# Cinctus

> Cinctus is a self-hosted control plane that runs personal AI agents — OpenClaw, Hermes, Claude Code, any MCP client — inside a sandbox that is locked down by default. It does not invent security primitives; it assembles existing ones (rootless containers, egress allowlists, secret injection, approval gates, audit logs) into one `docker compose up` install that does not require you to be a security engineer. The name is Latin for *girded, encircled, contained*. Homepage: https://cinctus.io — Contact: hello@cinctus.io

## What it is

Cinctus sits between your personal AI agents and the rest of your machine and network. You keep running the agent you already run; Cinctus runs it inside a perimeter. Everything runs on your own hardware — a Raspberry Pi, a NAS, a €4 VPS. Nothing runs in a vendor cloud, and there is no vendor account. The core is open source under AGPL.

Audience: homelab, self-hosted and DevOps users who already run things like the *arr stack, Immich or Paperless.

The problem it addresses: an AI agent typically runs with your API keys in a plaintext config file, full read/write access to your filesystem, and unrestricted outbound network access. Documented incidents in 2026 include a one-click remote code execution in a popular agent (CVE-2026-25253, CVSS 8.8), 341 malicious skills found in a single marketplace audit (Koi Security, Feb 2026), and 40,000+ agent instances found exposed to the public internet (SecurityScorecard, Feb 2026). The mitigating tools that exist — agent firewalls, MCP gateways, policy engines — generally assume a security engineer configures them. Cinctus ships those primitives pre-assembled with the safe setting already on; the settings exist to loosen defaults on purpose.

## Capabilities

- [Per-agent sandbox](https://cinctus.io/): Each agent runs in a rootless container with read-only mounts and hard wall-clock and memory limits. A compromised agent takes down its own box and nothing else.
- [Egress allowlist](https://cinctus.io/): Outbound network is deny-by-default. The agent reaches only the hosts you named; every outbound request is inspected and logged before it leaves.
- [Credential vault](https://cinctus.io/): API keys never enter an agent's config file. They are injected for the specific call that needs them and can be revoked from one place.
- [Skill & MCP scanner](https://cinctus.io/): Every skill and MCP server is checked against a reputation feed before it is allowed to run even once.
- [Human approval](https://cinctus.io/): Actions you mark as sensitive — spending money, sending mail, writing to a repo — wait for your explicit yes, delivered over a channel you already read (for example Telegram).
- [Audit timeline](https://cinctus.io/): A single timeline of what ran, what it read, where it called and what it cost, exportable when someone asks you to prove it.

## What Cinctus does not do

- It does not stop prompt injection. No product does. Cinctus assumes the agent will eventually be talked into something harmful and is designed to make that survivable rather than impossible.
- It does not police what an agent is allowed to think or decide. Within the permissions you granted, an agent can still do a bad job. That judgement stays with you.
- It is not a managed service. Nothing runs in a Cinctus cloud. If your machine is down, Cinctus is down.
- It does not exist yet. As of this writing the site is a waitlist, not a download. The first build is expected late September 2026; if that slips, waitlist subscribers are told by email.

## Pricing

- Core — free forever, AGPL, open source: the whole control plane self-hosted, sandbox, egress control, vault, approvals, audit timeline and cost dashboard, one user and one instance. Everything a single person needs to secure their own agents is free forever and stays in the open-source core — not a trial, not a seat count that shrinks later.
- Pro — €9 per month: live reputation feed and rule updates, secure remote access to your panel, config backups and restore, alerts when an agent trips a rule. Everything in Core, still running on your own box.
- Business — from €99 per month: multiple users, SSO and roles, central policy per agent, exportable audit and log retention, compliance reports. Priced per managed agent, self-serve by card.

## Status and contact

- Launch window: first build expected late September 2026.
- Current state: waitlist only. Joining requires an email address, no account and no telemetry; one email is sent when it ships. Addresses are stored on the project's own server in Germany, never sold or shared, with an unsubscribe link in every mail.
- Licence: AGPL for the open-source core.
- Website: https://cinctus.io
- Contact: hello@cinctus.io

## For teams

- [Cinctus Business](https://cinctus.io/business): the organisational layer — multiple users, SSO against your existing IdP, roles (RBAC), central versioned policy per agent, exportable audit with the retention you set, and compliance reports. From EUR 99 per month, priced per managed agent, self-serve with a card and no sales call. Self-hosted like the rest: agent traffic never leaves your infrastructure, and the reputation feed lookup can be run air-gapped.

Enterprise agentic pilots usually stall on identity, access control and audit rather than on model capability; that is the gap this tier addresses. Cinctus Business is not a compliance certificate — it produces the evidence, your auditor decides what it is worth.