For on-prem and air-gapped Kubernetes AI

The Fail-Safe for Enterprise AI.

Know what went into the AI you ship, control what it does in production, and prove it all. Jozu Hub verifies and secures models, agents and MCP servers. Agent Guard enforces your policy and contains your agents on your own Kubernetes, connected or air-gapped.

Talk to us Watch the demo

From the team behind KitOps, a CNCF project.

Built in the open

Created by the team behind KitOps, a CNCF project.

Runs fully disconnected. Awardable on the CDAO Tradewinds and Platform One Solution Marketplaces. Jozu for defense

Trusted by practitioners

We're building a vendor-agnostic MLOps platform and KitOps ModelKits align perfectly with that vision. They work wherever our containers do — on-prem or in the cloud — giving us the freedom to store and deploy ML artifacts without being tied to a specific infrastructure.

Tomasz Bochenski, Lead Machine Learning Platform Engineer, MLOps, DSV
Proven in production
One platform

Governance breaks at the seams

Supply chain security connected to Runtime security

Supply chain security

Vulnerability scanning, provenance, and signing for private models, datasets, agents, and MCP servers.

Supply chain security

AI guardrails

Policies that control prompts, responses, token usage, and sensitive data leakage.

Policy Gateway

Agents, tools, and MCPs

Least-privilege policies that control which tools an agent can use, and when.

MCP registry

Agent protections

A microVM with admission controls that isolates agents from your systems and untrusted MCP servers.

Agent Enclave

Cryptographic auditing

A cryptographically chained log of every action, for diagnosis or compliance evidence.

Jozu Hub
Span the lifecycle

No more gaps, no more patch work.

Verify

Before execution

Jozu scans every model, agent, and MCP server, from malicious code execution and backdoored weights to prompt injection and dataset poisoning. The results are signed and attached to the artifact, then artifacts that fail are blocked before they load.

How Jozu verifies AI artifacts
Enforce

During execution

Jozu enforces organizational policies wherever AI executes. Block malicious prompts and redact sensitive data when chatting with frontier models. For local agents we isolate them and control what goes in and out, and what tools they use.

How Agent Guard enforces policy
Prove

Across them both

Every policy decision, security scan result, human approval, and AI asset change is captured in one tamper-evident, cryptographically chained audit record. It's attached to your AI package's metadata and can be exported with just one-click.

How Jozu Hub keeps the record
Verify

Know what's inside before it runs.

Every model, agent, and MCP server is scanned across nine vulnerability classes, from malicious code execution to prompt injection or data set poisoning. Approved artifacts are signed so they can be verified by every client.

What you haven't approved doesn't run. Unvetted AI is blocked before it is loaded, stopping risky shadow AI.

See how scanning works
Doughnut chart breaking down 6 scans by severity: 2 passed, 1 low, 1 medium, 1 high, 1 critical
Enforce

Nothing gets past your policy.

Jozu Agent Guard evaluates every agent action against policy at the moment it happens, locally without any network dependency. Denied actions get a reason, an audit entry, and a compliant path forward.

Explore Agent Guard
Terminal showing AgentGuard denying a push to main because a pull request is required
Prove

Gain visibility into AI across your organization

Jozu lets you curate an approved catalog of models, agents, skills, and MCPs that are vetted and trusted. It keeps an immutable, tamper-evident log of all of it, so you can see the whole picture.

Jozu's audit log is cryptographically chained and can be used for regulatory compliance evidence.

Explore the registry
Audit timeline: Alice added as Admin, Tool Policy Updated, Security Report completed, Attestation data uploaded, ModelKit successfully signed
Integrated by design

How Jozu fits your stack

Jozu uses the same open source container standard you already use with Docker and Kubernetes. There's no vendor lock-in, or proprietary formats. Best of all, Jozu complements your existing tools.

Integration points

Jozu works with

  • Identity (Okta, Entra, Keycloak)
  • Data Loss Prevention (Forcepoint, Proofpoint)
  • SIEM and SecOps tools
  • Code and container scanners (Snyk, Trivy, Chainguard)
No changes required

Jozu doesn't change

  • Model training (MLFlow, Weights & Biases)
  • Model inference (KServe, Ray)
  • Prompt engineering tools
  • Model observability (Arize, HiddenLayer)
Jozu on Kubernetes Enterprise support for KitOps and ModelPack
Architecture Comparison

From a laptop to an air-gapped cluster

Jozu Hub deploys to your Kubernetes environment, on-prem or private cloud. Agent Guard runs on desktops, servers, and edge devices. Both are fully functional in air-gapped and DDIL environments: policies enforce locally, records are kept locally, and everything syncs when connectivity returns. Jozu has no SaaS dependencies, meaning we never see your data, it's completely private and sovereign.

OTHER SAAS SOLUTIONS

Vendor SaaS Control Plane

YOUR
ENVIRONMENT

Models and Agents
Data
Prompts, logs
  • Your data and outputs transit the internet
  • Enforcement depends on their uptime and your link to it
  • Audit records sit in someone else's tenant
NO SAAS DEPENDENCY NOTHING LEAVES

YOUR ENVIRONMENT

JOZU HUB + AGENT GUARD
Models
Agents
Prompts, logs
  • Your data stays on your infrastructure
  • Policy enforces locally, with no phone home
  • Audit records are yours, cryptographically chained
Jozu for defense and air-gapped networks Run Jozu Hub on-prem
The Problem

AI Creates Risk Faster
Than Policy Can React

All of these are already used in your org, and none of them enforce your policy.

Frontier AI

When humans or AI make mistakes, your sensitive data could end up on the internet.

AnthropicGoogle AIPerplexityOpenAIGrokElevenLabs

Vendor AI

Vendor Agents are directly integrated into your most used tools, with zero policy enforcement.

Microsoft CopilotAgentforceServiceNowZoom

Open Source AI

Your team can't verify the safety of public AI, inviting malicious AI in through the backdoor.

Llama by MetaKimiPhi-4GLM

What's needed is a consistent and machine enforced policy across all AI use cases.

See how Agent Guard enforces policy Case study: an agent disabled its own guardrails
End-to-end security

Two use cases, one platform

Jozu was designed to give enterprises the ability to secure, govern, manage, and track their AI, regardless of where it comes from. Jozu consolidates multiple point tools, into a single platform.

Use Case 1: Frontier and Vendor AI

Frontier AI /
Vendor AI

AnthropicOpenAIAgentforceMicrosoft CopilotGlean
Security wherever AI runs

Jozu Agent Guard

  • Block malicious prompts, responses, and unvetted MCPs
  • Redact sensitive data as it passes through the network
  • Enforce policies even when disconnected from the network
Explore Policy Gateway

Govern, Track,
and Manage Activity

Control access, prove results

Jozu Hub

  • Administer policies centrally
  • Capture and view all audit information
  • Export compliance evidence
  • Track Agent Guard instances, health, and connectivity
Explore Jozu Hub

Use Case 2: Local AI Agents

Open Source /
Self-Hosted Agents

KimiPhi-4Llama by Meta
Verify AI artifacts before production

Jozu Hub

  • Scan for security issues in AI artifacts
  • Administer policies centrally
  • Capture and view all audit information
  • Export compliance evidence
  • Track Agent Guard instances
Explore Jozu Hub

Secure Deployment
to Endpoints

Agent isolation and policy enforcement

Jozu Agent Guard

  • Isolate agents in a microVM
  • Guarantee only approved AI is used
  • Control agent access to files and tools
  • Block or redact sensitive data
  • Audit all actions and changes
Explore Agent Enclave
Govern AI in use

See how Jozu can protect your AI use

See a short demo where Jozu finds and redacts sensitive data from going into ChatGPT. Then stop Claude Code from downloading a dangerous package. Examples of real risks impacting you today.

Watch the demo
FAQS
How does Jozu Hub integrate with our existing CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions)?
Jozu works with the pipeline tools you already use. The platform integrates with Jenkins, GitLab CI, GitHub Actions, Dagger, and OpenShift pipelines. Models are packaged via the Kit CLI or Python SDK, stored in your existing registry using OCI standards, scanned for security issues, then deployed through your normal ML pipeline automation workflows. Jozu fits into your stack rather than replacing it - you keep your existing tools and authentication while adding security scanning, signed packaging, and attestation-based deployment gates. ModelKit CI/CD operations use standard commands that work in any pipeline environment.
Can we automate model scanning and evaluation in our CI/CD workflows using Jozu Hub?
Yes. Model scanning happens automatically when ModelKits are pushed to Jozu Hub. The platform performs checks for code injection, backdoors, data poisoning, prompt handling, and adversarial attacks. Security scan results are tracked per version, and you can download audit logs for compliance checks. Jozu can block deployments or pulls if SHA digests don't match signatures, ensuring only validated models reach production. This automated validation replaces manual security reviews that slow down deployment cycles.
How do we deploy ModelKits from Jozu Hub through our CI/CD pipeline to Kubernetes?
ModelKit Kubernetes deployment follows a straightforward process: Jozu auto-generates deployment artifacts including inference containers and Kubernetes manifests from your ModelKits. Your CI/CD ML deployment pipeline pulls the signed ModelKit, Jozu validates the SHA digest against the signature, and if validated, deploys to your Kubernetes clusters. Automated model deployment supports any cloud or on-premises Kubernetes distribution.
How does Jozu Hub use OCI artifacts to package ML models and datasets?
Jozu Hub packages models, datasets, codebases, and documentation as OCI Artifacts. Each component becomes a layer in the OCI artifact, enabling efficient storage and transfer since unchanged layers are deduplicated and don't need re-uploading or storage. Jozu’s OCI compliance means ModelKits work with any registry that supports OCI standards. The platform can even add SPDX 3 software bill-of-materials and signed provenance attestations to each package, creating an OCI model registry that maintains full lineage and audit trails while remaining compatible with your existing container infrastructure.
What are the benefits of using OCI standards for ML model management vs traditional approaches?
OCI ML benefits come from leveraging proven container infrastructure rather than building new systems. Unlike Git LFS, OCI provides efficient layer-based storage (unchanged components aren't re-uploaded), built-in versioning through tags and digests, cryptographic verification of content, and native support in Kubernetes. Container standards means your DevOps teams already know the tooling and workflows. Previous approaches scattered models across Git, S3, and experiment trackers - creating audit nightmares and unclear rollback processes. OCI-based ModelKits provide a single artifact with complete provenance that moves through your existing registry and deployment infrastructure.
How does Jozu Agent Guard govern MCP servers?
Agent Guard packages MCP servers as OCI artifacts with cryptographic signatures and attestations. Policies control which agents can call which tools, with what parameters, under what conditions. Your IDE (VS Code, Cursor, Claude Desktop) points to Jozu Hub as its MCP registry for centrally curated, security-scanned servers.
What happens when an agent encounters a policy that blocks it?
The agent is denied. Agent Guard fails closed — missing data or evaluation errors result in denial, not pass-through. For high-risk actions, ToolPolicy triggers human-in-the-loop confirmation. Every decision is logged in the tamper-evident audit trail.
Can Agent Guard work in disconnected or air-gapped environments?
Yes. Policies travel as OCI artifacts alongside the agents they govern and enforce locally with no connectivity to a central controller. Audit logs sync to Hub when connectivity is restored. This is a primary differentiator for defense, edge, and DDIL deployments.