# Quilzo > Quilzo gives every AI agent an identity, a policy, a budget and a signed record, asks a person before the actions that matter, and runs as one self-hosted binary. Quilzo is one Go binary with no third-party dependencies, licensed under Apache-2.0. Source: https://github.com/Quilzo/Quilzo ## Get started - [Get started with Quilzo in ten minutes](https://quilzo.github.io/start/): Build Quilzo, sign in, load a demo site and run your first AI agent, with or without a model. One binary, no dependencies, about ten minutes. - [Today, the first screen after signing in](https://quilzo.github.io/today/): The first screen after signing in: what waits for you, a brief whose every figure is a link, counts, and questions answered as views you keep. - [Install and run Quilzo in production](https://quilzo.github.io/install/): Build Quilzo from source or as a container, and run it safely: admin on loopback, TLS, a separate log writer, encrypted storage. - [Glossary: AI agents, MCP, A2A and the words Quilzo uses](https://quilzo.github.io/concepts/): What an AI agent control plane, an MCP gateway, A2A, prompt injection, human in the loop, earned autonomy and the other terms in this manual mean, in one place. ## AI agents - [Build an AI agent that asks before it acts](https://quilzo.github.io/agents/): Declare an AI agent's capabilities, budget and autonomy, make it ask a person before it writes anything, and read every run step by step, in the admin or as JSON. - [Limits that hold: what a hijacked AI agent still cannot do](https://quilzo.github.io/agent-limits/): Scope what an AI agent reads and calls, cap what it spends in money, and stop a hijacked agent leaking data, with limits enforced outside the model. - [Agents that pay, within limits a person sets](https://quilzo.github.io/payments/): Let an agent pay suppliers, top up credit or buy within a mandate a person grants: payees, a limit per payment, a budget and an end date, with a receipt each time. - [AI agent identity: sponsors, principals and signed receipts](https://quilzo.github.io/agent-identity/): Give every AI agent its own identity and a person who answers for it, stop it when they leave, and prove what any run did with a signed, checkable receipt. - [Evaluate AI agents against prompt injection, and let them earn autonomy](https://quilzo.github.io/evals/): Test an AI agent on real tasks, many times, with instructions planted in what it reads. It earns the right to draft or publish only by resisting them. - [Run an AI agent's own code in a sandbox](https://quilzo.github.io/programs/): Run a coding agent, script or agent runtime in a kernel sandbox where every action goes through its declaration and models are reached through Quilzo. - [Give an AI agent a browser it cannot misuse](https://quilzo.github.io/browser/): Let an AI agent read and act on websites in a sandboxed Chromium, with every request held to its declared hosts and every press that pays or sends approved. - [Let an AI agent run commands without a shell to misuse](https://quilzo.github.io/workspace/): Give an AI agent a folder of its own and the programs it may run, each command in a fresh sandbox, with deletes and network use approved by a person. - [AI agent memory people can see, correct and erase](https://quilzo.github.io/memory/): Let AI agents remember between runs without a hidden profile: memory per person, held when it came from untrusted text, and erasable with a receipt. ## Models and chatbots - [LLM gateway: model routes, budgets in money and a privacy guard, for any AI agent](https://quilzo.github.io/models/): One gateway for every AI agent's model calls, built here or in any framework: fallback routes, budgets in money, PII masking and memory. - [A RAG chatbot that answers from your pages and cites its sources](https://quilzo.github.io/chatbots/): Add a chatbot that answers visitors from your published pages, cites a source for every sentence, hands off to a person, and stores nothing a visitor asks. - [Stop prompt injection in RAG: screening, guardrails and poisoned pages](https://quilzo.github.io/chatbot-safety/): Keep planted instructions out of what a RAG chatbot reads, add Lakera Guard or Google Model Armor as a second check, and catch a poisoned page early. - [The writing assistant, and typed AI decisions with a confidence gate](https://quilzo.github.io/assistant/): Ask a model to draft pages that every publishing check still applies to, and let it answer typed questions with a confidence threshold below which a person decides. ## Connect - [Connect AI apps and agents to Quilzo over MCP, with OAuth and receipts](https://quilzo.github.io/agent-interface/): Connect Claude, ChatGPT, coding agents or your own agents to Quilzo over MCP, locally or with OAuth 2.1, each acting as one person, with a receipt for every call. - [MCP gateway: govern the tools AI agents call, with pinning and approvals](https://quilzo.github.io/integrations/): Give AI agents tools on MCP servers you approve, refuse a tool whose definition changed, and offer your MCP servers to other agents with approvals. - [Govern agents built with ADK, Agent Framework, LangChain, CrewAI and the OpenAI Agents SDK](https://quilzo.github.io/frameworks/): AI agents built with ADK, Agent Framework, LangChain, CrewAI or OpenAI's Agents SDK get their tools and models through Quilzo, governed and with memory. - [A2A: agent cards and tasks from other vendors' agents](https://quilzo.github.io/a2a/): Publish an A2A agent card that states each agent's capabilities, budget and oversight, and accept A2A 1.0 tasks from other agents, run under your declarations. - [AI agent inventory and shadow AI detection](https://quilzo.github.io/fleet/): One inventory of every AI agent, app, tool server and model route, who answers for each, who called what from the signed log, and shadow AI. - [The content API and the command line](https://quilzo.github.io/api/): A read-only or writable JSON content API with If-Match, and a command line where every command speaks JSON and exit codes tell a refusal from a failure. ## Content - [Make features as packages](https://quilzo.github.io/make/): Declare a feature as one package of types, records, pages, forms, agents, webhooks and roles, read what it can do, and install it or take it back as one decision. - [Research projects with claims you can check: numbers linked to code, real citations](https://quilzo.github.io/research/): Research projects for people and AI agents: a plan registered before the data, numbers only from code, and citations that must exist and support their claim. - [Evolve: search over programs with a sealed evaluator](https://quilzo.github.io/evolve/): Let a model improve a program generation by generation, scored by an evaluator in its own box that the programs cannot read, with a test set and a journal. - [Pages, sections and the editor](https://quilzo.github.io/pages/): Write pages in the admin or as JSON, build them from sections, leave notes, and see what differs from what is live, with every version kept by its hash. - [Content types and records](https://quilzo.github.io/types/): Define content types every surface enforces, bind pages to them, and keep structured records in collections, from the admin, the command line, the API or an agent. - [Structure, listings, menus and vocabularies](https://quilzo.github.io/structure/): Declare listings that show records on pages, menus that refuse a broken target, and controlled vocabularies, all checked before they publish. - [Forms with retention and erasure](https://quilzo.github.io/forms/): Collect form submissions the public server cannot read back, keep them only as long as their stated purpose needs, and erase what a person asks you to. - [Media: images, video and provenance](https://quilzo.github.io/media/): Upload images and video with required descriptions, derive crops and renditions without losing the original, require captions, and verify C2PA provenance. - [Design, themes and templates](https://quilzo.github.io/design/): Start from a template, generate a palette from one colour with contrast checked, and move design tokens in and out, in templates that cannot run code. - [Languages and translations](https://quilzo.github.io/languages/): Run a site in more than one language, see which translations are missing or were made from content that has since changed, and record what each was translated from. - [Member accounts and boards](https://quilzo.github.io/members/): Let visitors have accounts that sign in with passkeys, invite them, write on moderated boards, and erase an account completely on request. ## Release - [Review, publish, schedule and roll back](https://quilzo.github.io/publishing/): Review what changed, let the accessibility and content gates run, publish by moving a pointer, promote through environments, and roll back at once. - [Analytics, A/B tests and personalisation](https://quilzo.github.io/growth/): Count views, visitors, referrers and conversions without a cookie, run A/B tests that give a verdict only when there is one, and personalise by what a request says. - [Selling to shopping agents](https://quilzo.github.io/shopping-agents/): Let shopping agents find what a shop sells, through a product feed and UCP catalog search, lookup and product, priced from published records. - [Import, export, replicas and the permanent web](https://quilzo.github.io/transfer/): Leave whenever you like: export to Markdown, WordPress WXR, lossless JSON or RO-Crate, import from WordPress, replicate, and publish to IPFS. ## Security operations - [Collect security logs from Okta, Entra, GitHub, AWS and more](https://quilzo.github.io/collect/): Read sign-in and audit logs from Okta, Entra, GitHub, AWS and more; take events from Okta hooks, webhooks and Shared Signals; map any log you have. - [Detections, findings and threat hunting](https://quilzo.github.io/detection/): Detection rules with their own fixtures, Sigma import, one ranked findings queue, hunting for what is rare, and an analyst agent that can only suggest. - [Cases, incidents and regulatory clocks](https://quilzo.github.io/cases/): Open incidents that start the reporting clocks each regime sets (NIS2, GDPR, DORA, SEC, CIRCIA, HIPAA), run playbooks, and take two-person actions on other tools. - [Security automations, sign-ins, canaries and access reviews](https://quilzo.github.io/automations/): Automate responses that watch, ask or act; see sign-ins by office, VPN and impossible travel; plant canaries; and run access reviews and vendor checks. - [Vulnerability prioritisation with KEV, EPSS, SSVC and VEX](https://quilzo.github.io/vulnerabilities/): Import SBOMs and advisories, rank vulnerabilities by exploitation and exposure with CISA KEV, EPSS and SSVC, plan upgrades, and publish OpenVEX. - [Workforce risk across HR, identity and device tools](https://quilzo.github.io/workforce/): Join people and their machines across HR, identity, device and training tools, find what no one system sees, and score each person with reasons. - [The shield: Quilzo defends itself](https://quilzo.github.io/shield/): Playbooks decided in advance block, slow, lock down or pause the moment an attack shows; every protection ends by itself; changes take two admins. ## Compliance and audit - [Security posture and compliance frameworks](https://quilzo.github.io/security/): Continuous checks of how Quilzo is configured, each with why it matters and the fix, read as FedRAMP, NIST 800-53, ISO 27001, SOC 2, GDPR and the EU AI Act. - [EU AI Act and ISO/IEC 42001 evidence, and an AI bill of materials](https://quilzo.github.io/ai-evidence/): Evidence for the EU AI Act's deployer duties and ISO/IEC 42001 Annex A, read from what your agents, chatbots and models did, and a CycloneDX AI bill of materials. - [Evidence for an assessment: NIST 800-53, OSCAL and FedRAMP 20x](https://quilzo.github.io/compliance/): Show how Quilzo implements each NIST 800-53 control in OSCAL, draft an SSP, report FedRAMP 20x indicators, and give auditors one verifiable file. - [Content provenance and AI disclosure](https://quilzo.github.io/provenance/): Record who or what wrote every page, mark AI-generated content as the EU AI Act asks, and refuse to publish a page whose origin is unrecorded. - [Tamper-evident audit log with signed heads and proofs](https://quilzo.github.io/logging/): Every action in a hash-chained log, identifiers pseudonymised, heads signed with Ed25519 and ML-DSA, with proofs, anchoring and RFC 3161 timestamps. - [Privacy: what Quilzo keeps about people](https://quilzo.github.io/privacy/): What Quilzo keeps about visitors, members, staff and customers, how long, and how each is erased: forms, chatbot questions, analytics, memory, prompts and notices. ## Administration - [People, roles and permissions for working with agents](https://quilzo.github.io/people/): Grant roles on any part of the site, give jobs and agent permissions such as approve on one agent, deny where it must win, and explain why anybody can act. - [Single sign-on with OIDC and SAML](https://quilzo.github.io/sso/): Sign in to the Quilzo admin with Google Workspace, Microsoft Entra ID, Okta, or any OIDC or SAML provider, required per domain, with break-glass accounts. - [SCIM provisioning from Okta and Entra](https://quilzo.github.io/provisioning/): Let Okta, Microsoft Entra or another identity provider create, update, suspend and delete people through SCIM, with their groups mapped to Quilzo roles and jobs. - [Passkeys, tokens and sessions](https://quilzo.github.io/passkeys/): Sign in with passkeys and no password, issue API tokens scoped below their holder, exchange a token for a short session, and set session limits. - [Credentials for programs and CI jobs](https://quilzo.github.io/credentials/): Let CI jobs exchange their platform's identity token for a short Quilzo token, narrow any token with RFC 8693, and bind tokens to a key with DPoP. - [Settings and outbound network control](https://quilzo.github.io/settings/): Every setting with what it is for and what it costs, a recorded reason for any weakening, and every outbound connection named, with an offline mode. - [Run Quilzo on an isolated or air-gapped network](https://quilzo.github.io/isolated/): Run Quilzo on an isolated network with no outbound connections, a local model, classification markings, encrypted storage and recorded transfers across the gap. ## More - [Rooms and calls (experimental)](https://quilzo.github.io/collaboration/): Experimental building blocks: rooms with a stated purpose, calls encrypted end to end with SFrame (RFC 9605), screen sharing and an AI note-taker. - [Licence: Apache-2.0](https://quilzo.github.io/licence/): Quilzo is open source under the Apache License 2.0. Use it, change it, embed it in your own product and sell it, with no licence key and nothing held back.