Axtary
Summary
An AI agent approves a pull request, then quietly swaps the payload before the connector fires — and you never know until prod breaks. Axtary exists to close that gap: it binds every approval to the exact payload hash reviewed, so a changed diff is a rejected diff.
Axtary sits beside the agent and evaluates each tool call against deterministic policy before the underlying provider is called. Routine actions — ones that clear the policy rules — pass automatically. Higher-risk actions pause for a human to review the normalized payload, and the approval is cryptographically tied to that specific hash. If anything changes after sign-off, the adapter catches the mismatch and blocks execution. Every attempt, pass, and rejection lands in a verifiable ledger. The self-hosted path keeps provider credentials local, which matters for teams that cannot route credentials through a third-party service.
Bottom line: Pick Axtary for a pilot where you need auditable, payload-level approval gates on agent-driven GitHub or Slack actions — but expect to build your own integration scaffolding if your stack falls outside the documented connector set.
Pricing Plans
Subscription- Free Tier
- Local use only; no hosted approvals or team dashboard
Local
Run published CLI and packages locally with policy checks and ledger
- No account required
- Local policy and payload checks
- Action ledger and verification tools
Founding Team
Hosted approvals and team features after 30-day pilot
- Shared review and evidence
- Team dashboard
- Direct support during pilot
Enterprise
Custom scoped agreement for security and deployment requirements
- Identity and retention scoping
- Support terms agreed before rollout
View full pricing on axtary.com →
Pricing may have changed since last verified. Check the official site for current plans.
Community Performance Report Card
No community ratings yet. Be the first to rate this tool!
Community Benchmarks Community
Sign in to submit a benchmarkNo community benchmarks yet. Be the first to share a real-world data point.
Pros
Sign in to edit- Payload hash binding ties every human approval to the exact diff or message reviewed, so a payload altered after sign-off is rejected at the adapter before the provider is called — eliminating the attack surface where approval covers a summary rather than the literal content.
- Deterministic policy evaluation on routine actions means low-risk tool calls clear automatically, so human reviewers only see the calls that actually warrant attention rather than approving every agent action manually.
- Self-hosted policy enforcement keeps provider credentials local, so teams under data-residency or credential-exposure constraints can run authorization checks without routing sensitive tokens through a third-party service.
- A verifiable ledger records every decision, pass, execution result, and trace reference, so teams facing a post-incident audit have a timestamped, tamper-evident record of what the agent was authorized to do and what actually ran.
- ActionPass artifacts carry normalized action records — actor, intent, resource, constraints, and policy version — structured for consumption across SDKs and MCP wrappers, so teams can integrate authorization evidence into existing tooling without custom log parsing.
Cons
Sign in to edit- The hash-binding guarantee only holds for connectors that implement the adapter-side verification step. Teams whose agents call tools outside the documented connector set — anything not in the GitHub, Slack, Linear, AWS/GCP, MCP, or document-search list — must write and maintain their own adapter verification before Axtary's core security property applies to those calls.
- Axtary enforces policy on proposed actions; it does not generate, plan, or sequence agent tasks. Teams that need an authorization layer bundled with agent orchestration — where the same system routes tasks and enforces rules — will hit this ceiling immediately and look at platforms that combine both concerns.
- The product is in access-request stage with a small documented connector surface, which means teams with production timelines that cannot absorb an integration build or a waitlist delay will default to a more established policy enforcement tool rather than waiting for connector coverage to expand.
Community Reviews
Sign in to write a reviewNo reviews yet. Be the first to share your experience.
About
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- 2026-07-26T13:29:47.000Z
Best For
Who it's for
- Teams needing agent action approvals
- Local-first policy checking
What it does well
- Policy enforcement on AI agent tool calls
- Payload verification before GitHub or Slack actions
- Ledger evidence for non-production agent workflows
Integrations
Discussion Community
Sign in to commentNo discussion yet. Sign in to start the conversation.
Compare Axtary
Spotted incorrect or missing data? Join our community of contributors.
Sign Up to ContributeCommunity Notes & Tips Community
Sign in to contributeBe the first to contribute. General notes, observations, gotchas, and tips from people who use this tool day-to-day.
Frequently Asked Questions
- Is Axtary free?
- Axtary has a permanent free tier alongside paid upgrades. You can keep using a baseline version indefinitely without paying.
- Is Axtary open source?
- No — Axtary is a closed-source tool. Source code is not publicly available.
- Can I self-host Axtary?
- Yes. Axtary supports self-hosting on your own infrastructure.
Hours Saved & ROI Stories Community
Sign in to contributeBe the first to contribute. Concrete time/cost savings, with context. e.g. "Cut my code review backlog from 4h to 45m per week."
Curated lists that include this category
Most authorization layers tell an agent what tools it can use. They say nothing about what it is allowed to do with those tools on a specific payload at a specific moment. Axtary intercepts the tool call, normalizes the action record — actor, task, resource, constraints, and payload hash — evaluates it against policy rules, and either passes it, blocks it, or routes it to a human for review of that exact payload. The signed ActionPass artifact expires and is bound to the reviewed hash; the connector adapter verifies the hash again before calling the provider. If the payload has been altered between approval and execution, the call is denied and both hashes are recorded in the ledger.
The payload-binding mechanism is the differentiating feature. Approval is not a broad permission to invoke a tool — it is authorization for a specific action with specific content. The vendor’s demo illustrates this with a tampered Slack message that injected a credential token after human sign-off; the adapter caught the hash mismatch and blocked the post before the Slack API was called. This closes the class of attack where an agent or compromised intermediary re-writes a payload after a human has already reviewed a summary rather than the literal content.
Axtary fits teams running pilots of agent workflows against security-sensitive targets: production repositories, infrastructure paths, internal Slack channels, cloud storage with sensitive prefixes. The ledger provides evidence for post-incident review and compliance documentation in non-production contexts. Where it does not fit: teams that need the tool to plan or orchestrate work — Axtary enforces policy on actions agents propose, it does not generate or sequence those actions. Teams whose connectors fall outside the documented set (GitHub, Slack, Linear, AWS/GCP reads, MCP tool calls, document search) will need to build adapter-side verification themselves before the hash-binding guarantee applies.
The self-hosted deployment runs policy evaluation locally so provider credentials never leave the host environment. The vendor describes a CLI-first workflow — `axtary run workflow` — used for reproducing and testing policy scenarios. ActionPass artifacts are designed to be consumed across SDKs, proxies, and MCP wrappers, so teams already using MCP-compatible tooling can slot verification in without replacing the agent runtime.