Trust your AI
supply chain.
A self-hosted registry for every model, agent, MCP, and skill in your stack:
verified before it runs, governed while it runs, provable after the fact.
The models, agents, MCPs, and skills your teams are shipping are unsigned, unscanned, and unaccountable.
Enabling AI across your enterprise opens the largest unverified surface in your stack. The next breach won't come from your code. It'll come from an artifact your team trusted by default.
Learn more about Jozu's perspective on security:
-
Backdoored models in production
Weights pulled from public hubs land directly in serving infrastructure. Static scanners can't see what's hidden in the parameters.
-
Compromised agents and MCPs
Tool-poisoning, shadow tools, prompt injection through dependencies. Every install is an unknown actor with execution rights.
-
No chain of custody
No signatures. No attestations. No way to prove which model produced which output, or which version of an agent took which action.
-
Runtime damage, no audit answer
When something goes wrong, whether exfiltration, unauthorized action, or a regulator's question, there is nothing tamper-evident to fall back on.
Jozu is the supply chain
security layer for AI.
From the artifact your team pulls in, to the action it takes in production. One chain of custody, end to end, across models, agents, MCPs, and skills.
Jozu Hub
Centralized, signed, scanned, attested. The registry that decides whether a model, agent, or MCP is allowed into your environment at all. Deployed on your infrastructure.
Explore Jozu HubJozu Agent Guard
Runtime policy enforcement on every agent action, including the local tool calls and stdio operations gateways can't see. Deploys to servers, desktops, edge, IoT, and air-gapped networks.
Explore Agent GuardWhat Hub does that a container registry can't.
Scanning built for AI artifacts
Nine vulnerability classes, from code that executes on load to backdoored weights, data poisoning, prompt injection, and license violations. Results ride with the artifact as signed attestations.
Artifact diffing
Side-by-side comparison of ModelKit versions: what changed in weights, configuration, dependencies, and training data. Turn "what's different about v3?" into a diff, and enforce CI/CD policy on it.
Timeline and lineage
Complete version history for every artifact from experiment through staging to production. The SHA in production traces back to the exact training run.
Rapid Inference Containers
Composed at pull time from your hardened base image and the ModelKit, with no build step. The same ModelKit serves vLLM, llama-cpp, or your custom runtime by changing one path segment. In internal testing a Llama 3.2 8B model was serving in 42.8 seconds versus 425.4 seconds for a conventional container build, roughly 10x faster.
MCP Registry API
Hub implements the MCP registry specification. VS Code, Cursor, and Claude Desktop point directly at Hub for centrally curated, security-scanned MCP servers.
Policy administration
Author policies once, distribute them as versioned, signed OCI artifacts, and enforce them at pull time in Hub and at admission and runtime in Agent Guard.
Zero-trust standards,
extended to AI.
The same discipline you already apply to firmware, containers, and software dependencies, now for models, agents, MCPs, and skills.
Every artifact verified
Cosign signatures, OCI attestations, scanning across nine vulnerability classes. Provenance enforced before execution.
Every action governed
Policy enforcement at admission and runtime. Human-in-the-loop via MCP elicitation where it matters.
Every event provable
Cryptographically chained, tamper-evident audit. Covers the artifact, the agent, the action, the operator.
Run anywhere
Self-hosted, on-prem, edge, air-gapped. No cloud dependency. No central controller required.
ARCHITECTURE
Jozu Hub signs and serves the artifacts. Jozu Agent Guard enforces them at runtime, on-prem, at the edge, or fully air-gapped.
Policies (SHA verified)
Edge, Air-Gapped
- Prompt Filtering
- I/O Filter
- Policy Enforcement
- Tool Access Control
- Audit Logging
- Agents
- MCP Servers
- Models
Agent Guard operates without compromise in disconnected environments.
Security teams ship AI
on Jozu.
We're building a vendor-agnostic MLOps platform and KitOps ModelKits align perfectly with that vision. They work wherever our containers do — on-prem or in the cloud — giving us the freedom to store and deploy ML artifacts without being tied to a specific infrastructure.
How Jozu compares.
Side-by-side breakdowns vs the registries, MLOps tools, and runtime guardrails you're probably evaluating.
+ How is Jozu different from an AI gateway?
Gateways inspect what crosses the network. Jozu starts at the artifact, verifying every model, agent, MCP, and skill before execution, and enforces policy on every action, including the local tool calls and stdio operations a gateway never sees.
+ Does this slow down my engineers?
No. Approved artifacts are available immediately from the registry. Verification, signing, and scanning happen at admission, not at every request. Local enforcement runs alongside the agent, not in the request path.
+ Does Jozu work air-gapped?
Yes. Both Jozu Hub and Agent Guard are designed for self-hosted, on-prem, edge, and fully air-gapped deployments. No cloud dependency. No central controller required.
+ Where does Jozu fit with KubeFlow, KServe, and KitOps?
Jozu Hub hardens KubeFlow pipelines and KServe deployments with automated scanning, tamper-evident storage, and governance. It uses KitOps ModelKits as the artifact format, so your existing infrastructure stays in place, and you don't have to replace your tools.
+ What does an Agent Guard deployment look like?
Agent Guard runs alongside the agent, on a server, a developer laptop, an edge node, or an air-gapped workstation. It enforces admission and runtime policy locally, with no central controller dependency, and ships cryptographically chained logs to Jozu Hub for audit.
+ How do you handle unverified artifacts already in production?
Most teams start by importing existing models, agents, MCPs, and skills into Jozu Hub for inventory and scanning, then route new deployments through Agent Guard. Existing workflows keep running while the unverified backlog gets cleared.
Request your free Jozu trial
Interested in testing Jozu in your private environment? Download the Helm Chart, and start your 2-week trial.
-
STEP 1
Install
Jozu Hub can be installed in your environment in just 1-hour, with no disruptions to existing workflows. We suggest taking a baseline measurement of current deployment times and security gaps, to benchmark against.
-
STEP 2
Evaluate
Once installed, you can run real-world tests with your models and infrastructure for up to 2-weeks. This will allow you to measure Jozu's performance against your existing tools and processes.
-
STEP 3
Review
At the end of your 2-week trial our team will work with you to review your results, and help you quantify improvements and ROI. This includes an implementation and roadmap discussion.