Sold by: TaskHawk Systems
Deployed on AWS
Cryptographic interlock for autonomous AI agents. Six-layer formally verified kernel issues a signed ALLOW, CONSTRAIN, or DENY verdict before any action executes. Hash-chained evidence. Fail-closed.
Overview
Kevros AI Governance Gateway enforces verifiable governance on every AI agent decision before execution.
Autonomous AI agents are making high-stakes decisions at machine speed. Compliance infrastructure built for human-paced workflows cannot keep up. Kevros closes that gap. Every agent action receives a signed ALLOW, CONSTRAIN, or DENY verdict before it executes. Use cases include agent-initiated trade workflows, automated claims handling, industrial control supervision, and payment authorization. If governance is unreachable, execution halts. No exceptions. No silent failures.
Deploys inside your AWS account using AWS CloudFormation, Amazon ECS on AWS Fargate, Application Load Balancer, Amazon EFS, AWS Secrets Manager, and Amazon CloudWatch. Customer data and signing keys are not transmitted outside your account by default.
Six-Layer Formal Verification Kevros is the only AI governance offering on AWS Marketplace with end-to-end formal verification of the enforcement kernel. Six independent verification layers spanning model checking, SMT proofs, bounded checks, runtime assertions, cross-language vector regression, and interactive theorem proving collectively explore 1.94 billion system states and produce 71 SMT proofs and 20 mechanically-checked theorems with zero counterexamples and zero unproven assumptions.
Why Kevros Tamper-evident provenance ledger. Every governance decision is recorded in a hash-chained, append-only ledger on Amazon EFS. Auditors verify chain integrity using the published verifier specification.
Fail-closed architecture. Governance unavailability triggers automatic execution blocking. Agents cannot circumvent oversight under any failure condition. Dual-lane post-quantum signatures. ML-DSA-87 (FIPS 204) anchors every 100-record block of the hash-chained ledger. SLH-DSA-SHA2-256f (FIPS 205) provides the off-chain co-signing lane on settlement-class events. Quantum-resistant from day one.
Tier-conditioned rate limiting. Per-tier API Gateway UsagePlan throttling at the publisher edge. Free Trial 5 requests per second; Starter 25; Professional 50; Enterprise 200.
ML behavioral drift detection. Latency-drift and semantic-drift monitors flag anomalous agent behavior before violations materialize. CloudWatch and CEF observability. Container metrics and governance events surface in CloudWatch dashboards. CEF-formatted syslog export for any CEF-capable collector.
Built for AWS Deploys via AWS CloudFormation as a customer-side stack. Talon classifier inference runs in the TaskHawk publisher account; classifier weights never enter the customer image. Image is signed with cosign against an AWS KMS key; signatures verify against the publisher KMS public key.
Compliance-Aligned Evidence Generates evidence designed to support governance reviews under NIST AI RMF, EU AI Act risk classification (Annex III), and SOC 2 control families. Hash-chained decision records, post-quantum-signed block roots, and certifier-grade evidence bundles in auditor-ready format. Kevros provides verifiable technical evidence; it does not replace your compliance program, risk assessment obligations, or legal determinations.
Plans Free Trial. $0 per month. 1,000 calls. Hash-chained evidence. Starter. $499 per month. 100,000 calls. Production capacity. Professional. $1,499 per month. 1,000,000 calls. Adds ML drift plus dual-lane post-quantum signing. Enterprise. $4,999 per month. 5M inclusive calls plus AWS Marketplace metered overage. Adds fleet drift, CEF syslog export, evidence bundles.
Click Continue to Subscribe to deploy in your AWS account. Typical deployment under 20 minutes.
Highlights
- Six-layer formal verification: 1.94B states, 71 proofs, 0 sorry. Zero property violations.
- Dual-lane post-quantum signing: ML-DSA-87 (FIPS 204) and SLH-DSA-SHA2-256f (FIPS 205) on every record.
- Hash-chained evidence on Amazon EFS. Fail-closed architecture. Deploys in your AWS account.
Details
Sold by
Categories
Delivery method
Type
Supported services
Delivery option
A2A server on Amazon Bedrock AgentCore Runtime
Container image (ECS + EKS)
MCP server on Amazon Bedrock AgentCore Runtime
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Free Trial | Evaluation tier with 1,000 included governance calls per month, hash-chained evidence ledger, signed release tokens. | $0.00 |
Starter | Production tier with 100,000 included governance calls per month, 25 req/sec rate limit, multi-protocol agent access (REST, MCP). | $499.00 |
Professional | Production tier with 1,000,000 included governance calls per month, ML behavioral drift detection, dual-lane post-quantum signing (ML-DSA-87 + SLH-DSA-SHA2-256f), 50 req/sec rate limit. | $1,499.00 |
Enterprise | Production tier with 5,000,000 included governance calls per month, fleet-level drift monitoring, CEF-formatted syslog export, certifier-grade compliance evidence bundles, 200 req/sec rate limit. | $4,999.00 |
Vendor refund policy
TaskHawk Systems, LLC subscription fees are non-refundable, except as required by applicable law. AWS Marketplace subscriptions are also subject to AWS Marketplace refund policies. To request a refund or discuss billing concerns, contact support@taskhawktech.com . We will respond within 2 business days. For full terms, see https://taskhawktech.com/terms .
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
A2A server on Amazon Bedrock AgentCore Runtime
Supported services: Learn more
- Amazon Bedrock AgentCore
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
Feature release. Activates Protocol 427 budget-attestation verification, managed attestation signing, and operator self-serve onboarding across all delivery options. Adds a quarterly compliance report endpoint for Enterprise tier.
What changed:
-
Protocol 427 is now active by default. Agents that include a signed Budget-Attestation header receive cryptographic verification against the operator's registered ML-DSA-87 key. Agents without a Budget-Attestation header continue operating under existing tier rate limits with no configuration change required.
-
POST /v1/attestations/issue is now live. Operators can delegate attestation signing to the hosted Kevros service; private keys remain in HSM storage and are never accessible to application code.
-
Operators can now register and provision ML-DSA-87 keys programmatically via new self-serve API endpoints. Manual provisioning is no longer required.
-
Enterprise tier: GET /operators/{id}/compliance-report/{year}/{quarter} returns a signed quarterly governance summary for CISO review and third-party audit workflows.
-
ECS/EKS CloudFormation templates updated to the v4.6.2 digest-pinned image. Three new optional parameters support Redis-backed nonce deduplication for multi-replica deployments and HSM-backed managed signing. Existing v4.6.1 deployments are unaffected. All new parameters have safe defaults and apply only to new stack creates.
Compatibility: no breaking changes to the A2A API, MCP tool list, product code, entitlement model, tier limits, or billing dimensions. Existing v4.6.0 and v4.6.1 customers can move to v4.6.2 by updating the image reference and redeploying.
Additional details
Usage instructions
A2A server on Amazon Bedrock AgentCore Runtime DEPLOYMENT (Typical: 15 to 20 minutes)
Deploy via Amazon Bedrock AgentCore Runtime as an A2A server. The Kevros container exposes an A2A endpoint that other agents in your AgentCore environment call to receive governance verdicts before action execution.
Use image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/taskhawk-systems/kevros-a2a-gateway:4.6.2
Configure AgentCore Runtime to expose the A2A protocol endpoint. The container reads the AWS Marketplace contract dimension at startup and resolves your tier entitlement against marketplace-entitlement:GetEntitlements.
Verify deployment health: GET /health Expected response: HTTP 200 {"status":"healthy"}
Submit a governance request: POST /governance/verify Body: {"agent_id":"caller-id","action_type":"action-type","action_payload":{}} Expected response: signed ALLOW, CONSTRAIN, or DENY decision with release_token and verification_id.
Retrieve evidence: POST /governance/bundle Response includes provenance records and post-quantum anchor metadata for audit verification.
Protocol 427 (v4.6.2+): Agents that supply a signed Budget-Attestation header receive full 10-step cryptographic verification. Register your operator ML-DSA-87 key at POST /operators/register. Retrieve your BYOK integration kit at GET /operators/{id}/byok-kit.
Tier features:
- Free Trial: 1,000 governance calls per month, 5 req/sec
- Starter: 100,000 governance calls per month, 25 req/sec
- Professional: 1,000,000 governance calls per month, 50 req/sec, ML behavioral drift detection, dual-lane post-quantum signing
- Enterprise: 5,000,000 governance calls per month, 200 req/sec, fleet drift monitoring, CEF syslog export, certifier-grade evidence bundles, compliance report endpoint
Documentation: https://www.taskhawktech.com/developers Support: support@taskhawktech.com Security disclosures: security@taskhawktech.com
Resources
Vendor resources
Support
Vendor support
Support is provided directly by TaskHawk Systems, LLC.
Contact
Email: support@taskhawktech.com Web: https://www.taskhawktech.com/company Documentation: https://www.taskhawktech.com/developers
Response Times
Free Trial: best-effort, business hours (Monday through Friday, 9:00 AM to 5:00 PM US Eastern), 2 business day response. Starter: 1 business day response on technical issues. Professional: 8 business hours response on technical issues; 4 business hours on production-impacting issues. Enterprise: priority support; 4 business hours response on technical issues; 1 business hour on production-impacting issues.
Scope of Support
Deployment assistance for the AWS CloudFormation stack, configuration of governance policies, integration support for REST and MCP agent endpoints, troubleshooting of Kevros runtime behavior, and guidance on evidence ledger verification.
Customers are responsible for their own AWS account configuration, IAM permissions, network connectivity, and AWS service costs (Amazon ECS on AWS Fargate, Amazon EFS, Application Load Balancer, AWS Secrets Manager, Amazon CloudWatch). AWS service issues are routed to AWS Support per your AWS Support plan.
Security incident reporting: security@taskhawktech.com or follow the disclosure process at
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.