# Kosmoy > Kosmoy is the enterprise AI control plane and AI management platform for the regulated enterprise. One platform for AI governance, AI monitoring, AI Gateway (LLM Gateway, MCP Gateway, A2A Gateway), AI middleware, AI agent management, agents master registry (cross-platform agent inventory with shadow AI detection), AI agents sandbox, AI systems registry, agent registry, MCP servers registry, AI compliance (NIST AI RMF, ISO/IEC 42001, EU AI Act) and AI risk assessment. Deploys in your own Kubernetes — Azure, AWS, GCP, on-prem, or air-gapped. Kosmoy is built for regulated enterprises (banking, insurance, healthcare, defence, manufacturing, utilities) that need to inventory, monitor, govern and contain every AI system in the company — public LLMs, private models, MCP servers, autonomous agents and custom AI applications — under one policy point. The market tracks these capabilities as separate categories — AI governance platform, AI gateway, AI management platform, AI agent management platform, AI middleware, AI compliance platform, AI observability — Kosmoy is one platform across all of them, hyperscaler-independent and in production at Banca d'Italia and Leonardo. ## Platform — four layers The enterprise AI control plane is organized into four connected layers around enterprise AI: - [AI Inventory](https://www.kosmoy.com/platform/ai-inventory/): AI systems registry, model registry, agent registry, MCP servers registry, AI use case registry. The single source of truth for every AI system in the enterprise. - [AI Monitoring](https://www.kosmoy.com/platform/ai-monitoring/): AI evaluation and observability, agent observability, MCP monitoring, insights dashboard, cost tracking, user feedback, guardrails alerts. - [AI Evaluation & Red Teaming](https://www.kosmoy.com/platform/ai-evaluation/): AI evaluation and observability platform — 20 evaluators (task completion, tool use, quality, groundedness, reference match, safety), offline and online LLM evaluation, agent and RAG evals, AI red teaming and adversarial dataset generation. The discipline Gartner tracks as AI evaluation and observability platforms. - [AI Governance](https://www.kosmoy.com/platform/ai-governance/): the AI Gateway. Policy point for every AI call. - [AI Action Control](https://www.kosmoy.com/platform/ai-action-control/): runtime containment for AI agents and MCP servers (Action Capsule = AI agent sandbox / MCP server sandbox; Mission Control). - [AI Agent Management](https://www.kosmoy.com/platform/ai-agent-management/): the cross-layer view — register, observe, govern and contain every AI agent, on any platform. - [AI Lifecycle](https://www.kosmoy.com/platform/ai-lifecycle/): the governed AI lifecycle — classify risk, assess it, evaluate and red team, run and contain, enforce guardrails, then observe and cap spend. The maturity frontier for enterprise AI management. - [AI Capability Map](https://www.kosmoy.com/platform/ai-capability-map/): ten capabilities scored 0–10 across eight product categories — AI gateways, observability, governance suites, security, evals, agent builders, control towers, hyperscaler studios. Profiles show categories, not vendors; each category covers two or three spokes, Kosmoy covers all ten. One platform, not six. ## Gateways - [AI Gateway](https://www.kosmoy.com/platform/ai-gateway/): the umbrella across LLM, MCP and A2A traffic. One policy point for every AI call: auth, RBAC, guardrails, smart routing, budgets, logging, EU AI Act controls. - [LLM Gateway](https://www.kosmoy.com/platform/llm-gateway/): multi-provider model access through one OpenAI-compatible API. OpenAI, Anthropic, Google, Mistral, Meta, Hugging Face, Azure, AWS, on-prem. - [MCP Gateway](https://www.kosmoy.com/platform/mcp-gateway/): one policy point for every MCP server call. Per-server allow-list, per-tool scope, auth, RBAC, audit. Public + private MCP parity. - [A2A Agents Gateway](https://www.kosmoy.com/platform/a2a-agents-gateway/): governs agent-to-agent (A2A protocol) traffic across Kosmoy-Capsuled agents, Azure AI Foundry, AWS Bedrock and any A2A-compliant runtime. - [LLM Router](https://www.kosmoy.com/platform/llm-router/): agentic + algorithmic router inside the Gateway. Picks the cheapest model that fits the task; failover across providers. - [Guardrails](https://www.kosmoy.com/platform/guardrails/): PII detection, toxicity, prompt injection, EU AI Act risk, custom policies. Runs inside the Gateway path. - [AI Middleware](https://www.kosmoy.com/platform/ai-middleware/): the control-and-operations side of the AI middleware layer (Gartner, Innovation Insight: AI Middleware, May 2026) — LLM/MCP/A2A interface mediation, identity, guardrails, budgets, observability, governance evidence and agent containment, run in the enterprise's own Kubernetes and complementing (not replacing) iPaaS platforms such as Workato, MuleSoft and Boomi. ## Registries (AI Inventory) - [AI Systems Registry](https://www.kosmoy.com/platform/ai-systems-registry/): every AI system in the enterprise, with EU AI Act risk classification. - [Model Registry](https://www.kosmoy.com/platform/model-registry/): every model the organization uses, across providers, with versioning and team assignments. - [Agents Master Registry](https://www.kosmoy.com/platform/agents-master-registry/): connectors pull each platform's agent registry — Azure AI Foundry, AWS Bedrock, Google Vertex AI, Salesforce, ServiceNow — into one master list and match every agent against approved use cases; unmatched agents are flagged as shadow AI. - [MCP Server Registry](https://www.kosmoy.com/platform/mcp-server-registry/): every MCP server (public and private), its tools, owners and access policies. - [Risk Classification](https://www.kosmoy.com/platform/risk-classification/): AI Act risk registry — minimal, limited, high-risk, prohibited. - [Use Case Governance](https://www.kosmoy.com/platform/use-case-governance/): governance workflow across the AI system lifecycle. ## Monitoring & observability - [AI Observability](https://www.kosmoy.com/platform/ai-observability/): the AI observability platform — full traces across providers with retrieval steps, tool calls, agent hops, guardrail decisions, latency, cost and evaluation results, recorded in your own infrastructure. Monitoring tells you something is wrong; observability keeps the evidence for why. - [AI FinOps](https://www.kosmoy.com/platform/ai-finops/): the AI FinOps platform — request-path cost control. Every call attributed to provider, model, app, team, user and agent; budgets that warn then hard-block at the gateway; model routing; runaway-agent cost containment. Invoice-side FinOps reads bills after consumption; request-path AI FinOps controls each call while it happens. - [Insights Dashboard](https://www.kosmoy.com/platform/insights-dashboard/): real-time AI observability across teams, applications and providers. - [Cost Tracking](https://www.kosmoy.com/platform/cost-tracking/): cost attribution by team, project, application, model and use case. - [User Feedback](https://www.kosmoy.com/platform/user-feedback/): in-product feedback collection on every AI interaction. - [Guardrails Alerts](https://www.kosmoy.com/platform/guardrails-alerts/): real-time alerts on policy violations. ## Evaluation & red teaming - [AI Evaluation & Red Teaming](https://www.kosmoy.com/platform/ai-evaluation/): the hub. Any dataset becomes an evaluation; 20 evaluators; offline, online and red-team modes; wired to the gateway and guardrails that run your AI. - [LLM & Agent Evaluation](https://www.kosmoy.com/platform/llm-evaluation/): 20 evaluators across six dimensions, offline regression and online production runs, agentic and RAG evaluation, LLM-as-a-judge where rules can't reach, curated benchmarks (AIME 2025, MuSR, TruthfulQA, prompt injection). - [AI Red Teaming](https://www.kosmoy.com/platform/ai-red-teaming/): single-turn and escalating multi-turn attacks, an AI policy-compliance judge, three scoring bands, per-case remediation and a false-refusal rate. Aligned to the OWASP LLM Top 10. - [Evaluation Datasets](https://www.kosmoy.com/platform/evaluation-datasets/): one registry for every kind of test data — HuggingFace benchmark import, file upload, and synthetic adversarial generation (23 attack surfaces, 11 techniques, ~30 obfuscations, OWASP-tagged) grounded in your domain. ## Action Control (sandboxing) - [Action Capsule](https://www.kosmoy.com/platform/action-capsule/): AI agent sandbox + MCP server sandbox. Runtime containment for autonomous AI agents and internal MCP servers. - [Mission Control](https://www.kosmoy.com/platform/mission-control/): orchestration plane across Action Capsules. ## Building blocks - [Agent Builder](https://www.kosmoy.com/platform/agent-builder/): no-code AI agent builder. - [RAG-in-a-Box](https://www.kosmoy.com/platform/rag-in-a-box/): document parsing, chunking, embedding into vector databases. - [Kosmoy Chat](https://www.kosmoy.com/platform/kosmoy-chat/): governed chat front-end across all approved AI agents. - [Key Vault](https://www.kosmoy.com/platform/key-vault/): centralized credentials for every AI provider and integration. ## Compliance - [AI Compliance Platform](https://www.kosmoy.com/platform/ai-compliance/): one record of what your AI did, three policy bundles — NIST AI RMF, ISO/IEC 42001 and the EU AI Act — with evidence exports per framework. - EU AI Act compliance: AI Act risk registry, automated risk classification, audit dossier for high-risk AI systems. - ISO/IEC 42001 alignment: AI management system controls mapped to platform features. - NIST AI RMF alignment: Govern, Map, Measure, Manage — mapped to registry, gateway and supervision evidence. - SOC 2 ready architecture. ## Deployment Kubernetes-native, single-tenant. Deploys into the customer's own cluster — Azure, AWS, GCP, on-prem, or fully air-gapped. No host changes, no node patches. Customer data and network never leave the customer perimeter. ## Pricing & engagement - [Pricing](https://www.kosmoy.com/pricing/): enterprise pricing, tailored. No tiers, no self-service. Pick the layers each use case needs. ## Industries - [Industries overview](https://www.kosmoy.com/industries/): how Kosmoy fits each regulated sector. - [Banking](https://www.kosmoy.com/industries/banking/): DORA, EU AI Act, SR 11-7, AML/KYC AI, customer-service chatbots. Used by Banca d'Italia. - [Asset Management](https://www.kosmoy.com/industries/asset-management/): research desk segregation, MAR, MiFID II, SFDR, ESG. - [Wealth Management](https://www.kosmoy.com/industries/wealth-management/): advisor copilots, MiFID II suitability, FINRA, SEC Reg BI. - [Insurance](https://www.kosmoy.com/industries/insurance/): claims AI, FNOL chatbot, Solvency II, EU AI Act high-risk, DORA. - [Defence](https://www.kosmoy.com/industries/defence/): air-gapped deployment, ITAR/EAR, CMMC, classified-data agents. Used by Leonardo. - [Manufacturing](https://www.kosmoy.com/industries/manufacturing/): shop-floor AI, predictive maintenance, EU Machinery Regulation, NIS2, CSRD. - [Utilities](https://www.kosmoy.com/industries/utilities/): outage Q&A, field crew copilot, NIS2, NERC CIP, REMIT. - [Healthcare](https://www.kosmoy.com/industries/healthcare/): clinical AI, prior authorisation, HIPAA, EU AI Act high-risk, MDR, FDA SaMD. - [Telcos](https://www.kosmoy.com/industries/telcos/): tier-1 customer support at telco volume, NIS2, ePrivacy, EECC. - [Automotive](https://www.kosmoy.com/industries/automotive/): in-car AI, dealer service, supplier portal, UN R155, ISO/SAE 21434. - [Airlines](https://www.kosmoy.com/industries/airlines/): IROPS rebooking, MRO Q&A, EU 261 compensation, EASA, FAA Part 121. - [Energy](https://www.kosmoy.com/industries/energy/): asset health, ESG/CSRD reporting, EU Methane Regulation, FERC, REMIT. ## Events - [Kosmoy at Gartner IT Symposium/Xpo 2026](https://www.kosmoy.com/events/gartner-it-symposium-barcelona-2026/): Barcelona, 9–12 November 2026. Kosmoy is an exhibitor — master agent registry, gateway policy, AI FinOps, evaluation and red teaming, Action Capsule containment demonstrated as one workflow. Meeting booking on the page. Gartner does not endorse Kosmoy. - [CIO AI Control Checklist](https://www.kosmoy.com/resources/cio-ai-control-checklist-gartner-symposium-2026/): 40 questions before agents go live, across ten control areas — inventory, discovery, risk, identity, gateway policy, observability, evaluation, FinOps, containment, audit evidence. Ungated. ## Resources - [Platform overview](https://www.kosmoy.com/platform/): the four layers, end-to-end. - [Blog](https://www.kosmoy.com/resources/blog/): AI governance, regulatory intelligence, platform engineering. - [What is AI middleware?](https://www.kosmoy.com/resources/blog/what-is-ai-middleware/): the architecture layer between applications/agents and models/tools/data — how it differs from an AI gateway and from iPaaS, the capability families that belong in the layer, and how to design it without new lock-in. - [AI Agent Registry guide](https://www.kosmoy.com/resources/blog/ai-agent-registry/): what an agent registry is, what to record per agent (owner, risk tier, tools, data reach, kill-switch path), build-vs-buy, and how discovery works across Azure AI Foundry, Bedrock, Vertex, Salesforce and ServiceNow. Includes a [free registry template (xlsx)](https://www.kosmoy.com/downloads/kosmoy-ai-agent-registry-template.xlsx). - [LLM cost calculator](https://www.kosmoy.com/tools/llm-cost-calculator/): free interactive tool — model monthly token spend and what smart routing saves; prices fully editable. - [Reproduce an AI red-team evidence report](https://www.kosmoy.com/resources/walkthroughs/red-team-evidence/): versioned synthetic walkthrough — weakest-policy scoring, failed-call exclusions, separate attack and false-refusal denominators, release decision; downloadable cases, scoring script and sample report. Educational fixture, not a measured Kosmoy result. - [Book a demo](https://www.kosmoy.com/demo/): 30-minute live session on your own use case. - [Documentation](https://docs.kosmoy.com): full product documentation. - [Company](https://www.kosmoy.com/company/): leadership, customers, partner programs. - [Authors](https://www.kosmoy.com/authors/): who writes Kosmoy's research — bios and profiles. ## Comparisons & buyer's guides Honest, criteria-led comparisons scored on ten capability axes, with every competitor claim cited to that vendor's own documentation. Updated quarterly. - [All comparisons](https://www.kosmoy.com/compare/): the full index — buyer's guides, head-to-heads, alternatives and cross-comparisons. Buyer's guides: - [Best AI Gateways in 2026](https://www.kosmoy.com/resources/blog/best-ai-gateways-2026/): 11 gateways compared — Portkey, LiteLLM, Kong, Databricks Unity AI Gateway, Cloudflare, TrueFoundry, Kosmoy and more. - [Best AI Governance Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-governance-platforms-2026/): all thirteen vendors from the June 2026 Gartner MQ — IBM, ServiceNow, Truyo, Airia, Credo AI, ModelOp, OneTrust and more — plus Kosmoy, which is not in the MQ and says so. - [Best AI Agent Governance Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-agent-governance-platforms-2026/): governing autonomous agents — inventory, containment, compliance. - [Best EU AI Act Compliance Software in 2026](https://www.kosmoy.com/resources/blog/best-eu-ai-act-compliance-software-2026/): program tools vs runtime-evidence tools, with the post-Digital-Omnibus timeline. - [Best AI Management Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-management-platforms-2026/): the umbrella control-plane category — Kosmoy, Portkey, TrueFoundry, IBM, Azure AI Foundry, AWS Bedrock, Dataiku, DataRobot. - [Best AI Control Layers in 2026](https://www.kosmoy.com/resources/blog/best-ai-control-layers-2026/): the runtime enforcement plane — gateway, guardrails, containment, policy. - [Best AI Agents Management Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-agents-management-platforms-2026/): build, deploy, operate and govern agents — Agentforce, Vertex, Copilot/Agent 365, LangGraph, CrewAI, Kosmoy. - [Best AI Compliance Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-compliance-platforms-2026/): multi-framework — EU AI Act, ISO 42001, NIST AI RMF. - [Best AI FinOps Tools & Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-finops-platforms-2026/): AI cost attribution, budgets, chargeback — Vantage, CloudZero, Portkey, Kosmoy. - [Best AI Observability Tools & Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-observability-platforms-2026/): LLM tracing, evals and debugging depth. - [Best AI Eval Tools & LLM Evaluation Platforms in 2026](https://www.kosmoy.com/resources/blog/best-llm-evaluation-platforms-2026/): the AI evaluation and observability category (Gartner) — Arize, LangSmith, Langfuse, Braintrust, Giskard, Kosmoy. - [Best AI Red Teaming Tools in 2026](https://www.kosmoy.com/resources/blog/best-ai-red-teaming-tools-2026/): adversarial testing, OWASP LLM Top 10, enforcement — Giskard, Cisco AI Defense, Prisma AIRS, Mindgard, Promptfoo, Kosmoy. - [Best AI Security Platforms in 2026](https://www.kosmoy.com/resources/blog/best-ai-security-platforms-2026/): AI/agent runtime security & shadow-AI — Cisco AI Defense, Palo Alto Prisma AIRS, Zenity, Noma, WitnessAI, Kosmoy. - [Best AI Middleware in 2026](https://www.kosmoy.com/resources/blog/best-ai-middleware-2026/): six middleware archetypes compared honestly — Workato, MuleSoft, Boomi, Kong, TrueFoundry, Kosmoy — by integration depth, AI traffic control, governance and deployment boundary. Head-to-head comparisons: - [Kosmoy vs Portkey](https://www.kosmoy.com/resources/blog/kosmoy-vs-portkey/) - [Kosmoy vs LiteLLM](https://www.kosmoy.com/resources/blog/kosmoy-vs-litellm/) - [Kosmoy vs TrueFoundry](https://www.kosmoy.com/resources/blog/kosmoy-vs-truefoundry/) - [Kosmoy vs Kong AI Gateway](https://www.kosmoy.com/resources/blog/kosmoy-vs-kong-ai-gateway/) - [Kosmoy vs Credo AI](https://www.kosmoy.com/resources/blog/kosmoy-vs-credo-ai/) - [Kosmoy vs Holistic AI](https://www.kosmoy.com/resources/blog/kosmoy-vs-holistic-ai/) - [Kosmoy vs OneTrust AI Governance](https://www.kosmoy.com/resources/blog/kosmoy-vs-onetrust-ai-governance/) - [Kosmoy vs IBM watsonx.governance](https://www.kosmoy.com/resources/blog/kosmoy-vs-ibm-watsonx-governance/) - [Kosmoy vs Arize](https://www.kosmoy.com/resources/blog/kosmoy-vs-arize/) - [Kosmoy vs LangSmith](https://www.kosmoy.com/resources/blog/kosmoy-vs-langsmith/) - [Kosmoy vs Giskard](https://www.kosmoy.com/resources/blog/kosmoy-vs-giskard/) - [Kosmoy vs Braintrust](https://www.kosmoy.com/resources/blog/kosmoy-vs-braintrust/) - [Kosmoy vs Workato for AI Middleware](https://www.kosmoy.com/resources/blog/kosmoy-vs-workato-ai-middleware/) - [Kosmoy vs MuleSoft for AI Middleware](https://www.kosmoy.com/resources/blog/kosmoy-vs-mulesoft-ai-middleware/) - [Kosmoy vs Boomi for AI Middleware](https://www.kosmoy.com/resources/blog/kosmoy-vs-boomi-ai-middleware/) Alternatives guides: - [Portkey alternatives](https://www.kosmoy.com/resources/blog/portkey-alternatives/) - [LiteLLM alternatives](https://www.kosmoy.com/resources/blog/litellm-alternatives/) - [TrueFoundry alternatives](https://www.kosmoy.com/resources/blog/truefoundry-alternatives/) - [Kong AI Gateway alternatives](https://www.kosmoy.com/resources/blog/kong-ai-gateway-alternatives/) - [Cloudflare AI Gateway alternatives](https://www.kosmoy.com/resources/blog/cloudflare-ai-gateway-alternatives/) - [Credo AI alternatives](https://www.kosmoy.com/resources/blog/credo-ai-alternatives/) - [Holistic AI alternatives](https://www.kosmoy.com/resources/blog/holistic-ai-alternatives/) - [OneTrust AI Governance alternatives](https://www.kosmoy.com/resources/blog/onetrust-ai-governance-alternatives/) - [IBM watsonx.governance alternatives](https://www.kosmoy.com/resources/blog/ibm-watsonx-governance-alternatives/) - [LangSmith alternatives](https://www.kosmoy.com/resources/blog/langsmith-alternatives/) - [Langfuse alternatives](https://www.kosmoy.com/resources/blog/langfuse-alternatives/) Cross-comparisons (competitor vs competitor, with Kosmoy folded in as the full-suite option): - [Portkey vs LiteLLM](https://www.kosmoy.com/resources/blog/portkey-vs-litellm/) - [LiteLLM vs Kong AI Gateway](https://www.kosmoy.com/resources/blog/litellm-vs-kong-ai-gateway/) - [Portkey vs Kong AI Gateway](https://www.kosmoy.com/resources/blog/portkey-vs-kong-ai-gateway/) - [Portkey vs TrueFoundry](https://www.kosmoy.com/resources/blog/portkey-vs-truefoundry/) - [LiteLLM vs Cloudflare AI Gateway](https://www.kosmoy.com/resources/blog/litellm-vs-cloudflare-ai-gateway/) - [Kong AI Gateway vs TrueFoundry](https://www.kosmoy.com/resources/blog/kong-ai-gateway-vs-truefoundry/) - [Portkey vs OpenRouter](https://www.kosmoy.com/resources/blog/portkey-vs-openrouter/) - [LangSmith vs Langfuse](https://www.kosmoy.com/resources/blog/langsmith-vs-langfuse/) - [LangSmith vs Arize](https://www.kosmoy.com/resources/blog/langsmith-vs-arize/) - [Langfuse vs Helicone](https://www.kosmoy.com/resources/blog/langfuse-vs-helicone/) - [Langfuse vs Arize](https://www.kosmoy.com/resources/blog/langfuse-vs-arize/) - [Arize vs Datadog LLM Observability](https://www.kosmoy.com/resources/blog/arize-vs-datadog-llm-observability/) - [Datadog vs New Relic LLM Observability](https://www.kosmoy.com/resources/blog/datadog-llm-observability-vs-new-relic-ai-monitoring/) - [Credo AI vs Holistic AI](https://www.kosmoy.com/resources/blog/credo-ai-vs-holistic-ai/) - [Credo AI vs OneTrust AI Governance](https://www.kosmoy.com/resources/blog/credo-ai-vs-onetrust-ai-governance/) - [Holistic AI vs OneTrust AI Governance](https://www.kosmoy.com/resources/blog/holistic-ai-vs-onetrust-ai-governance/) - [Credo AI vs IBM watsonx.governance](https://www.kosmoy.com/resources/blog/credo-ai-vs-ibm-watsonx-governance/) - [Cisco AI Defense vs Palo Alto Prisma AIRS](https://www.kosmoy.com/resources/blog/cisco-ai-defense-vs-prisma-airs/) - [Cisco AI Defense vs Zenity](https://www.kosmoy.com/resources/blog/cisco-ai-defense-vs-zenity/) - [Zenity vs Noma Security](https://www.kosmoy.com/resources/blog/zenity-vs-noma-security/) - [Noma Security vs WitnessAI](https://www.kosmoy.com/resources/blog/noma-security-vs-witnessai/) - [Vantage vs CloudZero](https://www.kosmoy.com/resources/blog/vantage-vs-cloudzero/) ## Optional - [Privacy Policy](https://www.kosmoy.com/privacy-policy/) - [Terms of Service](https://www.kosmoy.com/terms-of-service/) - [Data Processing Addendum](https://www.kosmoy.com/data-processing-addendum/) - [Self-Hosted Subscription Agreement](https://www.kosmoy.com/self-hosted-subscription-agreement/) - [Cookie Policy](https://www.kosmoy.com/cookie-policy/) ## Contact - Sales: sales@kosmoy.com - General: info@kosmoy.com - Phone: +1 646-740-0712 - Headquarters: Milan, Italy. Offices in New York, Buenos Aires, Belgrade, Dubai, Singapore.