One layer. Every framework. Every cloud.
Faramesh slots into the stack you already run. 13 agent frameworks, six credential brokers, the major observability platforms, and SPIFFE for workload identity. Drop it in. Keep your stack.
13 frameworks. Auto-patched at runtime.
Run faramesh and your framework's tool dispatch is patched at process start. No decorators, no wrappers, no code changes.
Your secrets stay in your vault.
Faramesh never stores credentials. When a policy permits a tool call, it fetches the secret from your broker just-in-time and injects it into the call.
Bring your own broker.
Faramesh requests the secret from your broker only when a policy permits the call. The agent never sees raw credentials.
Plug into the stack you already run.
Faramesh sends operational data to your existing dashboards and uses your existing identity system to track who's making each call.
Metrics in your existing dashboards.
Faramesh exposes a Prometheus-compatible /metrics endpoint. Scrape it with whatever you already use.
Real identities on every call.
Agents get cryptographic workload identities. Humans approve through your existing single sign-on.
Four ways to deploy. Pick what fits your stack.
Faramesh ships in shapes that match how teams actually run agents in production. Same enforcement, same audit format, same policies regardless of mode.
Run alongside your agent process.
Deploy as a sidecar container in the same pod as your agent. Tool calls cross a unix socket. Lowest latency, strong isolation, fits standard cloud-native patterns.
What we enforce, where.
Enforcement strength depends on what the operating system gives us. Use this as a deployment guide.
Audit logging works identically across all platforms. Tamper-evident records, hash-chained, regardless of how strong the runtime sandbox is.
One platform. Three pillars.
Ship your agents to production.
Every agent you deploy deserves a policy, an audit log, and a human in the loop.
Open source. Self-hosted or cloud. No credit card required.