Sold by: Marquor
Deployed on AWS
Marquor is a payload-free runtime security and governance platform that controls what autonomous AI agents are authorized to do across cloud, SaaS, APIs, and enterprise tools. It discovers agents, continuously evaluates trust and delegated authority, enforces actions at runtime, adjudicates high-risk decisions, and generates cryptographically verifiable evidence.
Overview
Marquor is a cloud-neutral, API-first runtime security and trust platform for autonomous AI agents. It provides organizations with an independent control layer for discovering agents, governing delegated authority, enforcing runtime policy, and determining whether an agent should be permitted to perform a specific action. Marquor operates at the agent-to-tool and API boundary without requiring inspection or storage of sensitive customer payloads.
Marquor continuously builds an Open Agent Dossier (OAD) containing operational trust context such as agent identity, capabilities, connected tools, delegated authority, runtime posture, and decision history. Its Govern engine applies deterministic authorization and policy controls, while Automated Risk Adjudication (ARA) evaluates ambiguous or high-risk actions and can allow, deny, escalate, or require additional approval. Runtime posture changes can immediately affect an agent's authority.
Every governed decision can generate tamper-evident, cryptographically signed evidence through Marquor Assure, helping security, risk, and compliance teams establish accountability for autonomous actions. Designed for multi-cloud and enterprise environments, Marquor complements existing IAM, API gateways, SIEM, DLP, and cloud security controls rather than requiring organizations to replace them. Organizations can use Marquor to establish consistent agent governance across AWS, other cloud environments, SaaS applications, MCP infrastructure, enterprise APIs, and AI frameworks.
Highlights
- Payload-Free AI Agent Security - Discover and govern autonomous AI agents at the tool-call boundary without inspecting or storing sensitive customer payloads, helping reduce data exposure, privacy, and compliance concerns.
- Runtime Authorization & Enforcement - Continuously evaluate agent identity, posture, delegated authority, tool access, and policy to allow, deny, escalate, or instantly revoke risky AI agent actions.
- Automated Risk Adjudication & Verifiable Evidence - Marquor ARA evaluates ambiguous or high-risk actions in real time and generates tamper-evident, cryptographically signed decision receipts for audit, compliance, security, and dispute workflows.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
Kubernetes (Amazon EKS) - Helm
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
This product is available free of charge. Free subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Vendor refund policy
Marquor charges no fees for this product, so no refunds arise. It provides a 15-day monitor-mode evaluation from first deployment: enforcement stays disabled and the entitlement expires at the end of that period. Extensions and paid editions are available on request. AWS infrastructure charges for running the gateway in your own AWS account are billed by AWS and are outside Marquor's control. Contact support@marquor.io for evaluation support or to request an extension.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Kubernetes (Amazon EKS) - Helm
Supported services: Learn more
- Amazon EKS
- Amazon EKS Anywhere
Helm chart
Helm charts are Kubernetes YAML manifests combined into a single package that can be installed on Kubernetes clusters. The containerized application is deployed on a cluster by running a single Helm install command to install the seller-provided Helm chart.
Version release notes
Marquor Runtime Security - Trial 1.1.0 - initial release.
Runtime least-privilege enforcement and tamper-evident receipts for AI-agent tool calls. The gateway sits in front of your MCP server and governs what each agent is actually allowed to do, with no changes to agent code.
What it does
- Verifies agent identity from a cryptographically signed token subject, never a spoofable header. The gateway holds public keys only: it verifies, it never issues.
- Enforces per-agent least privilege. Each agent gets an explicit allow-list of permitted tools, enforced under a global default-deny floor. A verified but uncertified caller gets deny-all.
- Records tamper-evident receipts. Every decision is appended to a hash-chained ledger signed with Ed25519, so any retroactive edit or deletion is detectable.
- Intercepts only what it must. POST /mcp inspects tools/call; all other MCP traffic is forwarded transparently.
Fail-closed by design. Every configuration loader refuses to boot on invalid input rather than starting in a permissive state. Deployment is a single pod with a persistent ledger volume; the Helm chart refuses to install a configuration that would run two writers or a non-persistent ledger, because either would break evidence continuity silently rather than loudly.
Runs where you run. Multi-architecture image supporting x86-64 and AWS Graviton (arm64) on Amazon EKS, EKS Anywhere, and self-managed Kubernetes. Runs as a non-root user on a minimal base image with zero known CVEs at publication.
Rollout path. Start in monitor mode to observe agent behaviour and review receipts without blocking anything, then switch to enforce once the allow-lists reflect real usage.
Additional details
Usage instructions
-
Prerequisites. A Kubernetes cluster (EKS 1.25+ recommended), an OIDC issuer your agents authenticate against, and a StorageClass supporting ReadWriteOnce.
-
Provide four OAD documents. identity.yaml (issuer/audience/JWKS; PUBLIC keys only), policy.yaml (the global default-deny floor), and per agent a dossier manifest plus a clearance allow-list. Every loader is fail-closed: the gateway refuses to boot on anything invalid, and a verified-but-uncertified caller gets deny-all.
-
Install. Set upstreamUrl to your MCP server and supply the OAD documents. The chart mounts them read-only from ConfigMaps and the admin token from a Secret. The chart ships with inert placeholder defaults so it renders out of the box: an unconfigured install denies everything and reaches nothing. Replace upstreamUrl and the identity document before expecting it to serve traffic.
-
Two constraints the chart enforces by refusing to install:
- Exactly one replica. The gateway is single-writer: one Ed25519 signing key, one hash-chained traces.jsonl, one ReadWriteOnce volume. Two replicas fork the chain into branches signed by different keys, destroying tamper-evidence silently. The Deployment strategy is Recreate, never RollingUpdate.
- Persistent storage is required. /data holds the signing key and the ledger. Losing it restarts the chain under a new key.
-
Verify. GET /healthz returns {"status":"ok"}. Point your agents at the gateway's /mcp endpoint - no agent code changes are required. Start in monitor mode, review the receipts, then switch to enforce.
Support
Vendor support
Marquor provides technical support for product onboarding, deployment, configuration, integrations, policy setup, runtime enforcement, and troubleshooting. Customers can also receive guidance for integrating Marquor with AI agents, agent gateways, MCP-based environments, cloud services, and enterprise tools. Support requests can be submitted by email at admin@marquor.io Standard support is provided during U.S. business hours. Enterprise support, architecture assistance, onboarding, and enhanced response options are available based on the customer's subscription and support agreement.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.