For teams running agents in production · self-hostable
You've hired agents.
We provide their HR.
Every other tool just watches your agents work and charts what broke. Taksham runs the whole employment — an identity and scoped permissions for each one, live supervision in the critical path, per-agent cost, and a loop that turns every failure into a gate the same mistake can't slip past twice.
Day one
A new agent clocks in — eager, and wearing pay:* like it's nothing.
scroll to play ↓
You've hired a workforce that never sleeps. Nobody's managing it.
ChatGPT and Claude are tools for your people — and they're great. But you're not just hiring people anymore. You've got agents in production that decide and act on their own: answering customers, touching data, spending money. That's a new kind of employee, and right now no one actually manages them.
Taksham is that management layer. Think of it as HR for your agents — every job an HR department does for your humans, Taksham does for your agents. You run your people; we run your agents.
- Identity
Hiring & badges
An identity and scoped, expiring permissions for every agent.
- Evals
Performance reviews
Evals and scorecards — is the work good, is quality slipping?
- Firewall
Catch it in the act
A live semantic firewall, a kill-switch, and one-click revoke.
- Loop
Never make that mistake twice
Every incident becomes a permanent regression test.
- Optimize
Payroll & expenses
Per-agent cost attribution, budgets, and cheaper routing.
- Govern
Compliance & the paper trail
Approvals, policy, and an audit log produced just by running.
- Memory
The personnel file
What each agent knows and remembers across sessions.
You bought eight tools. You still can't answer one question.
Tracing in one vendor. Evals in another. A gateway, a guardrail, a red-team script, a finops dashboard — each with its own store, its own IDs, its own version of the truth. When an agent burns $40 and ships a refund it shouldn't have, you stitch five exports together by hand and still guess.
The data that would explain the failure exists. It's just scattered across products that were never meant to agree. So nothing is replayable, nothing is provable, and the same incident happens twice.
Taksham collapses the pile into a single substrate. One spine. Every answer.
Every trace, decision, and dollar — on one immutable, replayable spine.
Spans, decisions, and embeddings land append-only in a single store. Nothing is ever mutated, so any run replays byte-for-byte — the model call, the tool result, the guardrail verdict, the cost. Decisions are first-class rows, not log lines, so "why did it deny this?" has an answer, not a theory.
- Spans + decisions + embeddings, one schema, one tenant stamp
- Faithful replay — reconstruct any run to any offset
- Semantic search over runs via cosine kNN on embeddings
- DuckDB embedded for local · ClickHouse for scale — same SpQL
-- last 24h: agents that denied a payment, with cost
SELECT agent, count(*) deigns, sum(cost_usd) burn
FROM spans JOIN decisions USING (trace_id)
WHERE decision.verdict = 'DENY'
AND decision.policy LIKE 'payments.%'
AND ts > now() - interval '24h'
GROUP BY agent ORDER BY burn DESC;The same query runs against the embedded store on your laptop and the columnar store in prod. No re-instrumentation, no second pipeline.
The failure you debug today becomes the test that blocks it forever.
Most platforms tell you something broke. Taksham closes the loop: an incident on the spine is detected, minted into a failing eval drawn straight from the trace, and wired into a statistical CI gate. The pull request that would re-ship the bug doesn't merge. Reliability stops being a vibe and becomes a ratchet.
Twenty-two surfaces. One login. All reading the same spine.
Traces
01Faithful replay, full-text search, multimodal span detail.
Observe
02Dashboards, monitors, debug copilot, classic-ML XAI, taint paths.
Gateway
03OpenAI-compatible proxy, routing, virtual keys, MCP reputation.
Evals
04Datasets, scorers, review insights, GitHub prompt sync, spreadsheet IDE.
Loop
05Incident → replay → regression test, plus trace-driven auto-improve.
Verify
06SBOM, dependency risk, reachability, model-weight scan.
Copilot
07Debug traces, drive evals, mint tests from incidents.
Authoring
08Visual graph canvas, NL→graph, durable agent blueprints.
Govern
09Approvals, policies, OAuth AS, auth-flow builder, secretless mint.
Compliance
10EU AI Act risk-tiering, ISO 42001, bias/fairness audits.
Security
11Red-team campaigns, signed Trust-Score, recon, posture scoring.
Firewall
12Bidirectional scanners, DLP, /v1/guard drop-in, runtime egress.
Discovery
13Shadow-AI discovery, identity-graph blast-radius, 101+ posture rules.
Platform
14Self-observability — Taksham, watching Taksham.
Runtime
15Durable workflows, flow control, and a microVM driver with guest-kernel + rootfs isolation (no silent fallback).
Optimize
16FinOps, router leaderboard, custom predictors, feedback improvement.
Memory
17Episodic + semantic recall, criteria retrieval, temporal KG audit.
Data
18Offline-first sync, authz partial replication, CRDT.
Browser
19Act / extract / observe, record-and-replay.
Train
20Gymnasium RL env, incident→RL wire, trajectory export.
Voice
21WER/CER, latency, barge-in, realtime callers.
Swarm
22Call-graph topology, per-agent cost & blast radius, first-party A2A protobuf wire.
Owned, not glued.
The pieces that decide whether agents are trustworthy — the durable engine, agent identity, the gateway, the eval runner, the incident-to-test loop — are first-party Taksham code reading first-party data. We integrate model APIs, browser and OS drivers, and the database substrate. Everything that constitutes the moat, we built.
Taksham — Sanskrit, the one who carves. We didn't assemble a platform from other people's primitives. We cut it. Named for the carpenter. Built like one.
Durable workflow engine
Deterministic replay, signals, schedules, flow control, workflow depth panels.
Agent identity & authz
Durable OAuth authorization-server (DCR), visual auth-flow builder, secretless credential mint preview.
Visual agent authoring
A reactflow graph canvas with NL→graph — blueprints save and persist (durable agent-graph registry), then run on the workflow engine.
LLM gateway
OpenAI-compatible proxy, 400+ model catalog, MCP reputation, batch/passthrough APIs.
Eval engine
Composable scorers, review insights, GitHub prompt sync, distribution-gate experiments.
Incident-to-test loop
Detect → real-LLM-grounded diagnosis → mint → gate → auto-improve (scorer, dataset, prompt) on the live spine.
Semantic firewall
Bidirectional scanners, DLP, /v1/guard drop-in, and an inline sub-50 ms detector tier with a deterministic latency-budget degradation ladder.
Supply-chain signing
Real Ed25519 DSSE envelopes + in-toto SLSA provenance over SBOMs — a genuine signature, verified, not a placeholder.
Learned-model defaults
Injection, eval-judge, the red-team attack-success judge, and the memory embedder run real learned students out of the box (the embedder is auto-fetched from Hugging Face on first use when network egress allows) — heuristics are the floor, not the ceiling.
Provable control, because the evidence is already on the spine.
Every guardrail verdict, approval, payment reservation, and policy decision is a row, not an afterthought. Compliance evidence isn't generated for the audit — it's the byproduct of the system running. Red-team campaigns attack your live agents through the same gateway, scored by a learned attack-success judge, and feed findings back to the firewall.
Managed Cloud or self-host — same first-party stack. Zero lock-in is a setting, not a promise.
Run it as a managed Cloud, or self-host the whole thing — same code, same spine. The hosted tier enforces per-tenant isolation (a tenant can't read, route, or spend against another) with a partitioned cache and regional failover; self-host stays first-class for regulated buyers. Self-hosted, the spine is yours — DuckDB on a laptop or ClickHouse in your VPC, shipped with Docker Compose, Helm, or Terraform, and your traces never leave your perimeter unless you decide they should.
Clone it. Run it. Open the spine.
No account, no credit card, no cloud. The full control plane boots on a seeded spine so every one of the 22 surfaces is live the moment the dev server is up. Point your own traffic at it via the SDK or OTLP when you're ready.
# clone the monorepo
git clone https://github.com/utkarshparcel/taksham
cd taksham
# install the workspace (pnpm + turbo)
pnpm install
# boot the control plane on the seeded spine
pnpm dev
→ control plane http://localhost:3000Taksham manages the agents. Hanu watches the estate they run on.
An agent with a badge and a budget still runs on your cloud, your identity provider, your CI, your model endpoints. Hanu is our self-hosted security platform for exactly that surface — it correlates signals across all of them into compound attack chains, with the evidence attached, so a GitHub action, a certificate issued last month and a Bedrock call this afternoon land in one risk instead of three dashboards.
Same posture as Taksham: your datastores, your keys, no control plane phoning home. Community edition is free in production.
Correlation, not another scanner
75 correlation rules across two tiers join signals that are only dangerous together.
609 detections, 96 ATT&CK techniques
Deterministic rules over typed signals — no LLM in the detection path, so a score is reproducible six months later.
Cloud, identity, supply chain, AI
AWS, Azure, GCP and Kubernetes in depth; Okta and Entra ID; GitHub, GitLab and CI; model and agent surfaces.
Closes where the work happens
A fix goes back as a check run or a pull request, not a console ticket nobody opens.
The end of the apology
Stop apologizing for your agents.
Give every agent an identity, a reviewer, and a gate it can't slip past — then let Taksham run the rest.