Skip to content
OTONMI

Secure every agent action.

ExplorePrompt injectionCredential leakTool poisoning

Runtime security for AI agents

We are not a filter. We are a firewall for autonomous AI.

Six deterministic detectors inspect every prompt, tool-call and MCP config — and block the dangerous ones before they execute.

OverviewRuntime security

OTONMI is a detection engine and inspection API that catches threats in AI-agent activity — per message, per tool-call, in real time.

The six detectors

At OTONMIGuardrails are a suggestion. This is enforcement.

  1. 0.1Thesis

    Inspect every action, not every quarter

    An agent’s behaviour shifts with every input, every tool, every retrieved document. An agent you don’t inspect at runtime is a breach accruing one tool-call at a time.

  2. 0.2Method

    Six detectors, in parallel, inline

    Injection, credential leaks, tool poisoning, excessive agency, exfiltration and supply chain — run against every prompt, tool-call and MCP config.

  3. 0.3Verdict

    Allow, flag or block — with evidence

    A deterministic severity policy grades each finding and returns a verdict with payload-level evidence. No model in the hot path.

Surface
Prompts, tool-calls & MCP configs
Engine
Deterministic — no model in the hot path
Standards
OWASP LLM Top 10 · MITRE ATLAS aligned
0.4How we talk
  • [ LLM01 ]Prompt injection
  • [ LLM02 ]Sensitive disclosure
  • [ LLM03 ]Supply chain
  • [ LLM06 ]Excessive agency
  • [ MCP-TP ]Tool poisoning
Meet the engine

Six DetectorsOne Runtime

Every request runs the full pipeline in parallel against the agent’s activity — prompts, tool-calls and MCP configs.

No model in the hot path.

Explore in depth
DevelopersAPI reference
DetectorsSpecifications
02 / 06
[ DET-02 ]OWASP LLM01

Prompt injection

Direct and indirect injection, jailbreak personas and system-prompt override or extraction attempts in inbound content — caught before the agent acts on them. Deterministic signatures return explainable findings without a model dependency.

Class
Direct + indirect
Engine
Deterministic
Standard
LLM01 · LLM07

Verdict policy: block on CRITICAL or HIGH, flag on MEDIUM, allow the rest.

How it works

The inspection API One call before every action

Developer docs

Drop-in, synchronous, at the edge

Your agent calls POST /api/inspect with a Bearer oton_sk_ key before it acts. Six deterministic detectors run in parallel on Cloudflare Workers and return an allow, flag or block verdict with payload-level evidence.

Only aggregates are stored — verdict, per-category counts, latency. Raw prompt and response content is never stored or logged.

POST /api/inspect
Authorization: Bearer oton_sk_…

{ "input": {
    "role": "user",
    "content": "…" } }

→ { "verdict": "block",
    "findings": [ … ] }
0.5Containment

Every threat, contained — before the agent acts.

CRITICAL and HIGH findings are blocked in-line, with payload-level evidence — the agent never gets to run them.

allow · flag · block
1.0

Deterministic verdicts

Block on critical or high. Flag on medium. Every verdict ships with its evidence.
Read the docs
2.0

Design partners

A focused production evaluation for teams operating AI agents. One workflow, integrated inspection, measured findings and latency — and a go/no-go decision together.

Apply for the pilot
3.0

Get in touch

Questions about putting OTONMI in front of your agents? Write to the founders directly — Moise Kenge, Founder & CTO · Security+ · OSINT.

hello@otonmi.com