Skip to content

Enterprise

Built to fit how enterprises run identity and infrastructure.

Your identity provider, your directory, your devices, your privacy rules and, if you choose, your own cluster. Vekri adds AI governance and runtime authorization for agents without becoming another identity silo, or another place your data has to go.

Contact SalesRequest a Demo

Capabilities

Identity, privacy, isolation and deployment.

Each item is in the current release and verified by tests in the product repository, with its limits beside it.

  • Enterprise single sign-on (OpenID Connect)

    OpenID Connect providers per organization (for example Microsoft Entra ID or Okta) for the console, the management API and employees' agents.

    Vekri Control · Vekri Gateway (remote MCP)

    Limit: Verified with OpenID Connect test providers, not a live Entra ID or Okta tenant.

  • SCIM 2.0 provisioning

    Users and groups provisioned with SCIM 2.0. Deactivating someone ends their sessions and agent sign-ins at once; history is kept.

    Vekri Control

    Limit: Verified with Entra ID and Okta request fixtures, not live tenants.

  • User-device binding

    Bind devices to people through their SSO sign-in or an administrator, and require a verified binding for sensitive access.

    Vekri Gateway (remote MCP) · local MCP gateway · macOS, Linux

    Limit: A binding shows who uses a device; it does not prove that a request came from it. No MDM attestation.

  • Administrative roles

    Organization roles from org-owner to viewer, mapped from directory groups by their stable ids; every route checks its permission on the server, and no one can grant a role, or join a group carrying it, without holding its permissions.

    Vekri Control

  • Self-hosted, single organization

    Install with one Helm chart in your own Kubernetes cluster, as exactly one organization, with no connection to Vekri required. Detection, including the classifier, runs inside the installation.

    Helm chart · Kubernetes

    Limit: The production profile (TLS, an enterprise identity provider, managed PostgreSQL) is validated by configuration tests, not yet end to end.

  • Bring your own ingress

    Gateway API routes with Envoy Gateway, an existing Gateway you manage, or your own ingress. The ingress routes traffic; Vekri authorizes it.

    Helm chart · Kubernetes

  • Privacy and retention settings

    Choose whether names are shown by role or never, the minimum group size for breakdowns, and how long usage is kept.

    Vekri Control

  • On-device sensitive-data inspection

    Classifies prompts, tool inputs and MCP tool arguments on the workstation, only on the surfaces an administrator enables. Only category names and counts leave the device.

    Claude Code hooks · local MCP gateway · macOS, Linux

    Limit: Off by default. Hooks report after the fact; only the local MCP gateway can act before a call runs.

  • Embedded prompt-injection classifier

    Rules on normalized and decoded text, and a classifier model embedded in the Vekri binaries. It runs without a network call or a separate service.

    Vekri Gateway (remote MCP) · local MCP gateway · Kubernetes, macOS, Linux

  • Durable audit evidence

    Intent is recorded before a write executes and the outcome after; an uncertain outcome is flagged, never retried blindly.

    Vekri Gateway (remote MCP) · Kubernetes

Planned

  • PlannedSAML sign-in. Signing in with SAML.
  • PlannedSigned installers for MDM distribution. Signed and notarized packages for distribution through device management.
  • PlannedWindows endpoint. Vekri Endpoint on Windows.

Listed so you know where the edges are. Ask us before relying on anything here.

Deployment

Vekri's cloud or self-hosted: the same controls.

Comparison of Vekri's cloud and self-hosted deployments
AspectVekri's cloudSelf-hosted
Where it runsVekri's cloudYour Kubernetes cluster
IdentityYour OIDC provider and SCIMYour OIDC provider and SCIM
Connectivity to VekriRequiredNot required

Capabilities on this page describe the current release, a development build that has not yet had an external security review. Ask us about your identity provider, compliance requirements and deployment constraints; we will tell you exactly what is supported today.

Contact Sales

Plan your Vekri deployment with us.

Talk to us about the AI your organization uses, the systems agents reach and how you deploy: in Vekri's cloud, or inside your own Kubernetes cluster.

Contact SalesRequest a Demo