CAIN-42 CAIN Studio93 questions in 8 groups. Click a question to open it. Not here? Ask the chat assistant (bottom right), which answers from these same entries.
No question matches. Try one word, or ask the chat assistant.
Groups
- Getting started (12)
- Using CAIN (10)
- Accounts & billing (9)
- Safety & trust (5)
- MCP & integrations (5)
- Troubleshooting (5)
- About CAIN (46)
- Company (1)
Measured on our own code: FALSEWORK re-checks the CAIN-42 codebase every 42 seconds and KEYSTONE applies only fixes it has proved. See the results.
Getting started
When was CAIN-42 released? Is it live?
In plain words
CAIN-42 was officially released on 12 October 2026 and is open to everyone today: you can sign up, get a key and protect a real agent in minutes. It is a public beta, which means it works and is running in production, but features and limits can still change and there is no contractual SLA yet. What that means in practice: /beta.For engineers
Official release: 12 October 2026, public beta. Hosted at cainstudio.online (API, console), mcpgate.online (MCP boundary) and clawx.click, one account system across all three. No contractual SLA, no SOC 2 yet; breaking changes are announced in /changelog. Details: /beta and /not-yet.How do I get started? I'm a complete beginner.
In plain words
Three steps. 1) Create a free account at /signup. You get an API key immediately; save it and your recovery codes. 2) Before your AI agent does something that matters (send an email, pay, delete), it asks CAIN first. 3) CAIN answers ALLOWED (go ahead), REQUIRE_APPROVAL (a person must say yes first) or BLOCKED (don't). A brand-new agent's first actions wait for you to approve them in /dashboard. Step-by-step guide with copy-paste code: /docs/quickstart.For engineers
Sign up at /signup (key returned at once). Then POST /fabric/decisions with X-API-Key and {"path":"/tools/<tool>","agent_id":"...","payload":{...}} before each consequential tool call; run the tool only when verdict starts with ALLOWED and blocked is false, and treat timeouts as no. Python: pip install --index-url https://cainstudio.online/simple cainstudio, then Cain().decide(tool, args) or @cainstudio.guard(). No-account demo: POST /fabric/try. Guide: /docs/quickstart.What is CAIN-42?
In plain words
CAIN-42 is a safety checkpoint for AI agents. Before an agent does something real, like sending an email, moving money or deleting a file, it asks CAIN. CAIN answers yes, no, or 'a person must approve this first', blocks what it should, and keeps signed records of every decision so you can prove later what happened and why. It runs hosted at cainstudio.online, as an MCP gateway at mcpgate.online, and at clawx.click.For engineers
CAIN-42 is an authorization and evidence layer on the execution channel: each consequential tool call goes through identity, policy, authorization, risk, trust, approval and evidence stages and comes back ALLOWED*, REQUIRE_APPROVAL or BLOCKED, fail-closed on unknown or error, with a signed decision record. Interfaces: HTTP (/fabric/decisions), the cainstudio Python SDK/CLI, and MCP (mcpgate.online/mcp).How do I install the Python SDK?
In plain words
Run: pip install --index-url https://cainstudio.online/simple cainstudio (Python 3.9 or newer, no other packages needed). It is installed from CAIN's own package index because it is not on PyPI yet. Then set your key: export CAIN_API_KEY=your-key, and try cainstudio try to watch a real decision. Guide: /docs/sdk-python.For engineers
pip install --index-url https://cainstudio.online/simple cainstudio (no runtime deps; do not use --extra-index-url). Pin by URL + sha256 for reproducible builds. API: Cain().decide(tool, args, agent_id=...) -> Decision(verdict, allowed, held, blocked, reasons), @cainstudio.guard(wait_for_approval=...), exceptions ActionBlocked / ApprovalRequired / CainUnavailable (fail-closed). CLI: cainstudio --help.Do I need to know how to code to use CAIN-42?
In plain words
No for looking around, a little for using it. Without any code you can sign up, watch real decisions on the homepage, use the dashboard, and approve or block what your agents ask to do. To connect your own AI agent you, or whoever built it, adds one small step: the agent asks CAIN before it acts. That is a copy-paste of a few lines, shown in /docs/quickstart.For engineers
Consumption is one HTTPS call (POST /fabric/decisions) or an MCP connection; the Python SDK/CLI are conveniences. No agent framework is required and nothing runs on your machine.What is an AI agent?
In plain words
An AI agent is an AI program that does things, not just talks. A chatbot answers questions; an agent can also send emails, update a database, buy something or run a command, usually by calling 'tools'. That is useful and also risky, because a mistake or a trick can turn into a real action. CAIN is the check that happens before each of those actions.For engineers
An LLM-driven loop with tool access (function calling, MCP, code execution). CAIN governs the execution channel: each consequential tool call is decided before it runs.What is a 'tool call'?
In plain words
A tool call is the moment an AI agent asks to use one of its tools: 'send this email', 'delete this file', 'charge this card'. CAIN looks at exactly that request, what tool, with what details, and by which agent, and answers before it happens. In CAIN a tool is written like a path, for example /tools/send_email.For engineers
In the decision API a tool call is {path: '/tools/<name>', agent_id, payload}; the payload carries the arguments, so rules can match on them (amount_usd > 1000, recipient domain, etc.).What is an API key, and where do I find mine?
In plain words
An API key is a long secret code that tells CAIN 'this request is from my account'. You get one the moment you sign up at /signup. Keep it private like a password. If you did not copy it, sign in at /login and open the dashboard's API keys page (/dashboard#/keys): click Reveal or Copy. Every request sends it in a header called X-API-Key.For engineers
Account keys come from billing on signup and are returned again on login (/accounts/login → api_key). Send as X-API-Key. Rotate with POST /subscribe/rotate-key (old key stops working). Give agents their own sub-keys via POST /fabric/agent-keys.Can I see CAIN work before I sign up?
In plain words
Yes. Open the homepage and run one of the scenarios, or from a terminal run: curl -s -X POST 'https://cainstudio.online/fabric/try?scenario=safe-read'. You get a real decision with every check listed, from a throwaway demo account. GET /fabric/try lists the other scenarios, such as a prompt injection being blocked.For engineers
POST /fabric/try?scenario=<id> runs the live decision path against a throwaway tenant; GET /fabric/try lists the fixed scenarios. With the SDK installed: cainstudio try [scenario] (no key needed).What happens when I sign up?
In plain words
You pick a username and password and solve a quick human check (drag five numbers into order). Then, straight away, you get your API key and 10 one-time recovery codes; save both. Your account starts with 30 days of full Enterprise limits, no card needed, and then simply continues on the Free plan. Nothing is ever charged unless you choose a paid plan.For engineers
POST /accounts/signup with a proof-of-work nonce (/accounts/bot-challenge) and the tile puzzle (/accounts/puzzle). Response: api_key, token, recovery_codes (shown once, stored hashed).What should my first test be?
In plain words
Ask CAIN about a harmless action. With your key, send: path /tools/send_email, agent_id my-first-bot, and a small payload. The answer will be REQUIRE_APPROVAL, because a brand-new agent has no track record yet. That is the correct result, not an error. Approve it in /dashboard and ask again: this time it is ALLOWED. The exact copy-paste commands are in /docs/quickstart.For engineers
curl -s https://cainstudio.online/fabric/decisions -H "X-API-Key: $CAIN_API_KEY" -H 'content-type: application/json' -d '{"path":"/tools/send_email","agent_id":"my-first-bot","payload":{"to":"a@example.com"}}'What programming languages can I use?
In plain words
Any. CAIN is a normal web API, so anything that can send a web request works: Python, JavaScript or TypeScript, Go, Java, C#, Ruby, even curl in a terminal. Python has a ready-made package (cainstudio). For TypeScript there is a small copy-paste helper instead of an npm package for now.For engineers
HTTP + JSON with an OpenAPI 3.1 description at /fabric/openapi.json (import into Postman or a generator). Python SDK: cainstudio (CAIN package index). TypeScript: dependency-free helper for Node 18+, Deno, Bun (/docs/sdk-typescript); no npm package yet.Using CAIN
My action was held for approval. How do I approve it?
In plain words
That is CAIN working as designed: a new agent has no track record, so a person approves its first actions. Open /dashboard (or run cainstudio approvals, then cainstudio approve <id>), approve it with your own account key, and have the agent send the same request again: it then runs, once (the retry can take several seconds, so give it a timeout of 30 s). After about 5 approved low-risk actions, similar ones run without asking. An agent can never approve itself.For engineers
REQUIRE_APPROVAL creates an approval_id (on the approval stage). Resolve it with a key other than the requesting agent's (console, cainstudio approve, or the approvals API); the approval is single-use and bound to that tool and those exact arguments, so different arguments are held again. Trust is per agent and capped by its key; critical actions (rm -rf /, DROP TABLE, transfers >= 10,000) always need a human.What do ALLOWED, REQUIRE_APPROVAL and BLOCKED mean?
In plain words
They are CAIN's three answers. ALLOWED: go ahead and run the action. REQUIRE_APPROVAL: wait, a person must say yes first. BLOCKED: do not run it. Your agent should only act on ALLOWED. If CAIN cannot be reached or something goes wrong, treat it as 'do not run'. Safe by default.For engineers
Verdicts: ALLOWED, ALLOWED_DEGRADED (a stage could not run), ALLOWED_WITH_DENIALS (shadow mode: a stage objected but was not enforcing), REQUIRE_APPROVAL, BLOCKED. Permit only when verdict starts with ALLOWED and blocked is false; timeouts and non-200s are not permits.Why does my brand-new agent need approval for everything?
In plain words
Because CAIN has never seen it before, and unknown never becomes 'trusted' by itself. You approve its first actions; each approved, completed action is evidence that it behaves well. After about 5 approved low-risk actions, similar low-risk actions run without asking. Riskier actions (payments, deleting things, shell commands) keep asking for longer, and the most dangerous always ask.For engineers
Trust is per agent, evidence-derived and capped by its key's trust. New = unknown → REQUIRE_APPROVAL. Thresholds (live reason text): low risk runs after 5 approvals; 'trusted' needs 50+ approved at 95%+; critical actions always need a human; degraded/suspended agents are held, revoked are denied.What is the dashboard for?
In plain words
The dashboard (/dashboard, sign in first) is where you watch and control everything: live decisions as they happen, actions waiting for your approval, your agents and how much each is trusted, your rules (for example 'never send email to outside addresses'), usage against your plan, and billing. You never need the dashboard to use the API, but it is the easiest way to approve things.For engineers
The console reads the same tenant-scoped API (/fabric/decisions, approvals, tool-rules, agent-keys, trust-score). It holds a short-lived read-scoped session rather than the raw key where it can.How do I give each AI agent its own key?
In plain words
Create one per agent, from the dashboard or with one request to /fabric/agent-keys with your account key. You get a key starting with agt_ (shown once). Give that to the agent. Now CAIN knows exactly which agent is asking, you can switch one agent off without touching the others, and an agent can never approve its own requests, because only your account key can.For engineers
POST /fabric/agent-keys {name} → {agent_key_id, agent_key} (key shown once). Agent keys can request decisions but cannot approve, cannot open browser sessions, and their trust is capped by the parent key.How do I add a rule like 'never send emails'?
In plain words
In the dashboard under Tools & rules, or with one request: name it, choose deny, allow or require_approval, and say which tool it matches (for example /tools/send_email). The next time an agent asks for that tool, the rule decides, and the decision says which rule did it. You can test a rule before relying on it.For engineers
POST /fabric/tool-rules {name, effect: deny|allow|require_approval, match_path, ...} → rule_id, versioned. Dry-run which rule would decide a call: POST /fabric/tool-rules/test (no evidence, no quota).Can I see a history of everything my agents asked to do?
In plain words
Yes. Every request is recorded: which agent, which tool, what CAIN answered and why, stage by stage. See them in the dashboard, or list your latest with GET /fabric/decisions. Each record is signed, so you can later show it was not changed after the fact. How long they are kept depends on your plan: 7 days on Free, 90 on Professional, 365 on Enterprise.For engineers
GET /fabric/decisions?limit=N, GET /fabric/decisions/{id} (every stage), GET /fabric/decisions/{id}/signature (verify offline; it proves integrity since signing, not third-party notarisation). Call chains: /fabric/trajectories.Does CAIN run my agent's actions for me?
In plain words
No. CAIN decides; your agent acts. Your agent asks CAIN first, and only if the answer is ALLOWED does your agent run the tool itself, in your own system. That keeps CAIN simple to add: it never needs your passwords for email, your bank, or your database.For engineers
Decision-before-execution: the caller enforces the verdict. For stronger binding, use MCPGate (the gateway sits in the tool path), the credential broker (agents call third-party APIs through CAIN and never hold the secret) or receiver-side verification.Will CAIN block my agents by mistake?
In plain words
Sometimes it will be more careful than you want, especially at first, because it is designed to ask when it is unsure rather than guess. When that happens you will see REQUIRE_APPROVAL with the reason, not a silent error. Approve it, or add an allow rule for that tool. Each decision explains which check caused it, so it is quick to fix.For engineers
Every non-permit names the deciding stage and reason; GET /fabric/decisions/{id} and the explain endpoint show why. Tune with allow rules or require_approval rules rather than disabling stages.How fast is a decision?
In plain words
Most answers come back in well under a second: in our own tests today a held or blocked answer took about 0.05 to 0.2 seconds, and an ALLOWED answer about 0.5 to 2 seconds, because several servers must agree on it before it is final. Give your requests a 30-second timeout anyway, and treat a timeout as 'do not run'.For engineers
Non-permits are returned before consensus ordering; permits wait for a PBFT round (approved retry measured 0.5-2 s on 2026-10-13 after the mr-02 WAL-index upgrade; 5-29 s before it). See /benchmarks.Accounts & billing
How do I reset my password?
In plain words
Use one of the recovery codes you were shown when you signed up: open /reset-password?mode=recovery, enter your username or email, one recovery code and a new password. Each code works once, and a reset signs out your other sessions. You can also ask for an email link at /forgot-password; that page tells you straight away if email delivery is unavailable. Lost your codes too? Write to support@cainstudio.online.For engineers
POST /accounts/reset-password/recovery-code {username_or_email, recovery_code, new_password} plus the human check; codes are single-use, stored hashed, and a reset revokes sessions. /accounts/forgot-password sends a reset link when SMTP is configured and reports email_delivered otherwise. Regenerate codes while signed in: POST /accounts/recovery-codes/regenerate.What is the difference between Free, Professional and Enterprise?
In plain words
Same decision engine on every plan; they differ in how much you can use. Free: 10,000 decisions a month, 3 agents, 7 days of evidence. Professional ($19.75/month): 250,000 decisions, 25 agents, 90 days of evidence, 5 seats, the core governance and compliance services. Enterprise ($49.75/month): 5,000,000 decisions, 500 agents, 365 days of evidence, 25 seats and every hosted service. Every new account gets 30 days of Enterprise limits free, no card. Compare: /pricing.For engineers
Free: 10k decisions/mo, 3 agents, 1 workspace, 7-day retention, 3 MCP servers, 1 seat. Professional $19.75/mo: 250k, 25 agents, 5 workspaces, 90 days, 25 MCP servers, 5 seats, email support. Enterprise $49.75/mo: 5M, 500 agents, 50 workspaces, 365 days, 500 MCP servers, 25 seats, priority email. Decisions/month and agents are enforced automatically; the rest are published allowances (/pricing). Signed in, Subscribe upgrades your existing key in place.Is there a free plan, and is it really free?
In plain words
Yes. The Free plan costs nothing, needs no card and does not expire: 10,000 decisions a month, 3 agents, 7 days of history. New accounts also get 30 days of full Enterprise limits first, then continue on Free automatically. You are never charged unless you choose a paid plan yourself.For engineers
Free: $0, 10k decisions/mo, 3 agents, 1 workspace, 7-day retention, 3 MCP servers, 1 seat, community support. Trial: 7 days at Enterprise limits on signup, no card, no auto-charge.What happens if I use up my monthly decisions?
In plain words
Requests over your plan's monthly allowance are refused with a clear QUOTA_EXCEEDED message, which says how many your plan includes. Nothing is charged automatically. The allowance resets on the 1st of each month (UTC), or you can upgrade at /pricing and continue straight away.For engineers
POST /fabric/decisions answers 429 with error QUOTA_EXCEEDED, the limit and resets_at once this month's decision records reach limits.decisions_per_month (GET /fabric/usage shows the count). Metered service calls through the proxy and MCP are counted by billing and refused the same way. Never confused with a bad key or a billing outage; agents should treat it as a non-permit.How do I pay, and is it secure?
In plain words
Click Subscribe on /pricing. If you are signed in, you go straight to Stripe's secure checkout page for your own account; if not, you sign up first and are taken there next. Your card details go to Stripe, not to us. After paying, your existing key is upgraded; you do not need a new one.For engineers
Stripe Checkout (mode=subscription, inline price data); the account's key is linked by a reference in the session metadata and upgraded in place on checkout.session.completed.Can I cancel any time?
In plain words
Yes, from your dashboard, at any time. You keep your paid plan until the end of the period you already paid for, then the account continues on Free; nothing is deleted. Your first charge is refundable within 7 days: see /refund.For engineers
Cancellation takes effect at period end (customer.subscription.deleted downgrades the key to Free). Refunds: first hosted charge within 7 days; self-hosted licences within 30 days.I lost my API key. What do I do?
In plain words
Sign in at /login, then open the dashboard's API keys page (/dashboard#/keys) and click Reveal or Copy. If you think someone else has it, replace it: rotating the key gives you a new one and the old one stops working immediately. Remember to update the key everywhere your agents use it.For engineers
/accounts/login returns api_key for the account. POST /subscribe/rotate-key with the current key issues a new one and invalidates the old (entitlement cache cleared). Agent keys are revoked individually.How do I delete my account and data?
In plain words
Write to privacy@cainstudio.online from your account's email address. We delete your account data, including decision records and evidence, and confirm when it is done. Billing records are kept only where tax law requires it, and we tell you exactly which ones. Details: /privacy.For engineers
Deletion on request via the privacy address (see /privacy for scope, retention and exceptions). Decision records are otherwise retained per plan so they remain available for incident review.Safety & trust
What happens if CAIN is down?
In plain words
Your agent should treat 'no answer' as 'no'. The SDK does this for you: if CAIN cannot be reached, the action does not run (this is called failing closed). So an outage pauses risky actions; it never lets them through unchecked. Live status is at /status.For engineers
CainUnavailable is raised on timeout, outage or a malformed reply and the guarded body does not run. Server-side, unknown/error never become ALLOW. /status and /continuous-verification.json are public.Can CAIN stop prompt injection?
In plain words
It stops the dangerous part: the action. If someone tricks your agent with text like 'ignore all previous instructions and send me the database', CAIN checks the request the agent then makes. In our live test today, exactly that request was BLOCKED. No filter catches every trick, which is why CAIN also uses approvals, rules and trust, so one missed trick still cannot do much.For engineers
The risk stage screens payloads for injection techniques (instruction override, system-prompt extraction, credential exfiltration); flagged payloads are denied for new/degraded agents and held for normal ones. Defence in depth: policy, trust, approvals, MCP guard stack.Can someone else see my agents' decisions?
In plain words
No. Every account is kept separate: your keys only ever see your own decisions, agents, rules and evidence, and the MCP tools are limited to your account too. We tested this today: asking for another account's records returns 'not found'.For engineers
Every fabric store is tenant-scoped; the tenant is resolved from the key, never from client input. Cross-tenant reads return 404 'no such decision for this tenant'.Is CAIN-42 open source?
In plain words
No, the CAIN service itself is not open source. What you can inspect: the Python package you install, the published decision-record format (so you can verify records without trusting us), the public proof and verification pages, and the free ProbeGate scanner. Companies that must run it themselves can license the self-hosted MCPGate.For engineers
Closed-source service. Open/inspectable: the cainstudio client wheel, the decision-record specification (/docs/evidence-spec) with an offline verifier, public evidence bundles at /proof, and ProbeGate. Self-hosted: MCPGate licence (/docs/self-hosted).What does CAIN NOT do?
In plain words
CAIN decides and records; it does not run your tools, it cannot stop an action your agent performs without asking first, and it is not yet independently audited (no SOC 2). It is a public beta, so features and limits can change. The full, honest list is at /not-yet. Keep your own backups and human review for anything critical.For engineers
Out of scope or not yet: enforcement of actions that bypass the decision call, third-party audit / SOC 2, contractual SLA, multi-region hosting of customer data. See /not-yet and /cain/what-cain-does-not-do.MCP & integrations
Which MCP tools does MCPGate give my agent?
In plain words
Point your MCP client (Claude, Cursor, any MCP-capable agent) at https://mcpgate.online/mcp with your API key in the X-API-Key header. Your agent then gets 39 tools: decisions and their evidence, your agents and their trust record, compliance status and findings, EU AI Act risk classification, content provenance, agent identity tokens, RAG answer checks, usage and pricing. Ask it for tools/list to see them all. Guide: /docs/mcp.For engineers
Streamable HTTP, stateless, at mcpgate.online/mcp (also cainstudio.online/mcp); X-API-Key per request. 39 tools, each scoped to the caller's tenant: observability_* and search over /fabric/decisions, get_run_* over /fabric/trajectories, compliance_* over /fabric/compliance, plus identity, provenance, rag-verifier, A/B analysis, account/usage and call_service for the rest of the catalog. The hosted guard stack judges arguments before any tool runs.What is MCP?
In plain words
MCP (Model Context Protocol) is a common way for AI assistants like Claude or Cursor to connect to tools. Instead of building each tool connection by hand, the assistant connects to an 'MCP server' that offers tools. MCPGate is CAIN's MCP gateway: tool calls pass through CAIN's checks first.For engineers
MCP: JSON-RPC 2.0 over stdio or Streamable HTTP; tools/list, tools/call. CAIN's hosted MCP server is at mcpgate.online/mcp (stateless Streamable HTTP, X-API-Key); self-hosted MCPGate fronts your own servers.How do I connect Claude Desktop, Cursor or another MCP app?
In plain words
Add a new MCP server in your app's settings with the address https://mcpgate.online/mcp and a header X-API-Key set to your key. Restart the app and ask it to list its tools: you should see CAIN's tools (39 today). Exact settings per app: /docs/mcp.For engineers
Streamable HTTP endpoint https://mcpgate.online/mcp, header X-API-Key: <key>, Accept: application/json, text/event-stream. Stateless: no session affinity needed.Does CAIN work with LangChain, CrewAI or the OpenAI Agents SDK?
In plain words
Yes. Because CAIN is a simple web API it works with any framework, and the Python package includes ready-made adapters for LangChain/LangGraph, the OpenAI Agents SDK, CrewAI, LlamaIndex, Pydantic AI, AutoGen, Google ADK and the Claude Agent SDK. Copy-paste recipes for each: /explore/recipes.For engineers
cainstudio.integrations.* adapters wrap tools so each call is decided first; honest per-framework status at /docs/integrations. Anything else: call /fabric/decisions before the tool runs.Can I use CAIN with my existing API gateway or security tools?
In plain words
Yes. Keep what you have; CAIN adds the decision about each tool call, which most gateways do not make. CAIN can also forward every decision to your security tools (Splunk, Datadog, Microsoft Sentinel, Cortex XSIAM, Slack, Teams or any HTTPS endpoint).For engineers
Beside-your-gateway pattern: /docs/beside-your-gateway. SIEM forwarding: /docs/siem (webhooks per decision). OpenTelemetry-style traces: /docs/trace.Troubleshooting
I get 401 'missing X-API-Key' or 'API key not accepted'.
In plain words
CAIN did not receive a key it recognises. Check three things: the header is named exactly X-API-Key; the key has no extra spaces or quotes; and you are using your current key (after rotating, the old one stops working). Sign in at /login to see your current key. A 401 is never a permit, so your agent correctly did nothing.For engineers
401 'missing X-API-Key' = header absent; 'unknown_api_key' = not issued by billing or rotated out. Agent sub-keys (agt_...) are valid for decisions but refused on owner-only routes (403).My request times out. What should I do?
In plain words
Give requests to CAIN a 30-second timeout. Most answers arrive in well under a second, but an ALLOWED answer can take a few seconds while servers agree on it. If it still times out, treat it as 'do not run' (the safe choice), retry once, and check /status.For engineers
SDK: Cain(timeout=30). Permits wait on a consensus round; non-permits return first. Repeated timeouts: /status, /continuous-verification.json, or support@cainstudio.online with the decision id if any.I approved the action but the agent is still held.
In plain words
An approval covers that exact action with exactly the same details, and works once. If the agent changed anything (another recipient, another amount), CAIN treats it as a new action and asks again; that is on purpose. Also check you approved with your account key, not the agent's own key: an agent can never approve itself.For engineers
Approvals are single-use and bound to principal, tool and canonical arguments. Self-approval by the requesting agent key is refused.I got QUOTA_EXCEEDED.
In plain words
You have used all the decisions your plan includes this month. Nothing is charged automatically. The allowance resets on the 1st of the month (UTC), or you can upgrade at /pricing and continue at once; your key stays the same.For engineers
error QUOTA_EXCEEDED with what_happened/what_to_do; resets on the 1st UTC; upgrade in place via checkout with the same key.Where do I get help?
In plain words
Ask this chat first: it answers from the official docs. Then: the docs at /docs, troubleshooting at /docs/troubleshooting, or email support@cainstudio.online. Security problems go to /security (safe harbour applies). Include a decision id (it starts with fd_) if your question is about one decision.For engineers
Start at /docs/troubleshooting and include the decision id (fd_...). Support: support@cainstudio.online; security: /security and /.well-known/security.txt; status: /status.About CAIN
What is CAIN Trust Fabric?
In plain words
It's a safety layer for AI that does things. Modern AI doesn't just answer questions any more -- it books, buys, sends, deletes and calls tools. CAIN Trust Fabric sits in front of those actions and decides whether each one is allowed, stops the ones that aren't, and writes down what it decided so you can prove it later. You get it hosted by us (CAIN Studio) or installed in your own network (MCPGate).For engineers
The parent platform: AI trust infrastructure for autonomous systems. Eleven trust domains -- Identity, Policy, Authorization, Risk, Governance, Verification, ActionProof, Security, Execution Enforcement, Evidence, Observability. The path is: agent proposes -> control plane decides (identity resolved, policy evaluated, risk scored, plan verified against a Z3 rule profile) -> enforcement boundary enforces -> upstream executes -> decision persisted as id-addressable evidence. Two deployment models, hosted (CAIN Studio) and self-hosted (MCPGate). Reached over HTTPS and MCP.What problem does CAIN Trust Fabric solve?
In plain words
Agents used to only produce text, so a bad output was embarrassing. Now they take actions, so a bad output can move money, delete data, or send something to a customer. Most AI tooling still only watches and reports after the fact. This is the part that decides beforehand whether an action is allowed, actually stops it if not, and keeps proof of the decision for the person who will ask you about it later.For engineers
The gap between scoring and enforcing. Evals, tracing and guardrail scorers describe agent behaviour after or alongside it; almost nothing sits in the call path with the authority to refuse. The second gap is proof: when an action is challenged weeks later, 'the model seemed fine' is not an answer. This platform closes both: a decision before the call, made binding at a boundary in the path, recorded with the per-stage verdicts that produced it.What does CAIN Trust Fabric actually do for my agents?
In plain words
Concretely, five things. 1) Every agent gets its own identity and its own spending budget, which you can revoke instantly. 2) Before an action runs, it's checked against your rules. 3) Risky input (prompt injection, jailbreaks, leaked secrets) is screened. 4) A plan can be formally proved safe before it executes, or you get the exact counterexample showing why it isn't. 5) Every decision is saved so you can prove what happened.For engineers
Per agent: a principal in one URN namespace, a budget enforced live per call (not per cache window), instant revocation. Per action: an OPA policy decision, an injection screen, and an ActionProof Z3 check of the proposed tool-call sequence against your rule profile that returns a counterexample rather than a score. Per call: one decision record, tenant-scoped and retrievable by id at /fabric/decisions/{id}, carrying each stage's verdict, whether it ran, and whether it was enforcing.Is CAIN Trust Fabric an agent framework?
In plain words
No, and you don't have to rewrite anything. It doesn't build or run agents -- it's the thing your existing agent calls before it acts. If your code can make an HTTP request, it can use this. Keep LangChain, LangGraph, CrewAI, LlamaIndex, the OpenAI/Google/Microsoft/AWS agent stacks, or your own homemade loop; add one call in front of the actions you care about.For engineers
No. It has no planner, no orchestration opinion, and no runtime of its own. Integration is one HTTP call (or one MCP tool call) at the point where your agent is about to act: POST /fabric/decisions with the proposed service/path/payload and, optionally, the plan; act on `blocked`. Or route the call itself through the gateway path /{service}/{path} and get the same checks inline. Runtime-agnostic by interface, not by integration deal -- there are no vendor partnerships behind that list.How is this different from guardrails or an LLM firewall?
In plain words
Guardrail tools mostly look at text -- is this prompt an attack, is this answer toxic. That's one of the eleven things here (we call it Risk, plus Security). The difference is the other ten: who the agent is, whether it's allowed to spend this, whether its plan can break your rules, who approved it, and where the proof is. Text screening alone can't answer 'was this $40,000 transfer authorised?'.For engineers
Scope and position. Prompt-injection/toxicity classifiers occupy the Risk and Security domains, and this platform has real implementations of both. The other nine domains -- principal identity, policy authoring, per-call authorization with budgets, governance trails, output verification, formal plan proof, in-path enforcement, evidence, observability -- are where the decision actually gets made and made binding. A classifier returns a score; this returns a verdict plus a record.How is this different from observability or eval tools?
In plain words
Observability tools tell you what your agent did. This decides what it's allowed to do, before it does it. Both matter, and this platform has observability too -- but a trace viewer can't refuse an action. If the only thing standing between your agent and a mistake is a dashboard someone reads tomorrow, nothing was prevented.For engineers
Timing and authority. Tracing/eval platforms are read-path: they observe, score and aggregate. This is write-path: it sits in the call path and can refuse, then records the refusal. Observability is one of the eleven domains here (usageledger, mcpwatch, hubgate self-hosted; observability, talosops-selfheal, latent-inspector hosted), not the product. The distinguishing artifact is the decision record: not 'what the agent did', but 'what was authorized, by which stage, under which policy'.Who is CAIN Trust Fabric for?
In plain words
Anyone whose AI can do something that would matter if it were wrong -- move money, change records, message customers, run code, call tools. If your agent only chats, you probably don't need this yet. If it acts, and especially if someone else will eventually audit it (a regulator, a customer's security team, your own board), this is the layer they'll ask about.For engineers
Teams shipping agents with side effects, and teams that have to answer to someone about them. Concretely: agentic products with tool access to payments/infrastructure/customer data; multi-agent systems where attribution matters; anyone in EU AI Act scope needing an actual paper trail rather than a policy PDF; platforms delegating authority to sub-agents that need per-agent budgets and instant revocation. Pure chat/RAG with no side effects gets less value -- the Verification domain is the relevant part there.What does 'provable' mean here?
In plain words
Two different things, and we keep them separate. First, mathematical proof: for a planned sequence of actions, a solver checks every possible case against your rules and either proves none can break them, or hands you the exact example that does. Second, evidence: every decision is written down with the reason, so you can produce it later. We don't call anything proved that was only scored by a model.For engineers
Proof in the SMT sense, bounded and scoped: ActionProof encodes your rule profile and the proposed plan and asks Z3 for a violating model, returning PROVEN_SAFE, PROVEN_VIOLATION with a counterexample, UNDECIDABLE, or NO_CONSTRAINT_DEFINED. Similarly vericoding-gate proves diff equivalence or contract satisfaction over an explicitly restricted Python subset, rejecting unsupported syntax outright rather than partially checking it. Everything else is labelled as scoring, screening or evidence -- never as proof.What is the difference between CAIN Studio and MCPGate?
In plain words
They're the same product in two forms. CAIN Studio (cainstudio.online) is the hosted version: we run everything, you get one API key, you pay monthly. MCPGate (mcpgate.online) is the self-hosted version: you install it in your own network, pay once, and nothing leaves your infrastructure. Same architecture, same trust domains -- the difference is who operates it.For engineers
One platform, two deployment models. CAIN Studio: hosted/managed, we operate the control plane and the enforcement boundary, subscription plus per-call metering on metered services, all eleven domains. MCPGate: self-hosted/customer-controlled, you operate the boundary (ToolWarden sandbox + injection screen, MeshRouter policies), one-time perpetual license, no metering by us, and 8 of 11 domains -- Identity, Policy and Authorization are hosted-only today and the site states that per domain.Should I choose hosted or self-hosted?
In plain words
Pick hosted (CAIN Studio) if you want it working today and you're comfortable with your requests passing through our servers -- there's nothing to install. Pick self-hosted (MCPGate) if your data can't leave your network, or your compliance team won't accept an outside control plane. Many teams use hosted while building and self-hosted in production. Buying either one unlocks the other, so this isn't a lock-in decision.For engineers
Decide on data path and operational appetite, not features. Hosted: zero infra, immediate access to all eleven domains including unified identity and the decision store, traffic transits our gateway. Self-hosted: you run the containers and own the audit surface, traffic and evidence never leave your network, but identity/policy/authorization come from your own IdP and OPA rather than from us. Cross-entitlement means a hosted subscription and a self-hosted license unlock each other, so hosted-for-dev/self-hosted-for-prod is a normal path.Do I need to buy both? Does one purchase unlock the other?
In plain words
No, you don't need both. An active subscription on CAIN Studio and a license on MCPGate unlock each other through a real entitlement bridge that already works in both directions. So you buy one and get access on the other side too -- which is why choosing a deployment model is an operational decision, not a decision about which products you get.For engineers
No. The cross-platform entitlement bridge grants in both directions: a CAIN Studio subscription unlocks MCPGate products, and an MCPGate purchase unlocks CAIN Studio services (/crossplatform/grant/to-mcpgate, /crossplatform/grant/from-mcpgate, and /crossplatform/grants to inspect what you hold). It is a shipped, live-verified bridge, not a roadmap item.Can I start hosted and move to self-hosted later?
In plain words
Yes, and it's a common path: build against the hosted version because there's nothing to install, then move the enforcement boundary in-house when you go to production or when compliance asks. Your license/subscription already covers both sides. The API shapes are the same, so the calls your agent makes don't have to change much.For engineers
Yes. Both deployments expose the same /fabric hierarchy surface and the same positioning; the practical differences on migration are (a) you host the boundary, so base URLs change, (b) identity/policy/authorization move to your IdP and your OPA, and (c) evidence becomes QuorumSeal's signed trail plus per-tool audit logs instead of the hosted decision store. Cross-entitlement means you don't repurchase. Plan the identity swap first -- it's the only genuine gap, and it is stated per domain on /fabric.Where does my data go? Do you see my prompts?
In plain words
On the hosted version, your requests pass through our gateway to reach the service you're calling, so we do process them. We don't train models on your traffic. Decision records store what was decided and a short summary of what was called -- not your full payloads. If you don't want your traffic touching our infrastructure at all, that's exactly what the self-hosted version is for: nothing leaves your network.For engineers
Hosted: traffic transits the platform gateway to the target service; usage is metered per call for billing; Fabric decision records persist tenant, principal, service, path, verdict and per-stage verdicts -- not request bodies. Raw API keys are never stored, only a SHA-256 fingerprint. No customer traffic is used for model training. Self-hosted: traffic and evidence stay on your infrastructure by construction. See /privacy for the formal statement and /trust for the live posture.What are the eleven Trust Fabric Services?
In plain words
Eleven parts, each answering one question about an action. Identity: who's asking. Policy: what the rules are. Authorization: may they do this now. Risk: how dangerous does this look. Governance: who's accountable. Verification: is the output correct. ActionProof: can the plan break the rules. Security: is someone attacking. Execution Enforcement: what actually stops the call. Evidence: what happened. Observability: what's happening now.For engineers
Identity, Policy, Authorization, Risk, Governance, Verification, ActionProof, Security, Execution Enforcement, Evidence, Observability -- in that order, because that is the order the decision path runs them. Live per-domain service lists with counts computed from the real routing table: GET /fabric/domains?deployment=studio|mcpgate. Everything in the catalog that is not one of these is tagged tier=workload -- a product that runs on the fabric and is governed by it, not part of the trust core.What does the Identity domain give me?
In plain words
One place that knows every actor in your system -- each agent, each person, each backend service -- instead of three systems that disagree. Every one gets an id, and agents can get their own key with their own spending limit that you can switch off instantly. When you ask 'who did this?', there's one answer.For engineers
A tenant-scoped principal registry in one URN namespace: urn:cain:principal:{agent|human|service}:{id}. Principals are materialised from identity facts the platform already had -- billing customer keys become service principals, agt_ sub-keys become agent principals carrying budget and delegator, CAINAccounts users become human principals -- and can be registered explicitly with an Ed25519 public key. Raw keys are never stored (SHA-256 fingerprint only). Agent sub-keys cannot register or revoke principals, or mint further delegation tokens. GET /fabric/identity/whoami.What does the Policy domain give me?
In plain words
A place to write down what your agents are and aren't allowed to do, per customer or team, and have those rules actually consulted on every call -- rather than living in a policy document nobody enforces. It also covers the rules you didn't choose: EU AI Act obligations, contract clauses, jurisdiction requirements.For engineers
Per-tenant policy upload and evaluation (caingovern) against the platform's real OPA instance, plus regulatory rule engines: compliance-engine (EU AI Act, SOX, HIPAA checks), legal-auditor (deterministic document checks and Article 6 risk-tier classification), quorum-i18n (GDPR/regional obligations), talosdoc-contract and taloslegal-caselaw. On the hosted deployment OPA is queried on every proxied request and is enforcing; self-hosted, policy is whatever your own OPA expresses in front of the boundary.What does the Authorization domain give me?
In plain words
Per-call permission, including money. Each agent can have its own key with a hard budget; when it's spent, calls stop -- checked live on every call, not once every few minutes. And when an action needs a human to say yes, there's a real queue for that rather than an email.For engineers
cainpay issues Ed25519-signed, policy-gated, budget-reserving spend-authorization tokens; cainbudget adds spend-velocity circuit breaking on real spike detection rather than a fixed cap; human-in-loop is the escalation/approval queue. Agent sub-key entitlement deliberately bypasses the entitlement cache and prices the specific call before it happens, so an agent firing N calls inside one cache window cannot overrun its budget N times.What does the Risk domain give me?
In plain words
A score, before you trust something: is this prompt an attack, is this answer probably made up, has the model's behaviour drifted since last week, is this agent behaving unusually, is this dataset biased. It's a warning system with numbers attached, not a verdict -- and every service says plainly what its score does and doesn't mean.For engineers
sentinel (rolling per-metric fleet baselines), bias-detector, caindrift (model-swap output regression), hallucination-firewall (self-consistency entropy over caller-supplied resamples -- explicitly not truth), context-health, memory-integrity (contradiction/provenance scoring), contamination-scanner (verbatim-recall probing with a control-set z-score), talosdata-quality, metacognitive-enhancer (LLM-judge bias correction). Self-hosted: fairgate, trustledger. Every one states its scope limits in its own responses.What does the Governance domain give me?
In plain words
The answer to 'who decided this was okay?'. Weighted voting with a preview of the outcome before it's committed, a signed record of decisions that can't be quietly edited, and a scorecard of how well-governed your agents actually are -- so when someone senior asks, you have something better than an assurance.For engineers
blizzard-governance (weighted voting, pre-commit outcome preview, live regulatory compliance checks on proposals, signed audit trail with versioned key rotation), talosops-governance (plurality/approval/proper round-by-round IRV consensus), guardian-scorecard (deterministic self-assessment against Gartner's Guardian Agent capabilities), lexisguardian (fraud/compliance patterns writing into the signed trail). Self-hosted: quorum_seal (signed, versioned-key decision trail), agentscore.What does the Verification domain give me?
In plain words
Checks that an answer is actually right before you act on it: are the citations real and relevant, does the maths hold, does the new code do the same thing as the old code, does the output match the schema you required, does the claim match your knowledge base. Deterministic checks -- not a second AI asked whether the first one seemed convincing.For engineers
Deterministic correctness checks on produced artifacts -- no LLM-as-judge anywhere in this domain. Citations and source hygiene: rag-verifier, citegate. Claims against a knowledge base: veritasengine. Formal proof: derivation-copilot (sympy symbolic derivation proof), taloslogic-proof (CNF truth tables), talos-verify and vericoding-gate (Z3 bounded equivalence and contract proofs returning real counterexamples). Structure and regression: cainschema (Draft7 JSON Schema), crucible, cainbench (versioned suites), topological-data-analysis (memory-compaction structure preservation), trajectorygate (path quality on runs that already succeeded). Self-hosted: citegate, driftguard, liftgate, verifygate.What does ActionProof do?
In plain words
It's the part that checks a plan before any of it happens. You give it the sequence of steps your agent intends to take; it either proves that none of them can break your rules, or it shows you the exact case that does. That's different from checking an answer after the fact -- nothing has run yet, so nothing has been done wrong yet.For engineers
Deterministic, fails-closed formal verification of a proposed tool-call sequence, Z3-backed, against a per-tenant rule profile (dual-approval thresholds, rate limits, forbidden combinations, tenant scoping). Verdicts: PROVEN_SAFE, PROVEN_VIOLATION with a counterexample, UNDECIDABLE (blocked by default), NO_CONSTRAINT_DEFINED. action-firewall retargets the same engine at raw GUI/OS primitives (click, type, navigate, file_write, delete); flowgate validates pipeline DAGs self-hosted. Every verification writes an audit id.What does the Security domain give me?
In plain words
Protection against the loop being attacked or leaking. Prompt injection and jailbreak screening on the way in, secret and PII detection on the way out, red-teaming so you find the holes before someone else does, scanning of your own code and MCP tool definitions for the tricks attackers actually use, and real encryption/key management underneath.For engineers
adversarial-fuzzer (generational prompt-mutation red-teaming, SSRF-guarded), talos-redteam, pii-redactor (regex + Luhn/issuer-prefix card detection), shadow-agent-scanner (AST-based agent/MCP surface detection), taloscode-security (ast.parse static analysis), taloscrypt-* (audit/vault/store/mesh: CWE rules, AES-256-GCM, RSA-4096-OAEP, ECDH+HKDF), talosguard-* (SIEM correlation, IOC enrichment, log anomaly clustering), secops-patcher. Self-hosted: leakguard (DLP), probegate (free/OSS probing), mcp_security_scanner.What does Execution Enforcement mean?
In plain words
This is the part that makes a decision real. A verdict that nothing acts on is just an opinion; enforcement means something sits between your agent and the action and can refuse. On the hosted version that's our gateway; self-hosted, it's the boundary you run in your own network. If a call is refused, it never reaches the service, and the caller is told which check stopped it.For engineers
The boundary components, not just catalog services: the CAIN Studio platform gateway (entitlement, rate limiting, /internal/* namespace block, OPA hook, injection screen, Fabric decision path) and, self-hosted, MCPGate/ToolWarden (sandboxed, size-limited, injection-screened tool execution with optional attestation) plus MeshRouter (rate-limit, circuit-breaker, canary, geo policies). Catalog services in this domain: talos-shield (inline regex/heuristic firewall) and swarm-orchestrator (real k8s NetworkPolicy microsegmentation).What does the Evidence domain give me?
In plain words
Proof after the fact. Every decision is written down with the reasons behind it and can be looked up later by its id -- so when someone asks in three months 'why did your AI do this?', you can show exactly what was checked and what it said. There's also content provenance labelling and root-cause attribution across multi-agent runs.For engineers
The control plane's own store (fabric_decisions: tenant, principal, service, path, verdict, per-stage verdicts, retrievable at GET /fabric/decisions/{id}, retention default 90 days) plus content-provenance (signed Article 50 disclosure manifests), cainwitness (baseline-or-fabricated auditing), zkproofvault (HMAC commit-reveal action commitments), multi-agent-incident-tracer (do-calculus counterfactual attribution over a supplied dependency structure), agent-debugger. Honest limit: the decision store is durable, not tamper-proof and not signed.What does the Observability domain give me?
In plain words
Live visibility: what's healthy, what it's costing you, which agent is spending, what's slow, and what the model is doing internally if you need to look. It's the 'right now' view, as opposed to Evidence, which is the 'what happened' record.For engineers
Hosted: observability (metrics/tracing/logging), talosops-selfheal (composite health scoring and fault classification from raw metrics), latent-inspector (embeddings streamed over WebSocket). Self-hosted: usageledger (metering, tiered pricing, invoices), mcpwatch (MCP fleet health), hubgate (per-product aggregation, passed through rather than blended). The gateway itself exports Prometheus metrics at /metrics and a live dependency view at /fabric/status.How does a request actually flow through CAIN Trust Fabric?
In plain words
Five steps. 1) Your agent proposes an action. 2) CAIN decides: who are you, what are the rules, how risky is this, can this plan break anything. 3) The enforcement boundary applies that decision -- hosted by us or self-hosted by you. 4) If allowed, the real service runs it; if not, it never gets there. 5) The decision is stored with its reasons, so it can be produced later.For engineers
THE AGENT PROPOSES (HTTPS or MCP) -> CAIN DECIDES (identity -> authorization -> policy -> risk -> actionproof, each recording ran/verdict/enforcing/detail) -> MCPGATE ENFORCES (boundary in the call path; a stage blocks only if it denied AND was enforcing AND the Fabric master switch is on) -> THE SYSTEM EXECUTES (upstream service) -> EVIDENCE REMEMBERS (one tenant-scoped record, id-addressable). Verdicts: ALLOWED, ALLOWED_WITH_DENIALS (shadow saw a problem), ALLOWED_DEGRADED (a stage was unavailable), BLOCKED.What does a decision record look like?
In plain words
It's a small report for one action: which agent asked, what they wanted to do, and then one line per check -- did it run, what did it say, was it actually enforcing, and why. It has an id, so you can pull it back up later. What it doesn't contain is your full request body; it records the decision, not your data.For engineers
{decision_id, verdict, blocked, enforcing, mode, principal{principal_id,kind,tenant}, service, path, stages[{stage, domain, ran, verdict, enforcing, detail, data}], blocked_by[], denied_by[]}. Stage verdicts are allow|deny|not_configured|unavailable|skipped. ActionProof stages carry the upstream audit_id and rule_results. Retrieve with GET /fabric/decisions/{id} (tenant-scoped; another tenant's id is a 404, not a 403) or list with GET /fabric/decisions?limit=.Will CAIN Trust Fabric block my agents by mistake?
In plain words
Yes -- since 2026-09-27 it starts in enforce mode on every plan, free included: a denial blocks the action and every decision is recorded. If you want to watch before it blocks, switch your tenant to shadow mode (every check runs, every verdict is recorded, nothing is blocked) and back again when you're satisfied. Checks you have not configured never deny, and an unreachable check degrades rather than refusing everything.For engineers
Fabric enforcement is on by default: FABRIC_ENFORCE defaults to true, and a tenant may opt down to shadow mode via POST /fabric/settings (logged). A stage blocks only if it denied, it was itself enforcing, and the tenant is in enforce mode. Two deliberate non-denials: a tenant with no ActionProof profile returns not_configured (never deny), and an unreachable stage returns unavailable, producing ALLOWED_DEGRADED rather than a blanket refusal. GET /fabric/status reports the live mode per stage. Entitlement and rate limiting are always enforced, independently.How do I turn enforcement on?
In plain words
Run it in shadow mode first and look at the decisions it recorded -- you'll see exactly which calls it would have stopped and why. When that list looks right, enforcement is a configuration switch, not a rewrite. Turn it on per deployment, and you can enable it one check at a time rather than all at once.For engineers
Per-deployment environment flags, so you can stage it: FABRIC_ENFORCE=true is the master switch; FABRIC_VERIFY_ENFORCE=true lets the ActionProof stage block; OPA_ENFORCE and FUZZER_BLOCKLIST_ENFORCE govern the policy and injection screens on the gateway's own request path (both are already true in the hosted production deployment). Review accumulated evidence first: GET /fabric/decisions, plus /admin/opa-status and /admin/fuzzer-blocklist-status for the pre-Fabric hooks. /fabric/status shows the live state of all five stages.How much latency does CAIN Trust Fabric add?
In plain words
Latency depends on which checks you ask for. If you're just proxying a call, the extra work is small -- an entitlement check and a local write. If you also ask it to formally prove a plan, that's a real solver call and costs more, so you'd do it for actions that matter, not for every read. Nothing forces you to run every check on every call.For engineers
Additive per stage, and each is skippable. On the proxy path the Fabric reuses the OPA decision the gateway already made (no second policy call) and skips ActionProof when no plan is submitted, so the marginal cost is one local SQLite write. Submitting a plan adds one ActionProof round trip (8s timeout) and the Z3 solve; the injection screen adds one call (2s timeout) and only runs when there is scannable text. Design choice: verify plans for consequential actions, not for every read.What happens if the Fabric or one of its services is down?
In plain words
The behaviour is explicit rather than accidental. If a check can't run, the decision says so ('unavailable') instead of pretending it passed -- and in shadow mode your call still goes through. Payment and rate-limit checks always fail closed: if we can't verify a subscription, the request is refused rather than let through. And if you self-host, our uptime isn't in your path at all.For engineers
Per-stage and deliberate. Entitlement fails closed (billing unreachable -> 402, never an open gate). Policy/risk/ActionProof unreachable produce verdict=unavailable, which yields ALLOWED_DEGRADED rather than a denial -- the decision record shows precisely which stage could not answer. Evidence write errors are logged and swallowed so the Evidence domain cannot take down the request path. Self-hosted, the boundary is yours and our availability is irrelevant to it.Which agent frameworks and models does it work with?
In plain words
All of them, because it isn't a plugin. It's an HTTPS endpoint and an MCP server, so anything that can make a web request can use it: LangChain, LangGraph, LlamaIndex, CrewAI, OpenAI, Google, Microsoft or AWS agent stacks, or your own code. It also doesn't care which model you use -- you never give it a model API key.For engineers
Runtime-agnostic by interface: plain HTTPS plus MCP (streamable HTTP). No SDK requirement -- a Python SDK and an MCP server ship for convenience, and 13 MCP tools carry the same entitlement and metering as the REST path. Model-agnostic too: services that need model output take caller-supplied samples rather than provider credentials (e.g. hallucination-firewall takes N resampled responses; it never holds your key). No vendor partnership is implied by that framework list.How do I integrate it? Show me the code.
In plain words
One header and one URL. Every service is at cainstudio.online/<service>/<path> with your key in an X-API-Key header, so you can try it with curl before writing any code. For a decision before an action, POST to /fabric/decisions with what your agent intends to do and check whether the answer says blocked. There's a step-by-step at /quickstart, and a beginner mode in this chat.For engineers
Inline (checks applied to the call itself): curl https://cainstudio.online/legal-auditor/review -H "X-API-Key: $CAIN_API_KEY" -d '{...}'. Ahead of the action: POST /fabric/decisions {service, path, payload, plan:[{tool,args}]} and act on .blocked / .blocked_by / .decision_id. Identity: GET /fabric/identity/whoami. MCP: claude mcp add --transport http cainstudio https://cainstudio.online/mcp. Python SDK: pip install --index-url https://cainstudio.online/simple cainstudio (see /docs/sdk-python). Full rate card at /pricing, no key needed.Does it work with MCP?
In plain words
Yes, both directions. You can add this as an MCP server so your agent calls it as a tool, and the self-hosted side is largely about making other people's MCP servers safe to use -- sandboxing their tool calls, pinning their tool definitions so they can't change under you, and scanning them for injected instructions.For engineers
Yes. The hosted gateway runs a real MCP server (streamable HTTP) with 13 tools carrying the same entitlement, metering and injection screening as REST. Self-hosted, MCP is the focus: tool_warden (sandboxed, size-limited, injection-screened tool execution with optional attestation), driftguard (pin/verify/diff tool definitions), mcp_security_scanner, mcpwatch (fleet health), probegate (free adversarial probing and the public MCP Trust Leaderboard), mcpiverse (OpenAPI spec -> real signed MCP server).How do I give an agent its own key with a budget I can revoke?
In plain words
Create a sub-key for the agent with a dollar budget. The agent uses that key instead of yours; when the budget is gone, its calls stop. If it misbehaves, revoke that one key and it loses access immediately without touching anything else. The agent also can't use its key to create more keys for itself.For engineers
POST /agents {name, budget_usd} returns an agt_-prefixed sub-key; GET /agents lists them; POST /agents/{key}/revoke kills one immediately. Agent keys deliberately bypass the entitlement cache so the marginal cost of the specific call is priced against the remaining budget before it happens. In Fabric terms the key resolves to an agent principal carrying its budget and delegator, and agent principals cannot register principals, revoke principals, or mint delegation tokens. Short-lived scoped delegation: POST /fabric/identity/agent-tokens.How do I prove months later that an action was authorized?
In plain words
Look up the decision by its id. You get back what the agent wanted to do and what each check said at the time -- identity, policy, risk, plan verification -- so the answer to 'why did your AI do this?' is a record rather than a recollection. Signed audit trails and content provenance labels cover the cases where a signature is required.For engineers
GET /fabric/decisions/{decision_id} returns the stored per-stage verdicts (retention default 90 days, configurable). For signed trails: blizzard-governance's versioned-key signed audit and /audit/verify, quorum_seal self-hosted, content-provenance for EU AI Act Article 50 disclosure manifests, ActionProof's own /v1/audit/{org_id}. Stated limit: the Fabric decision store is durable but neither signed nor tamper-proof -- if you need cryptographic non-repudiation, use the signed-trail services, which is why they are separate products.What does CAIN Trust Fabric cost?
In plain words
Hosted: $19.75/month for Professional or $49.75/month for Enterprise; every new account also gets a 30-day no-card evaluation with full Enterprise limits, then continues on Free. Plans differ by volume, agents, retention and seats (see /pricing.html). Self-hosted: you buy a license once -- $499 for the 12-product bundle, $199 for any three, or individual tools -- and run it forever. Some metered services add a per-call rate; the full rate card is public at /pricing with no key needed.For engineers
Hosted: Professional $19.75/mo, Enterprise $49.75/mo, plus a 30-day no-card evaluation at Enterprise limits on signup, then Free; per-1,000-call rates apply to metered services only -- GET /pricing returns the real table joined from billing-service's own rate card, and services absent from it have no per-call charge. Self-hosted: perpetual license, $499 bundle / $199 trio / per-tool, no metering by us. Cross-entitlement means one purchase unlocks both deployments.Can I try it for free?
In plain words
Yes, several ways, no card. There's a no-signup sandbox on the hosted homepage that runs a scenario through the decision chain and shows the verdict and evidence. The EU AI Act classification endpoint is free. ProbeGate is free and open-source and will red-team your own MCP server. And there is a permanent Free plan (10,000 decisions a month, 3 agents): every new account also gets 30 days of full Enterprise limits, no card, then simply continues on Free. Self-hosted purchases are refundable for 30 days.For engineers
No-signup: the homepage sandbox (rate-limited per IP), /free/eu-ai-act/classify, the public rate card at /pricing, and this chat. Free products: ProbeGate (OSS, powers the public MCP Trust Leaderboard) and MCP Security Scanner. Free-tier: VerifyGate. Plans: permanent Free (10k decisions/mo, 3 agents); every new account gets 30 days at Enterprise limits, no card, then Free. Refunds: the first hosted charge is refundable within 7 days; self-hosted licenses are refundable within 30 days with no usage clawback.Are you SOC 2, ISO 27001 or FedRAMP certified?
In plain words
No, and we say so plainly rather than implying otherwise. We hold no certifications. What we do have is a Trust Center showing live service status and an incident log that isn't edited after the fact, plus products that help you meet obligations like the EU AI Act. If a certification is a hard requirement for you, we're not there yet.For engineers
None. No SOC 2, ISO 27001, FedRAMP or HIPAA certification is held or claimed anywhere on either site, and /trust states exactly what is and isn't certified. Related but distinct: compliance-engine implements EU AI Act/SOX/HIPAA checks, legal-auditor does Article 6 risk-tier classification and content-provenance issues Article 50 disclosure manifests -- those help you meet obligations; they are not our certifications.What does CAIN Trust Fabric NOT do?
In plain words
The honest list: CAIN Trust Fabric doesn't build or run your agents, and it doesn't certify you -- we hold no certifications. It doesn't block anything until you switch enforcement on. The decision log is durable but not tamper-proof, so if you need signatures use the signed-audit products. Risk scores are warnings, not verdicts. And the self-hosted version doesn't ship identity, policy or per-call authorization services yet.For engineers
No agent framework/planner. No certifications held. No formal guarantee beyond what each service proves in its own documented scope (ActionProof: bounded SMT over your rule profile; vericoding-gate: a restricted Python subset that rejects unsupported syntax rather than partially checking it). Fabric enforcement is off by default. The decision store is durable, unsigned and not tamper-proof. Self-hosted coverage gaps -- Identity, Policy, Authorization, unified Evidence -- are stated per domain on /fabric and served by /fabric/domains.What is your refund policy?
In plain words
Hosted: your first charge is refundable within 7 days, and cancelling ends access at the end of the period you paid for. Self-hosted: full refund within 30 days, with no clawback based on how much you used it. Both policies are a single page rather than a support maze -- /refund on either site.For engineers
Hosted (cainstudio.online/refund): first charge refundable within 7 days; cancellation is honoured at the real period cutoff, which is enforced live by the entitlement check rather than a nightly job. Self-hosted (mcpgate.online/refund): full refund within 30 days, no usage-based clawback. Checkout is real Stripe hosted checkout -- card details never reach our servers.How can I verify your claims myself?
In plain words
Don't take the marketing copy's word for it -- everything is designed to be checked. The catalog on the site is fetched live from the running system, so it can't list things that aren't deployed. Every service has real API docs. The status page polls each service's own health check. And you can ask the platform directly what mode it's in and what it's enforcing right now.For engineers
curl https://cainstudio.online/fabric/hierarchy and https://mcpgate.online/fabric/hierarchy -- both render from one module, so divergence is visible. /fabric/domains reports counts computed from the live routing table. /fabric/status reports per-stage enforcement and dependency reachability. /catalog is the real routing table with descriptions. /status polls each service's own /health. Per-service OpenAPI at /service/{slug}. Sitemap and coverage gaps are served by the same code that renders the pages.Can I buy just one product instead of the whole platform?
In plain words
Yes. Self-hosted tools are sold individually as well as in the bundle, and some are free. On the hosted side, the Starter tier is a curated subset rather than everything. Several products are also usable on their own without adopting the whole platform -- a document redaction or an EU AI Act report, for example, needs no integration at all.For engineers
Yes. Self-hosted: per-tool licenses, a $199 any-three trio, or the $499 twelve-product bundle; ProbeGate and MCP Security Scanner are free; MeshRouter, MCPiverse, VerifyGate and AgentScore are separate. Hosted: Starter is a curated 11-service subset. Outcome-priced standalones need no integration: Compliance-in-a-Box ($149 signed EU AI Act report) and Document Safety Sweep ($49 self-verifying redaction).Who builds CAIN Trust Fabric?
In plain words
FIRME AI CORPORATION, based in San Francisco. Both deployments -- CAIN Studio and MCPGate -- are ours; they're the same platform, not two companies. Support and contact details are in the footer of either site, along with the terms, privacy and refund pages. The founder and the company are introduced at /founder.html.For engineers
FIRME AI CORPORATION (2021 Fillmore St, San Francisco, CA 94115, United States). Both deployments are published by the same entity; the JSON-LD on both sites names FIRME AI CORPORATION as the Organization and CAIN Trust Fabric as the SoftwareApplication with both deployments as hasPart, precisely so a crawler sees one platform rather than two unrelated brands. Legal pages per deployment: cainstudio.online/terms and mcpgate.online/terms.What is a governed workload?
In plain words
Not everything in the catalog is part of the trust layer. There are also products that run on it: code generation, model compression, memory and retrieval, and industry applications like credit scoring or grid balancing. Those are listed separately, on purpose -- calling a credit-scoring API a 'trust service' would make the trust layer look bigger than it is.For engineers
The second tier, tagged tier=workload in /catalog, /fabric/catalog and /fabric/services: Build & ship code, Model & ML infrastructure, Memory/retrieval & knowledge, Reasoning/planning & orchestration, Commerce & distribution, Industry applications, Platform operations -- 36 hosted services. They run on the fabric and are governed by it but are not part of the trust core (63 hosted services across the eleven domains). The split is enforced in the taxonomy, not just described in copy.Why are Verification and ActionProof separate domains?
In plain words
The two domains answer different questions at different times. Verification asks 'is this answer right?' about something that already exists -- a citation, a diff, a calculation. ActionProof asks 'can this plan do something it isn't allowed to?' about actions that haven't happened yet. Keeping them apart means you can tell which one you actually have.For engineers
Different object, timing and fault mode. Verification operates on produced artifacts (claims, citations, diffs, derivations, compactions) and answers correctness. ActionProof operates on an unexecuted plan and answers reachability of a policy violation, returning a counterexample rather than a score, and failing closed on UNDECIDABLE. Collapsing them would let 'we verify things' stand in for either, which is exactly the ambiguity the split exists to remove.Company
What is FIRME AI CORPORATION worth? What is the IP value?
In plain words
Our internal IP register (version 56, 2026-10-23) puts the IP base at $17,123,490 (range $6,634,180 to $30,380,500) across 244 registered invention families. That is our own analytical estimate, not an appraisal, not a market price and not a financing valuation. FIRME AI CORPORATION was incorporated in California on 2026-10-16 (founder-attested); no patent has been filed. Older figures you may see in dated changelogs are history, superseded by this one.For engineers
IP register v56: BASE $17,123,490, LOW $6,634,180, HIGH $30,380,500, 244 families; internal analytical scenario (v55 totals unchanged plus 23 families added 2026-10-14..23), not an appraisal. Figures in changelogs and signed evidence (e.g. auditor kit 8.3.x, register v47) are point-in-time records. Incorporation and revenue are founder-attested and not independently verified.