Secure AI software delivery,
on your terms.
CoBolt IDE is a desktop development environment that puts AI agents to work on your codebase under policy, approval, sandboxing and a tamper-evident audit trail. It runs on your engineers’ machines, with your model keys, and keeps the evidence.
- Windows, macOS and Linux
- Local-first, nothing collected by default
- Bring your own model keys
1export async function signup(req, res) {2const body = validate(req.body, schema)3if (!body.ok) return res.status(422)4// ai: coder · approved by code-owner5const user = await createUser(body.value)6return res.json(user)7}
Coder agent wants to run a shell command. Review the exact command before it executes.
- Policy: workspace layer
- Sandbox: Landlock
- Egress: local only
Three things go wrong when AI agents meet real codebases.
Coding assistants are easy to adopt and hard to govern. CoBolt was built for the second problem.
An agent that can edit files can also delete them, run installers, or push to a remote. Most tools decide this in the UI layer, where a prompt injection can talk its way past the check.
Every agent tool call is decided in Rust, not the renderer. Policy resolves managed, workspace, user and default layers, deny-first, over a compiled-in floor that no configuration can clear. Risky calls stop for an approval card that shows the exact command.
API keys pasted into editors, prompts that carry credentials or customer records, and terminal output that quietly travels to a provider.
Keys live in an encrypted vault and are injected by the backend at a loopback proxy, so they never re-enter the UI. Outbound context passes a DLP-aware firewall with deterministic secret, PII and PCI detectors. Local runtimes cover work that must not leave the machine.
Auditors, security teams and clients ask which lines were machine-written, who approved the risky steps, and under what policy. Chat history is not an answer.
Decisions, approvals, mode changes and trust events are written to an append-only, hash-chained log with signed checkpoints. Provenance and per-line attribution ride with the code, and an evidence bundle can be verified without the IDE.
A real IDE, with AI wired through it under control.
Everything below ships in the current build. Each capability has a matching control surface in Settings.
Start with the built-in Coder, Architect, Code-Reviewer, Security and Designer agents, or define your own with instructions, tool bundles, MCP allow-lists and lifecycle hooks. Each agent runs with only the tools you gave it.
Per-agent containment: tier, network, filesystem scope, CPU, memory, process and wall-clock governors.
Pick a workflow and watch it run: Plan then Execute, Parallel Review, Research and Design, Fix with Verification, Swarm Brainstorm and a security-hardening flow. The native Orchestra conductor drives multi-lane delivery with a live run panel and resumable runs.
Orchestra lanes: plan ▸ intel ▸ git ▸ add ▸ fix ▸ review ▸ UAT. 21 built-in workflows.
Connect OpenAI, Anthropic, Google, Azure OpenAI, Amazon Bedrock, Google Vertex AI, Mistral AI, xAI, Groq, Cerebras, DeepSeek, OpenRouter and more, or run Ollama, LM Studio and vLLM without any key at all. Publish a curated model list and route work types to the right model.
Vault: AES-256-GCM with an Argon2id-derived key, sealed in the OS keychain or your own KMS.
Choose how much autonomy each conversation gets: Plan is read-only, Cautious asks before every tool, Default allows safe tools and asks for risky ones, Auto Edits approves file edits, Full Auto is for sandboxed environments only. An auto-approve budget caps how many calls resolve on their own.
The security floor applies in every mode: secret files, workspace escape and path violations are always blocked.
A terminal-scoped assistant explains a command before you run it, turns a failed command into a diagnosis using the shell’s exit code, and proposes a fix you approve before it executes. Agents can also run as sessions inside the terminal over the Agent Client Protocol.
Opt-in session recording is AES-256-GCM encrypted at rest and redacted at write.
CodeMirror 6 with Vim mode and nine themes, language intelligence over LSP for Rust, Go, Python, TypeScript, C#, Java and Kotlin, a debugger built on DAP adapters (beta), and an xterm terminal with profiles, splits and reload-survival.
Model Context Protocol servers run in a reduced-privilege broker process. Each tool’s name, description and schema is fingerprinted when you trust it; if any of them change, calls are blocked until you review the difference.
Tool descriptions and outputs are scanned for injection markers. Each server gets its own outbound host allow-list.
Run history and replay, an AI provenance ledger, per-line AI attribution with a licence gate, CycloneDX SBOM and CVE gating, a supply-chain check on agent-added dependencies, and commit and artifact signing.
Standalone command-line verifiers work in CI and air-gapped environments without the IDE.
Landlock on Linux and Seatbelt on macOS confine the filesystem; Windows uses Job Objects for process and resource containment. The sandbox level actually applied is written to the record.
From a request to a reviewed change, with a record at every step.
This is the path every agent action takes. The order is fixed in the backend and cannot be skipped from the interface.
- 01Ask
Describe the task and pick an agent or workflow. Attach files, terminal output or a diff as context.
- 02Route
The model call goes to a loopback proxy. The backend injects the provider key from the vault; it never enters the interface.
- 03Gate
Each tool call meets the policy gate: managed ▸ workspace ▸ user ▸ defaults, deny-first, over a compiled-in floor.
- 04Approve
Risky calls surface as an approval card with the exact command. Approve once, for the session, the workspace or forever.
- 05Run sandboxed
Execution happens under Landlock, Seatbelt or a Windows Job Object. The level applied is written to the record.
- 06Review the diff
Proposed edits open side by side and are accepted per hunk. Applied lines carry AI attribution and a provenance entry.
- 07Keep the evidence
Every decision is a blake3-chained audit entry with periodic Ed25519 checkpoints. Export a bundle and verify it offline.
Where governed agents earn their keep.
Six scenarios drawn from the controls that exist in the product today.
Distribute a signed managed-policy bundle that fixes the sandbox mode, the approval ceiling and the egress allow-list. Publish the models engineers may use, set a default, and let budgets and cost-centre tags feed chargeback.
Build the air-gapped profile, route chat to local runtimes only, and let the DLP classifier stop secrets, PII and card data before egress. Retention floors, legal hold and data-subject requests are handled in the product, not a spreadsheet.
Export an evidence bundle for a date range and verify it offline. Freeze a workspace to read-only with no AI and no egress, collect a signed forensic package, or push a fleet-wide directive that disables MCP or burns credentials.
A red command block in the terminal is one click from a diagnosis grounded in the actual exit code and output. Proposed fixes wait for approval. Encrypted session recordings give the post-incident review a faithful replay.
Built-in scientist workflows coordinate research agents with hooks that classify data sensitivity, gate claims on evidence, verify citations and freeze the experiment protocol before execution. Every run is recorded in the run ledger.
Deliver a client repository with a per-line AI attribution report, a licence-gate verdict, a CycloneDX SBOM and signed commits. The provenance bundle shows which agent produced which change and who approved it.
Controls, deployment and integrations, as they ship today.
Filled markers are implemented in the current build. Hollow markers are in progress and should be treated as roadmap in any contract.
- OIDC sign-in with authorization code and PKCE, yielding a signed entitlement bundle.
- Role-based access enforced at MCP, agent, settings and credential call sites.
- SSO and SCIM directory console runs as a separate service outside the IDE.
- Managed policy bundles, signed, with per-module locks the interface cannot override.
- Capability drift detection through a fingerprint heartbeat.
- Incident directives: freeze, MCP disable, denylist, credential burn and panic, with dual control for irreversible operations.
- Context firewall and DLP on every outbound AI call, fail-closed.
- Retention, legal hold and eDiscovery across twelve local stores, with data-subject export and erasure.
- Key custody in the OS keychain, AWS KMS, Azure Key Vault, Google Cloud KMS, HashiCorp Vault or a PKCS#11 HSM.
- Telemetry off by default; the first-run consent screen sets what, if anything, is captured.
- Token and cost budgets for self, team and organisation, with admission checks and chargeback rollups.
- Dependency gate on agent-added packages, CVE gating, CycloneDX SBOM and SPDX licence checks.
- Commit and artifact signing, held-key or keyless.
- Tickets: Jira, Linear, Azure Boards and ServiceNow, read into agent context; changes are gated.
- CI status: GitHub, GitLab, Jenkins and Azure DevOps, read-only by design.
- MCP catalog and custom servers; remote workspaces over SSH, WSL and Dev Containers; corporate proxy and PAC support.
- Installer-first desktop app for Windows, macOS and Linux with a signed updater channel.
- Air-gapped build profile that omits network egress, telemetry export and the browser sidecar.
- Production code signing and notarization are being finalised for release.
- Bundled language servers; today servers are detected on the PATH.
Mapped, not certified.
CoBolt maps its controls to SOC 2 CC6, CC7 and CC8 and ISO 27001:2022 Annex A, and exports auditor-verifiable evidence for your own assessment. CoBolt IDE itself is not certified against these frameworks. Accessibility is documented in a self-attested VPAT 2.5.
Pre-release 0.23.
CoBolt IDE 0.23 is a pre-release commercial product. A server-side cloud mode and the bundled SDLC engine sidecar are not part of this build; delivery runs locally through the native Orchestra conductor.
Evaluate CoBolt IDE with your own policies and your own keys.
Evaluation builds run for 15 days on your machines. Nothing leaves the device unless you configure it to. sales@erup.ai · erup.ai/cobolt
- 01Tell us your platform mix, your model providers and the policies you need enforced.
- 02Install the evaluation build with a managed-policy bundle written for your environment.
- 03Run one real task through the gate, then export the audit chain and verify it offline.