Self-hosted · Your VPC

Run Kavros in your VPC

Hardware-enforced egress security for your AI agents. The entire stack runs inside your AWS account — and your agents need no code changes.

Minimum changes to go live

1 · One-time

Provision the stack

Provide your AWS VPC and a few values. One terraform apply provisions the control plane, data plane, and enclave in your account.

Deployment guide →
2 · Per agent

Choose an integration

Use @kavrosai/cli for scripts, the JSON HTTP contract from any language, or the optional Python hook for zero-code interception.

Agent integration → Developer integrations →
3 · Optional

Add your LLM key

For employee chat, add your Anthropic or OpenAI key in the dashboard under Teams → LLM Provider (BYOK). It is encrypted at rest.

The quick version

# 1. Provision (AWS VPC + a few values)
terraform apply

# 2. Configure workload credentials
export KAVROS_API_URL="https://<data-plane-host>/api/agent/egress"
export KAVROS_API_KEY="<workload-api-key>"
export KAVROS_AGENT_ID="<workload-id>"

# 3. Choose a client
npm install --global @kavrosai/cli
kavros doctor

# Or use the Python zero-code hook
python -m pip install kavros-agent

What we need from you

  • An AWS account (and permission to create EC2, RDS, and IAM roles).
  • A VPC with subnets to host the stack.
  • A DNS name for your dashboard (e.g. kavros.acme.com).
  • Your agent workloads (or the repos that run them).

What you get

  • Control plane + data plane + AWS Nitro Enclave, in your VPC.
  • Allowlist & DLP enforcement with NSM attestation on every decision.
  • Audit logs, compliance evidence exports, usage metering, and model routing.
  • Granular RBAC: Super Admin, Org Admin, Auditor.