Download AIControls · Self-hosted

Run AIControls in your own cluster.

Govern coding agents and Kubernetes agents from infrastructure you control.

Get started Request a license
Kubernetes ≥ 1.27Helm ≥ 3.12
install.sh
$ helm install aicontrols \
    oci://ghcr.io/nirmata/charts/aicontrols \
    -n aicontrols --create-namespace \
    -f values.yaml
NAME: aicontrols
STATUS: deployed

$ kubectl logs -n aicontrols deploy/aicontrols
started proxy
Why teams self-host AIControls

Control cost, keep teams fast, stop risky calls.

Cost

Set budgets that actually hold.

  • Spend limits per org, team or developer
  • Enforced at request time
  • Cut token waste with context optimization
Productivity

One endpoint, every tool.

  • No agents or SDKs to install
  • Shared MCP servers for everyone
  • Any provider: Anthropic, OpenAI, Bedrock, Vertex, Ollama
Security

Stop risky calls before they run.

  • Detect PII, secrets and prompt injection
  • Policy on every model and tool call
  • Every call recorded for audit
Install

Up and running in five steps.

Step 0

What do you want to govern?

Pick one and the steps below adapt. One install can govern both.

1

Create a values file

Deployment settings only. You'll connect LLM providers and policies in the Admin UI.

values.yaml
admin:
  email: "you@company.com"   # required
storage:
  persistentVolume:
    enabled: true
    size: 10Gi
ui:
  publicURL: "https://aicontrols.example.com"
2

Install with Helm

terminal
helm install aicontrols \
  oci://ghcr.io/nirmata/charts/aicontrols \
  -n aicontrols --create-namespace \
  -f values.yaml
get the bootstrap admin password
kubectl get secret aicontrols-admin-bootstrap -n aicontrols \
  -o jsonpath='{.data.password}' | base64 -d
3

Open the Admin UI and run setup

Log in as admin. The wizard connects an LLM provider, adds MCP servers and creates your first policy.

for testing · use Gateway API or Ingress in production
kubectl port-forward -n aicontrols svc/aicontrols 8080:8080 8081:8081
# Admin UI: http://localhost:8081/ui/
4

Activate your license

AIControls needs a signed license before it processes AI traffic. Licenses are tied to one cluster, identified by the UID of its kube-system namespace.

cluster ID · kube-system namespace UID
kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'
Sends your request to support@nirmata.com. We'll email your license key; add it in the Admin UI.
5

Connect your coding agents Desktop

Each developer creates an access token in AIControls, then points their tool at your endpoint.

~/.claude/settings.json
{
  "env": {
    "ANTHROPIC_BASE_URL": "https://aicontrols.example.com",
    "ANTHROPIC_AUTH_TOKEN": "YOUR_ACCESS_TOKEN"
  }
}
Tool calls are covered too. MCP traffic goes through the same endpoint, with no extra setup.

Connect your agent pods Kubernetes

Point agents at the in-cluster service. Or label them and let Kyverno inject the settings.

agent Deployment · env
env:
  - name: MCP_SERVER_URL
    value: "http://aicontrols.aicontrols.svc.cluster.local:8080"
  - name: OPENAI_BASE_URL
    value: "http://aicontrols.aicontrols.svc.cluster.local:8080/v1"
or: label the pod for Kyverno injection
metadata:
  labels:
    nirmata.io/ai-agent: "true"
Add identity. Mount a projected ServiceAccount token with audience aicontrols so each agent is verified. Agent identity guide →
Next steps

Put your first controls in place.

Write a policyAllow, deny or require approval Set a budgetToken and cost limits Review the audit logEvery call, attributed Full install guideTLS, Gateway API, upgrades
Rather not run it yourself?Use AIControls Cloud. Same controls, nothing to install.
Start on AIControls Cloud