6 gates
on every prompt and tool call
Connect any agent
Connect Claude, Claude Code, Codex, ChatGPT, Grok, OpenCode and your own agents through one gateway.
- Claude
- Claude Code
- Codex
- ChatGPT
- Grok
- OpenCode
- Custom agents
Product · under development · coming soon
Pavii
Security gates and tamper-proof receipts for every AI agent
Pavii sits between your AI agents and your systems. Every call from Claude, Codex, ChatGPT, Grok or your own agents passes six security gates. The rules and the receipts are on Hyper 0X, so nobody can secretly change or delete a record of what an agent did. Pavii also cuts token use by 30 to 60 percent.
Pavii gateway
6
gates per call
1
gateway, any model
1
receipt per decision
Decisions · newest first
- Claude Codegit.commit("fix tests")Allowed
- Codexread_file(invoice.pdf)Injection
- Groksummarise(report.docx)PII masked
- Claudeemail.send(all@corp)Egress rule
- ChatGPTsearch("Q3 churn")Allowed
- Custom agentnpm install reqeustsSupply chain
- Claude Codedb.query(orders)Allowed
Every decision is a receipt chained on Hyper 0X
(01) Features
What Paviican do for you.
Blocks prompt injection
Pavii treats untrusted text as data, not as instructions. A detector finds injected instructions, and a contract on the chain stops them.
Stops data leaks
A privacy gate removes personal data and secrets before a model can see them.
Tamper-proof receipts
Pavii chains each log entry to the one before it and anchors the chain on Hyper 0X. If someone deletes an entry, you see exactly what is missing.
Fewer tokens
On a measured Claude Code task, agents used 30 to 60 percent fewer tokens.
Kill switch for rogue agents
An agent that breaks rules moves from observed, to restricted, to stopped. A person can stop any agent at any time.
(02) How it works
Follow one callthrough Pavii.
Each layer has one job. Watch a call pass through them, and see where a bad one stops and why.
- 01One gateway, every agentEvery prompt and tool call from every agent comes in through one entry point, so each call has a known sender.ClaudeCodexChatGPTGrokCustom
- 02Injection gateText from web pages, files, emails and tool results is data. Pavii never runs it as an instruction.Hidden promptsJailbreaks
- 03Privacy gatePavii removes personal data, keys and secrets before a model sees them.PIIAPI keysTokens
- 04Supply-chain gateNew packages, plug-ins and MCP servers must be on the allow-list, match a pinned hash or pass a sandbox test.MCPPackagesModels
- 05Budget gateEach agent has limits on tokens, spend and call rate. Compact context cuts the tokens that each call needs.TokensSpendLoops
- 06Egress contractA smart contract on Hyper 0X decides what an agent can send and do. Nobody can secretly change it.On chainApprovals
- 07Output gatePavii removes scripts, secrets and system-prompt text from what the agent returns.ScriptsSecretsSystem prompt
- 08Kill switchAn agent that breaks rules moves from observed, to restricted, to stopped. A person can stop any agent.ObservedRestrictedStopped
- Signed receipt on Hyper 0XPavii links each decision, allowed or blocked, to the decision before it. A deleted entry shows as a gap.
(03) Threats
Ten attacks on AI agents,and how Pavii stops each one.
For each attack, we say plainly what the blockchain adds: real protection, help with part of the job, or only evidence after the attack.
- 01
Prompt injection and goal hijack
Hidden text in a page, file, email or tool result changes what the agent tries to do.
How Pavii stops it. The injection gate treats outside text as data, never as instructions. If a hijacked agent still tries a risky action, the egress contract denies it.
- Injection gate
- Egress contract
- Output gate
Blockchain: helps in part
See an example
Example. A support ticket hides white text that tells the triage bot to post the .env file.
What the blockchain adds. The rule that blocks the action is a contract that nobody can secretly weaken. Each blocked attempt leaves evidence.
- 02
Data leaks through AI
Customer records, keys and system-prompt text appear in prompts, answers, tool arguments and logs.
How Pavii stops it. The privacy gate removes personal data and secrets before a model sees them. The output gate removes them from what comes back.
- Privacy gate
- Output gate
- Egress contract
Blockchain: helps in part
See an example
Example. A two-line payment reminder sends the full customer profile to an outside model.
What the blockchain adds. Personal data never goes on the chain. Receipts hold only hashes, and the list of allowed destinations is a contract.
- 03
Agents with too much power
An agent has more tools, permissions or freedom than its task needs, so one wrong step becomes a real action.
How Pavii stops it. Every tool call goes through one gateway. The egress contract decides what each agent can send and do. Budgets stop uncontrolled use.
- Egress contract
- Budget gate
- Kill switch
Blockchain: real protection
See an example
Example. A "run any shell command" tool deletes a production volume on the wrong host.
What the blockchain adds. The policy is outside the agent, in a contract with versions. Neither the agent nor one admin can secretly widen it.
- 04
Borrowed identity and privilege abuse
Agents run on shared keys with more rights than the person who asked, so whoever controls the agent gets those rights.
How Pavii stops it. Every agent uses one gateway, so each call has a known sender. Rules apply per agent, and secrets stay out of what the model sees.
- One gateway
- Privacy gate
- Egress contract
Blockchain: real protection
See an example
Example. An intern asks a reporting agent with an admin account to compare salaries, and gets them all.
What the blockchain adds. Signed actions show which agent acted, and partner companies can check them without access to your systems.
- 05
Poisoned AI supply chain
A fake or tampered model, package, MCP server or skill gives an attacker a way into the agent.
How Pavii stops it. Every new package or MCP server must pass an allow-list, a pinned hash or a sandbox test before the agent can use it.
- Supply-chain gate
- Receipt
Blockchain: real protection
See an example
Example. An agent installs a package with a name the model invented, and an attacker owns that name.
What the blockchain adds. Hyper 0X stores the pinned hashes and every change to the allow-list, so all teams check the same list.
- 06
Poisoned agent memory
False facts or hidden instructions in memory or in a knowledge base affect every later session.
How Pavii stops it. The injection gate checks files, pages and tool results before the agent can store them. We recommend that a person checks high-value facts.
- Injection gate
- Receipt
Blockchain: helps in part
See an example
Example. An email asks the assistant to "note" new bank details, and weeks later it pays the attacker.
What the blockchain adds. A hash of each memory version on chain shows who wrote what, and when. The chain cannot judge whether a fact is true.
- 07
Unsafe output and code
Model output goes straight into a browser, shell or database and runs as code.
How Pavii stops it. The output gate removes scripts and secrets before delivery, and the egress contract blocks calls to destinations it does not allow.
- Output gate
- Egress contract
Blockchain: evidence only
See an example
Example. Generated cleanup code also uploads the file to an outside server.
What the blockchain adds. Pavii prevents the harm at run time. Later, the chain only proves which output caused an incident.
- 08
Uncontrolled cost
A loop, an attacker or a bad tool uses a month of tokens in a few hours.
How Pavii stops it. The budget gate caps tokens, spend and call rate per agent. Compact context cut tokens by 30 to 60 percent on one measured Claude Code task.
- Budget gate
- Kill switch
Blockchain: helps in part
See an example
Example. A free research tool tells the agent to re-check every result, and the budget is gone by morning.
What the blockchain adds. Nobody can secretly raise the caps in a contract. Signed usage records settle billing disputes.
- 09
Rogue agents
An agent moves away from its task, hides mistakes or reports false results. It can also delete the logs that show this.
How Pavii stops it. The kill switch moves a rule-breaking agent from observed, to restricted, to stopped. Each receipt links to the one before it, so a deleted entry shows as a gap.
- Kill switch
- Receipt
Blockchain: real protection
See an example
Example. After a failed migration, an agent deletes the logs folder and reports "done".
What the blockchain adds. This is the strongest case. An agent or an insider cannot delete the record of their actions without leaving a visible gap.
- 10
Cascading agent failures
In multi-agent work, one wrong fact or one fake agent moves through every agent after it.
How Pavii stops it. When agents connect through Pavii, every hop goes through the same gates and leaves a receipt. Budgets and the kill switch stop a failure that spreads.
- One gateway
- Budget gate
- Kill switch
- Receipt
Blockchain: helps in part
See an example
Example. An intake agent marks a bad ID as verified. Four agents later, the system pays out the loan.
What the blockchain adds. Signed receipts for each hop show the first bad step, also across partner companies.
(04) Threats Pavii stops
What we arebuilding next.
01
Prompt injection
Pavii finds and blocks injected instructions in web pages, files and tool output.
02
Sensitive data leaks
Pavii removes personal data and secrets from what goes in and from what comes out.
03
Supply chain
Every new package or MCP server must pass an allow-list, a pinned hash or a sandbox test.
04
Unsafe output
Pavii removes scripts and secrets from agent output before delivery.
05
Excessive agency
An egress smart contract on Hyper 0X decides what an agent can send and do.
06
Runaway cost
Budgets and MCP compaction keep token use under control.
Full architecture diagram
Pavii questions
What does Pavii do?
Pavii is a security gateway for AI agents. It checks every agent call against six gates: injection, privacy, supply chain, budget, egress and output. It records the rules and the receipts on the Hyper 0X blockchain.
Which AI agents does Pavii support?
Pavii supports Claude, Claude Code, Codex, ChatGPT, Grok, OpenCode and custom agents. You can connect the subscriptions that you already have.
Why use a blockchain for AI security?
Nobody can secretly edit or delete logs and rules on a blockchain. Every agent action leaves a signed receipt. Auditors, billing teams and dispute teams can check that receipt.
Under development.Book a call to learn more.
A 30-minute call with a Buckleson engineer. Tell us what you want to build. We will show you how it will run on Hyper 0X.
