Download AIControls · Self-hosted

Run AIControls in your own cluster.

Govern coding agents and Kubernetes agents from infrastructure you control.

Kubernetes ≥ 1.27
Helm ≥ 3.12

install.sh

$ helm install aicontrols \
    oci://ghcr.io/nirmata/charts/aicontrols \
    -n aicontrols --create-namespace \
    -f values.yaml
NAME: aicontrols
STATUS: deployed

$ kubectl logs -n aicontrols deploy/aicontrols
started proxy

Why teams self-host AIControls

Control cost, keep teams fast, stop risky calls.

Cost

Set budgets that actually hold.

Spend limits per org, team or developer
Enforced at request time
Cut token waste with context optimization

Productivity

One endpoint, every tool.

No agents or SDKs to install
Shared MCP servers for everyone
Any provider: Anthropic, OpenAI, Bedrock, Vertex, Ollama

Security

Stop risky calls before they run.

Detect PII, secrets and prompt injection
Policy on every model and tool call
Every call recorded for audit

Install

Up and running in five steps.

Step 0

What do you want to govern?

Pick one and the steps below adapt. One install can govern both.

1
Create a values file
Deployment settings only. You'll connect LLM providers and policies in the Admin UI.
values.yaml
```
admin:
  email: "you@company.com"   # required
storage:
  persistentVolume:
    enabled: true
    size: 10Gi
ui:
  publicURL: "https://aicontrols.example.com"
```

Install with Helm

terminal

helm install aicontrols \
  oci://ghcr.io/nirmata/charts/aicontrols \
  -n aicontrols --create-namespace \
  -f values.yaml

get the bootstrap admin password

kubectl get secret aicontrols-admin-bootstrap -n aicontrols \
  -o jsonpath='{.data.password}' | base64 -d

3
Open the Admin UI and run setup
Log in as admin. The wizard connects an LLM provider, adds MCP servers and creates your first policy.
for testing · use Gateway API or Ingress in production
```
kubectl port-forward -n aicontrols svc/aicontrols 8080:8080 8081:8081
# Admin UI: http://localhost:8081/ui/
```
4
Activate your license
AIControls needs a signed license before it processes AI traffic. Licenses are tied to one cluster, identified by the UID of its kube-system namespace.
cluster ID · kube-system namespace UID
```
kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'
```
Work email
Company
Cluster ID (kube-system namespace UID)Your license is tied to this cluster. The kube-system namespace UID is a stable, unique ID for it. Run the command above to get it.
Governing
Main goal
Sends your request to support@nirmata.com. We'll email your license key; add it in the Admin UI.
5
Connect your coding agents Desktop
Each developer creates an access token in AIControls, then points their tool at your endpoint.
~/.claude/settings.json
{ "env": { "ANTHROPIC_BASE_URL": "https://aicontrols.example.com", "ANTHROPIC_AUTH_TOKEN": "YOUR_ACCESS_TOKEN" } }
Cursor · Settings → Models
# Override OpenAI Base URL https://aicontrols.example.com/proxy/v1 # API key YOUR_ACCESS_TOKEN
shell
export OPENAI_BASE_URL=https://aicontrols.example.com/proxy/v1 export OPENAI_API_KEY=YOUR_ACCESS_TOKEN
VS Code · install the AIControls extension
code --install-extension nirmata.aicontrols
1. Click AIControls in the VS Code status bar.
2. Set the Server URL to your AIControls hostname, e.g. https://aicontrols.example.com.
3. Choose Connect with GitHub account, or paste your AIControls access token.
4. Send a Copilot Chat message. It shows up in Security Events under your GitHub identity.
Covers inline completions, Copilot Chat and Copilot edits in VS Code.
Tool calls are covered too. MCP traffic goes through the same endpoint, with no extra setup.
Connect your agent pods Kubernetes
Point agents at the in-cluster service. Or label them and let Kyverno inject the settings.
agent Deployment · env
```
env:
  - name: MCP_SERVER_URL
    value: "http://aicontrols.aicontrols.svc.cluster.local:8080"
  - name: OPENAI_BASE_URL
    value: "http://aicontrols.aicontrols.svc.cluster.local:8080/v1"
```
or: label the pod for Kyverno injection
```
metadata:
  labels:
    nirmata.io/ai-agent: "true"
```
Add identity. Mount a projected ServiceAccount token with audience aicontrols so each agent is verified. Agent identity guide