Obelyr

Obelyr / Platform

The platform

Six controls. Every AI-built tool inside them.

Approval, audit, recall, rollback, registry, policy. They ship together. They run on your infrastructure. No SaaS dependency. No outbound proxy hop.

Architecture at a glance

From prompt to governed app.

Applications signed once, run anywhere your policy allows.

Obelyr runtime Policy · Registry · Audit · RBAC on your infrastructure signed policy · application downloads · audit upload Endpoint · Linux Signed agent policy v17 · 3 apps Endpoint · Windows Signed agent policy v17 · 2 apps Endpoint · Linux Signed agent policy v17 · 4 apps obelyr · control plane → fleet
What's in the box

Six capabilities. One install.

No add-ons. No upsell. Every tier ships with all of it.

Signed policy distribution

Policy you control reaches every machine. Verified on arrival. No bypass.

Approved application catalog

A native launcher on Linux and Windows shows only the AI-built apps your team has approved. One click. Signed download.

Tool registry

Define which tools each application can call. Enforced at runtime, not via prompts. Per app, per role, per tool.

Append-only audit log

Exportable. In a shape your tools already read. Nothing rewrites or deletes a row.

Your providers, your machines

Your AI provider accounts connect from your own machines. Our infrastructure has no path to them.

Versioned rollback

Every application version is snapshotted before it changes. Rollback is one command. Broken self-updates auto-recover.

Obelyr runs where your tools run.

Specifics.

Endpoint agents
Linux (x86_64, arm64) · Windows 10+, 11.
Control plane
Single FastAPI process. SQLite or Postgres backend.
Identity
Local accounts today. SSO on the roadmap. Local accounts work for air-gapped operation.
Network
Outbound only from endpoints to control plane. Fully air-gapped operation supported.
Storage
All applications, policies, and logs stored on your infrastructure. Nothing leaves.
Updates
Signed releases with checksums. Offline update bundles available.
Deployment
Single-binary install on Linux or Windows. systemd unit and Windows service supplied.
Backup
One state directory plus the config file. Restorable with standard OS tooling.

See it run. Against your kind of workflow.

One call against a workflow shape that matches yours. Spreadsheet to dashboard. CRM export to follow-up bot. Support queue to triage app.

Book a demo → or send a workflow first
Self-hosted from day one. Your data. Your machines.
Book a demo →