Agents move fast.
Strazh holds them accountable.
Strazh launches your coding agent, so it is the one thing that can stop it.
▾ SCROLL
The gate.
The gate sits between the command and the process.
STRAZH · DISPATCH
PROCESS TREE
ENV
REJECTED
Every dispatch is on the record, even the ones that never ran.
Allow-list
agents touch only registered repos
Env scrub
secrets never enter the agent's process
Tree-kill
runaway processes end, whole tree, on timeout
Audit log
every dispatch, rejection, and review · queryable
Kernel jailWINDOWS · OPT-IN
AppContainer write-jail · Windows · opt-in
The gate decides what runs.
Coval decides what lands.
dispatch → diff → verdict → merge, on your call
COVAL · REVIEW
FILES TOUCHED
[✓] touch src/auth/session.ts (+~40 lines)
[✓] touch src/auth/keys.ts (rewrite)
[✓] remove config/legacy_keys.json
[·] touch .env FLAGGED
Review the blast radius before it merges.
COVAL REVIEW
@@ src/auth/session.ts
export function refresh(token) {
- const key = process.env.AWS_KEY
- if (!key) throw new Error("no key")
+ const key = vault.read("session-signing")
+ if (!key) return null
return sign(token, key)
}
@@ config/legacy_keys.json
- { "aws": "AKIA...", "openai": "sk-..." }
APPROVEREQUEST CHANGESREJECT
Review it like a colleague wrote it.
Strazh gates the machine. Coval keeps the code yours.
One gate. Every agent.
local agents run local · Devin is the one cloud exception
CLAUDE CODE
local CLI · gated + audited
dispatched with a prompt + repo, like the CLI itself
CODEX
local CLI · gated + audited
dispatched with a prompt + repo, like the CLI itself
CURSOR
local CLI · gated + audited
dispatched with a prompt + repo, like the CLI itself
DEVIN
cloud sessions · gated + audited · returns a PR
dispatched by opening a session against your repo
STRAZH · ENTITLEMENT
PLAN
METER
Local app
JSONL audit trail · your rules, your disk
a desktop console: allow-list, dispatch history, audit search
MCP server
any MCP client · same gate everywhere
same allow-list, env scrub, and tree-kill, called as a tool
same enforcement, either door
Windows today · signed MSI · macOS and Linux not yet packaged
Free
$0 · forever, 5 dispatches/day
Individual Pro
per seat/mo + $0.01/dispatch over 35/day
Enterprise
Contact us