Sold by: Codenotary Inc
Deployed on AWS
One governed view of every AI coding agent across your organization. See usage and cost by team, find unsanctioned AI tools, enforce policy on what agents may do, and keep a full audit trail, self-hosted in your own AWS account.
Overview
Keep every team's choice of AI tools. Gain one governed view of the whole organization. Developers use Claude Code, Codex, Cursor, Copilot, Claude Cowork and more, often several at once. AgentMon Enterprise brings them into one view across teams, departments and hosts: who uses which tools, what each session cost, and which AI tools are in use without approval. Access follows your organization: single sign-on with your identity provider, roles and audit scope (self, team, department, organization) taken from your Entra groups, and per-user ingest tokens. The reason to choose us: oversight across your whole AI tool mix and org chart, beyond the view any single vendor gives you.
Know what AI costs, and where it goes. AgentMon tracks spend per developer, team, agent and model in real time, shows burn rate and a forecast, and flags cost spikes, runaway sessions and agents stuck in loops. Chargeback reports split the bill by team, and recommendations point to the sessions and models worth changing. The reason to choose us: cost, usage and quality in one place, down to the single session that drove the bill.
See what AI agents do with your code, files, credentials and commands. Agents read files, change software, run shell commands and call tools with real credentials. AgentMon records every run and tool call in a searchable, append-only audit trail with full execution traces, classifies risky commands by severity, flags access to sensitive files, scrubs secrets before anything is stored, and detects prompt-injection attempts in 11 languages. Alerts go to Slack, PagerDuty, email, webhooks or your SIEM. The reason to choose us: cost visibility, security monitoring and investigation together, with the context to act when something looks wrong.
Turn policy into control, without building an AI security department. Governance rules check how teams configure their agents (including CLAUDE.md and AGENTS.md) and score policy coverage across the fleet. Any detection can become an enforcement rule that warns, requires approval or blocks the action, and suspicious agents can be quarantined. AgentMon is run by your existing platform, IT and security teams. The reason to choose us: practical, enforceable AI governance that fits the teams you already have.
Your data stays in your AWS account. This AMI deploys AgentMon as a self-contained appliance in your own AWS account. Prompts, traces and evidence stay inside your environment and under your retention controls, and a privacy mode can store metadata only. Your licence is part of your AWS Marketplace subscription: billed through AWS and installed automatically, with no licence keys to handle. To license itself the instance contacts AWS License Manager and the Codenotary licensing service at apps.codenotary.com; no agent telemetry leaves your account.
Highlights
- One governed view of Claude Code, Codex, Cursor, Copilot and more, across every team
- Cost, usage, audit trail and policy enforcement (warn, approve, block) in one place
- Self-hosted in your AWS account; licence billed and installed through AWS Marketplace
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04 LTS
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Seat | One seat per developer whose AI agents sent data to AgentMon in the last 30 days. Dashboard logins and admin accounts do not use seats. | $15.00 |
Vendor refund policy
Contract charges are billed by AWS Marketplace. Refund requests within 30 days of purchase or renewal are reviewed case by case; contact support+marketplace@codenotary.com with your AWS account ID and agreement ID. Monthly contracts can be cancelled before renewal and are not refunded pro rata. AWS infrastructure charges (EC2, EBS) follow AWS's standard refund policy.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Fixes in this version
- If AWS License Manager has never been set up in your account, the licence sync now says so and names the one-time setup step, instead of blaming the instance role.
- The instance now checks its licence back in to AWS License Manager after each sync. Before, a failed sync held the entitlement for about an hour and every retry in that hour failed.
- Usage instructions now list the License Manager setup and the CheckInLicense permission.
Licensing through AWS Marketplace
- The instance licenses itself from your AWS Marketplace subscription. No licence key to paste.
- A licence sync runs at first boot and every 6 hours. It checks out the entitlement through AWS License Manager using the instance role, then installs a short-lived licence that renews automatically.
- Settings > Licensing shows "Managed by AWS Marketplace", the last sync result, and a plain-language reason if a sync fails (missing IAM role, no entitlement, no network access).
- The instance role needs license-manager:CheckoutLicense and license-manager:CheckInLicense. IMDSv2 is required (hop limit 1).
- Outbound HTTPS to AWS License Manager and apps.codenotary.com is required for licensing. No agent telemetry leaves your account.
One view across your AI tools
- Claude Code, Codex, Cursor (including cursor-agent and the Cursor Admin API spend collector), Grok Build, Claude Cowork and OTLP-instrumented agents in one dashboard.
- Consistent agent counts, costs, scores and command severity on every page.
- Shadow AI discovery shows tools in use without approval.
Cost and usage
- Per-developer, team, agent and model spend, burn rate and a 7-day forecast.
- Model prices from a maintained catalog, refreshed on demand.
- One cost-per-hour and span count per session; loop detection shared by Insights, Recommendations and alerts.
- Decision analytics: plan approvals, rejections and interrupts.
Security and governance
- Risky shell commands classified by severity, including reads of credential files.
- Prompt-injection detection in 11 languages; a hidden-character concealment scanner.
- Agent memory observability: CLAUDE.md and AGENTS.md coverage, staleness and lineage, plus a memory-poisoning scanner.
- Governance rules and policy coverage score; warn, approve or block enforcement; agent quarantine.
- Failure clustering with per-trace verdicts.
- Read-only MCP server (amon-mcp) for querying AgentMon from your AI tools.
Operations
- m6i instance types supported next to m5 (x86_64). m5.xlarge recommended.
- Diagnostics bundle (amon diag) includes runtime config and query cost.
Additional details
Usage instructions
-
LAUNCH - Start the AMI on an m5.xlarge instance (recommended) with the recommended security group (HTTPS 443). No internet pulls are needed for the software at first boot. Three requirements: (a) A dedicated second EBS data volume (100 GB gp3 or larger) is REQUIRED and must be attached as /dev/xvdb; first boot aborts without it. The Marketplace 1-click launch attaches it. If you launch from the EC2 console, add a second EBS volume in the Storage step (or attach one and reboot) before first boot completes. (b) An IAM instance profile whose role allows the AWS Marketplace licence checkout. Minimal inline policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow", "Action":["license-manager:CheckoutLicense", "license-manager:CheckInLicense"],"Resource":"*"}]} Also attach the managed policy AmazonSSMManagedInstanceCore for Session Manager. REQUIRED with that role: IMDSv2 only, hop limit 1, so containers on the instance cannot use the role's credentials. In the EC2 console set Advanced details -> Metadata version: V2 only and Metadata response hop limit: 1, or run: aws ec2 modify-instance-metadata-options --instance-id <id> --http-tokens required --http-put-response-hop-limit 1 (c) Outbound HTTPS (443) to AWS License Manager in the instance's Region (license-manager.<region>.amazonaws.com) and to apps.codenotary.com. (d) AWS License Manager set up in your account. If you have never used it, complete the first-run setup in the License Manager console in this Region (it asks you to grant permissions), or run: aws iam create-service-linked-role --aws-service-name license-manager.amazonaws.com Without (b), (c) and (d) the appliance starts unlicensed and read-only.
-
FIRST BOOT - Allow about 5 minutes. The appliance prepares its data volume, starts single-node Kubernetes (k3s), installs its licence and deploys AgentMon from container images baked into the AMI.
-
GET CREDENTIALS - Connect via AWS Systems Manager Session Manager (aws ssm start-session --target <instance-id>) or SSH as user "agentmon". Run: sudo tail -40 /var/log/agentmon-firstboot.log for the dashboard URL. The one-time bootstrap admin password is in /var/log/agentmon-firstboot-secret.log, and can be recovered any time with: sudo kubectl -n agentmon get secret agentmon-ami-secrets -o jsonpath='{.data.bootstrap-admin-password}' | base64 -d
-
SIGN IN - Open https://<public-ip-or-fqdn>/ and sign in as admin@local with the one-time password. Change it immediately under Profile -> My Account -> Password. The admin@local account remains your break-glass login.
-
LICENCE - Nothing to install. The appliance checks out your AWS Marketplace licence on first boot and renews it every 6 hours. Settings -> Licensing shows "Managed by AWS Marketplace", your limits and the last sync. If a sync fails, it names the cause: no instance role, no licence for this account, or no outbound access. Over SSM: sudo cat /var/lib/agentmon/entitlement-status.json
-
CONNECT AGENTS - All agent traffic uses HTTPS on port 443: install the amon CLI and run "amon watch", or point any OTLP-instrumented agent at https://<your-appliance-fqdn>/ - OTLP is routed internally, no extra ports to open. Create ingestion tokens in the dashboard.
SUPPORT - support+marketplace@codenotary.com . Attach a diagnostics bundle (amon diag) to support requests.
Resources
Vendor resources
Support
Vendor support
AgentMon Enterprise is supported by Codenotary. Every AWS Marketplace subscription includes 24/7 support for production incidents with direct engineering access, and business-hours help (EST) for installation, configuration and operational questions. Contact support+marketplace@codenotary.com . A step-by-step deployment guide ships with the product, and the appliance includes a diagnostics bundle (amon diag) you can attach to any support request. Subscription and pricing questions: sales@codenotary.com or
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Runtime security and oversight for AI agents. See every agent, attribute every action, flag hostile inputs, and scrub leaked secrets before they're stored.
VAREK checks every action an AI agent attempts against your policy before it runs. Only SATISFIED actions execute; everything else is refused at the Linux kernel boundary.
Arcade.dev is the industry's first MCP runtime enabling AI to take secure, real-world actions. As the MCP runtime, Arcade is uniquely able to deliver secure agent authorization, high-accuracy tools, and centralized governance for multi-user AI agents at scale.
Graph powered AI scanning that reads your whole repo, not just the diff. SAST, SCA, secrets, IaC, container, and exploit validation in one agentic engine so it catches the crossfile, crossrepo vulnerability chains context less scanners miss. FAST rules only to DEEP multipass AI, your choice per scan. Bring your own LLM key or run on Phoenix credits.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.