Questions
- What is CAIN Trust Fabric?
- What is CAIN Studio?
- What is MCPGate?
- How do the two sites work together?
- I'm completely new to AI engineering. Where do I start?
- I'm not a developer. Is there anything here I can just use?
- Can you just clean a document or check my AI for me?
- How do I build my first AI agent?
- How do I deploy what I've built?
- How do I monetize an AI product?
- How do I use the catalog?
- How do I use the job taxonomy?
- How does the chatbot work, and can I trust it?
- What does it cost to try any of this?
- Is my data used to train models?
- What if a service is down or a call fails?
What is CAIN Trust Fabric?
New to this
It's the safety layer for AI that does things. Modern AI doesn't just answer questions any more -- it books, buys, writes to databases, and calls tools. CAIN Trust Fabric sits in front of those actions and decides whether each one is allowed, then writes down what it decided so you can prove it later. You get it in one of two ways: hosted by us (CAIN Studio, at cainstudio.online) or installed in your own network (MCPGate, at mcpgate.online). Same thing, different address.Already an engineer
The parent platform: AI trust infrastructure for autonomous systems, organised as eleven trust domains -- Identity, Policy, Authorization, Risk, Governance, Verification, ActionProof, Security, Execution Enforcement, Evidence, Observability. The call path is: agent proposes -> control plane decides (identity resolved, policy evaluated, risk scored, plan verified) -> enforcement boundary enforces -> upstream executes -> decision recorded as retrievable evidence. Two deployment models: CAIN Studio is hosted (we operate control plane and boundary, subscription billing); MCPGate is self-hosted (you operate the boundary in your own network, perpetual license). It is not an agent framework -- it is reached over plain HTTPS and MCP, so any runtime can call it. Fabric enforcement is opt-in per deployment; /fabric/status reports whether a given deployment is enforcing or observing. Full architecture: https://cainstudio.online/fabricWhat is CAIN Studio?
New to this
A collection of ready-made AI services you call over the internet with one password (an API key). You don't install or host anything. If you want to check whether AI-generated code is correct, detect bias in a model, give an agent memory, or classify a system under the EU AI Act, there's a service for it that you can call in one line of code.Already an engineer
A single-API-key gateway fronting a fleet of independently deployed AI engineering and governance services. The gateway does entitlement checks live per request (fail-closed), meters per-call usage for billing, and enforces policy via OPA. Paths are `/<service>/<path>`; there's also an MCP server and a Python SDK over the same surface.What is MCPGate?
New to this
Tools you install on your own machines to run AI agents safely, plus the billing layer for selling access. Most of them are one purchase you keep forever, rather than a monthly bill.Already an engineer
A self-hosted trust-and-ops suite plus the licensing/entitlement layer. Twelve tools under one perpetual bundle license (sandboxed tool execution, signed decision audit, RAG source-hygiene gating, per-agent trust scoring, fairness and significance testing, DAG validation, metering, MCP fleet monitoring, aggregation), and four standalone products -- two free, two separate subscriptions.How do the two sites work together?
New to this
CAIN Studio is the hosted deployment -- nothing to install. MCPGate is the front -- you sell and control access there. Buying on either one gives you access on the other, so you're not paying twice.Already an engineer
CAIN TRUST FABRIC is the platform. CAIN Studio (cainstudio.online) is its HOSTED deployment and MCPGate (mcpgate.online) is its SELF-HOSTED deployment. Same architecture, same eleven trust domains, different operator: on CAIN Studio we run the control plane and the enforcement boundary for you; with MCPGate you run the enforcement boundary yourself, in your own network. A normal path is to prototype against the hosted deployment (no infra to run), then move the enforcement boundary in-house with MCPGate if your data or your regulator requires it -- and plenty of teams run both, hosted for development and self-hosted for production. They are cross-linked: an active subscription or license on either one unlocks entitlements on the other, in both directions, so the choice is operational, not a choice about which products you get.I'm completely new to AI engineering. Where do I start?
New to this
Three things, in this order, and don't skip to the third. (1) Run the free sandbox on the CAIN Studio homepage -- no signup, no card. It runs a scenario through the decision chain and shows you every stage and the evidence record, so you get a feel for what a CAIN decision looks like. (2) Read the Quickstart at /quickstart, which walks from one API call to a deployed agent. (3) Open the Glossary at /glossary when a word stops you, then come back. Turn on Beginner Mode in the chat bubble and ask it anything -- it's read all of these pages.Already an engineer
Skip the sandbox and go straight to /catalog for the live service list, /pricing for the real rate card (public, no key), and /docs for the API surface. The MCP endpoint at /mcp is the fastest way to drive the platform from an existing agent.I'm not a developer. Is there anything here I can just use?
New to this
Yes — two things, and both are free to try with no account and no code. "EU AI Act Check" (at /compliance) asks you 18 plain-English questions about what your AI does and tells you your real legal risk tier plus everything you're required to do; the signed report you can hand to a customer or investor is $149. "Document Safety Sweep" (at /compliance/sweep) takes a document and removes the email addresses, phone numbers, card numbers and passwords in it, then re-checks its own work to prove they're gone; the cleaned file is $49. Everything else on this site is tools for people building AI systems, so it's fine to ignore it.Already an engineer
Two outcome products, both deterministic with no model in the path: /compliance (EU AI Act risk classification from 18 booleans, signed PDF, public verification endpoint) and /compliance/sweep (PII/secret redaction with an independent post-redaction re-scan as the verification step). One-off pricing, own Stripe checkout, no API key or subscription — they bypass the gateway's entitlement check by design.Can you just clean a document or check my AI for me?
New to this
Yes, that's exactly what the two done-for-you products do. To strip personal data out of a file before you share it, use Document Safety Sweep at /compliance/sweep — paste the text and it shows you what it found for free. To find out where your AI stands legally in the EU, use EU AI Act Check at /compliance. Neither needs an account. Two honest limits worth knowing: the document sweep does not catch people's names or postal addresses, and the AI Act check is a screening aid rather than legal advice.Already an engineer
/compliance/sweep runs pii-redactor scan → redact → an independent re-scan of the output, then a legal-auditor document review, and signs the result. The verification re-scan is the sellable claim; if the engine's self-report and the re-scan disagree it refuses to report it as verified. Names and postal addresses are out of scope. /compliance wraps legal-auditor's flag-driven classifier.How do I build my first AI agent?
New to this
An agent is just a loop: ask the model what to do, do it, tell the model what happened, repeat. Start with the loop doing exactly one thing. Give the model a single tool -- say, a function that checks whether some code is correct -- and let it call that tool, look at the answer, and decide whether it's done. Once that works, add a second tool. Almost every beginner agent that fails, fails because it was given eight tools before the first one worked.Already an engineer
Define your tools with strict typed schemas and validate arguments server-side regardless of what the model sent. Cap iterations and total spend, and treat every tool result as untrusted input to the next turn. Use budget-capped agent sub-keys (POST /agents) so a runaway loop has a hard ceiling. See /learn#agentic-workflows for a worked multi-tool pattern.How do I deploy what I've built?
New to this
Deploying means putting your code where it runs all the time instead of only on your laptop. The usual route: put it in a container (a package with your code and everything it needs), run that container on a server, and point a domain at it. The AI services you're calling on CAIN Studio are already deployed -- you only deploy the part you wrote.Already an engineer
The services you consume are hosted, so your deployable is just your orchestration layer. Keep keys out of the image (inject via environment), health-check on a route that actually exercises a dependency, and make entitlement failures loud -- a 402/403 from the gateway means a billing state change, not a transient error to retry blindly. See /learn#deployment.How do I monetize an AI product?
New to this
Decide what a customer pays for -- a monthly fee, each use, or each successful result. Then you need three things: a way to take payment (Stripe), a record of who's paid (entitlements), and a check before every request that this person is still allowed. MCPGate's UsageLedger handles the counting and invoicing so you don't build that from scratch.Already an engineer
Drive entitlements from Stripe webhooks with signature verification, never from the post-checkout redirect. Keep entitlement in one authority and check it live per request; per-service caches are how cancelled accounts retain access. If you meter, meter the work the customer asked for, not your internal fan-out. See /learn#monetization.How do I use the catalog?
New to this
Describe your problem in the search box in your own words -- 'stop my bot leaking passwords', 'check if this code is right'. It searches what each product does, not just its name, so you don't need to know the names. Products are also grouped by the job they do, so you can browse if you'd rather.Already an engineer
The catalog renders from the live `/catalog` endpoint, which derives from the gateway's actual routing table -- so it reflects what's deployed right now, and cannot list something unroutable. Search is client-side over descriptions plus job phrasings, word-boundary matched and ranked by match count.How do I use the job taxonomy?
New to this
The catalog is grouped by what you're trying to achieve rather than by technology -- for instance 'Verify & prove correctness' or 'Secure agents & prevent leaks'. Find the group that sounds like your problem and everything in it is relevant. It's a shortcut for when you don't yet know the vocabulary.Already an engineer
Nine job-to-be-done groups on cainstudio, four on mcpgate, with every product mapped exactly once -- coverage is asserted, so there's no uncategorised remainder hiding products. Group titles and blurbs are also part of the search corpus, so a query matching a job matches its members.How does the chatbot work, and can I trust it?
New to this
It's a RAG chatbot: before answering, it searches these pages -- the product list, this FAQ, the glossary, the quickstart -- and answers from what it finds. That means it's talking about the real catalog rather than guessing. Flip on Beginner Mode and it explains things from first principles with examples. If it doesn't know, it's built to say so instead of inventing an answer.Already an engineer
Hybrid retrieval -- BM25 lexical plus nomic-embed-text cosine similarity, reciprocal-rank fused -- over a corpus derived from the live routing table and this content module, with embeddings precomputed and cached by content hash. Retrieved passages are injected as the grounding context and the system prompt forbids answering outside them. Counts in its answers come from the live service table, never from prompt text -- the previous version hardcoded '38' in its prompt and went stale.What does it cost to try any of this?
New to this
Nothing to start. The CAIN Studio homepage sandbox and the EU AI Act classifier are free with no signup, MCPGate's Console lets you exercise all 12 bundle tools free, and ProbeGate and MCP Security Scanner are free permanently. Paid plans start at {STARTER}/mo; new accounts get a {STARTER_TRIAL}-day no-card evaluation first, and the first paid charge is refundable.{OFFER_NOTE}Already an engineer
Free: homepage sandbox (IP rate-limited), /free/eu-ai-act/classify, mcpgate /console, ProbeGate (OSS), MCP Security Scanner. Paid: Professional {STARTER}/mo, Enterprise {FULL}/mo, after a {STARTER_TRIAL}-day no-card evaluation. Metered rates are public at /pricing; services absent from that list carry no per-call charge. mcpgate's bundle is one-time perpetual.Is my data used to train models?
New to this
No. These services do a specific job with what you send and return a result. See /privacy for the full statement.Already an engineer
No training on customer request data. Most services here are deterministic analysis rather than model inference, so there's frequently no model in the path at all. See /privacy.What if a service is down or a call fails?
New to this
Check the status indicator at the top of the homepage -- it's a live check, not a cached badge. A 402 or 403 usually means a billing or permission problem rather than a broken service, so re-trying won't help; check your subscription.Already an engineer
The gateway is fail-closed: if entitlement or policy checks can't complete, the request is denied rather than allowed through unchecked. So 4xx from the gateway is often an enforcement result, not a transient fault -- retrying blind will just burn quota. /health is a real dependency check.