specify fleet details, abstracting complexity from the user.
Single Ingress and Proxy Architecture
Nasiko enforces a single ingress point for all agent traffic, ensuring that no agent is publicly exposed. Every inter-agent call is proxied through the server, where rate limits, access controls, and tracing are applied. The proxy also enables centralized logging and monitoring, providing end-to-end visibility into agent interactions.
LLM and Tool Gateway
Instead of holding real credentials, agents receive an OPENAIBASEURL and a token that resolves to the appropriate provider and model at runtime. Similarly, the MCP Gateway offers agents a merged, permission-filtered view of available tools and services, ensuring they only interact with authorized resources.
Observability and Tracing
Nasiko integrates with OpenTelemetry to generate OTel spans for every dispatch and proxy hop, enabling end-to-end tracing across the system. Token usage and costs are automatically collected and attributed to specific runs, providing real-time visibility into AI spend. Traces are stored in Tempo or Loki, allowing teams to analyze performance, debug issues, and optimize workflows. The platform also supports custom observability backends, ensuring flexibility in monitoring setups.
Flow Guards and Runtime Control
Redis-backed flow guards monitor for depth limits, fan-out thresholds, token budgets, and cycle detection to prevent runaway agent loops. These guards halt or escalate runs that exceed predefined limits, ensuring stability and cost efficiency.
Encrypted Secrets and Access Control
Secrets are encrypted at rest using AES-256-GCM and injected into agents only at deployment time, ensuring they are never exposed in logs or memory. This ensures that agents only interact with authorized resources and users, reducing the risk of unauthorized access or data leaks.
Embedded OCI Registry
The registry supports layer deduplication, reducing storage overhead and improving deployment speed. Agents can be pushed and pulled directly through Nasiko’s CLI, streamlining workflows and reducing dependencies on third-party infrastructure.
CLI-First Development
The CLI simplifies workflows for developers, allowing them to deploy agents, manage tools, and monitor activity without extensive configuration.
Multi-Platform Support
Nasiko supports deployment across Windows, macOS, and Linux environments, with two primary setup paths: Docker-only for end users and a Rust-based path for developers. The Docker path requires only Docker Engine and Compose V2, while the Rust path is intended for contributors who need to build from source.
Compliance and Audit Readiness
Nasiko enforces policies at the gateway level, ensuring that tools or actions violating rules are never presented to agents. This preemptive approach reduces audit risks and provides audit-ready logs for compliance reviews. Every decision—from model selection to cost attribution—is recorded in detail, offering transparency and accountability across multi-team environments. The platform’s tenant isolation features further enhance security by mapping agents to owners and roles, maintaining clear boundaries between teams.