Built incrementally, in the open.
AssuranceOps is pre-1.0. The gateway is source-available under Apache-2.0, so every claim on this site can be checked against the code that ships.
Nothing has been released yet: the version is 0.1.0 and the endpoint release ledger is still reserved. What follows is what is delivered versus what is still gated.
Substantial functional MVP
Provider and MCP proxying, streaming, policy, identity, budgets, scanning, transcripts, and tamper-evident audit evidence are implemented and under active pre-1.0 validation.
Governance operations
Posture scoring, alerts, response automation, threat intelligence, executive reports, multi-tenancy, and guardrail observability are implemented.
Prompt governance
Versioned templates, quality metrics, LLM-as-judge review, content-hash-bound approvals, and approval-gated rendering are implemented.
Hosted administration
OIDC authorization-code sign-in with PKCE, tenant-scoped RBAC, and short-lived Postgres-backed browser sessions are implemented.
Deployment baseline
Docker Compose, Kubernetes and Helm, shared Postgres counters, health/readiness probes, concurrent migration safety, and a Coolify staging profile are available.
Execution & portability hardening
The skill-execution control plane is delivered as a fail-closed authority boundary, and the endpoint executor binds grant-derived capability profiles with enforced resource ceilings. Kernel-level sandbox enforcement, native capability evaluation, complete adapter parity, provider certification, and end-user applications remain.
Release hardening and broader platform expansion remain active work. Signed installer packages, published container digests, a production-sized migration rehearsal, and third-party attestation are explicitly still open.
Shape what comes next.
Tell us which gates matter for your environment, or run the open-source demo today.
By joining, you agree to our Privacy Policy and Terms.