GOVERNANCE INFRASTRUCTURE FOR AGENTIC DEVELOPMENT

Control every agent.
Prove every action.

Built for teams working in audited or regulated codebases.

Policy that can only tighten, human approval before anything runs, and a hash-chained record of what happened — while the work stays on your own machine.

Download zilix → See how it works

v0.3.1 · macOS, Windows, Linux · solo use needs no account. Governing a team?

Runs on your machine · every action checked before it runs
Built by and for developers from
and more
ONE CONTROL LAYER · BUILT FOR AUDITED SOFTWARE TEAMS

One control layer across every agent action.

Zilix sits between your coding agents and your machine. An administrator publishes rules; every machine pulls and verifies its own copy; every tool call is checked before it runs; and what happened is written to a record that cannot be quietly edited.

01 — PUBLISH

A rule can take permission away. Never grant it.

An administrator writes rules and zilix signs them into a versioned bundle. A rule has exactly two possible actions — deny, or require a human to approve. There is no “allow”, so org policy can only ever make a developer’s agents stricter.

POLICY TIER · PLATFORMSigned
Deny
file · src/billing/**
Deny
command · ^git\s+push\s+--force
Require approval
tool · Bash
Require approval
budget · $5.00 / session
Change a rule and the signature no longer matches — a tampered bundle cannot silently apply.
WORKS ACROSS THE AGENTS YOUR TEAM ALREADY USES Claude Code · Codex · Gemini · Local models Your coding agents do the work. Zilix controls how the work happens.

COORDINATION · SEVERAL SESSIONS, ONE REPOSITORY

Turn the agents you trust into one shared brain.

Zilix runs an MCP server that every session in a repository can reach — so agents working side by side can see each other, check before they overlap, and say something when their approach changes. It works the same whether those sessions are Claude Code, Codex, or a model on your own machine.

How sessions stay out of each other’s way
1 shared stream per repoevery session in it can see the others
4 tools each session can callstatus, pivot, roster, direct message
0 locksclaims are advisory — disjoint work never waits
What a session can do about its peers
Tool What the agent uses it for
list_workspace_sessions Called early — find out who else is live in this repository
peer_status Called before work that could overlap someone else’s
coord_pivot Broadcast when its approach changes in a way peers need to know
message_session Send one peer an actionable directive — not status chatter
The guard

Every edit an agent makes records a claim on that file path. When a different session tries to edit a path a peer just touched, that one call is escalated to you with the conflict named — and the other session is told. It is deliberately advisory and time-bounded, not a lock: sessions working on separate files never interact with it at all. The point isn’t to prevent every overlap. It’s that an overlap becomes a decision you make instead of an overwrite you find later.

RUNTIMES · WHAT WE CAN ACTUALLY GATE

Pair with the brain you trust.

zilix wires into the coding CLI you already use, a provider API, or a model on your own machine — and tells you plainly how much of each one it can hold back.
4
Coding CLIs detected
Claude Code, Codex, Kimi, Gemini
5
Direct provider paths
Anthropic, OpenAI-compatible & more
0
Provider keys sent to us
They stay in the local daemon
Claude Code
Structured events · resume · models · planning · MCP
full gate
Codex CLI
Structured events · resume · models & reasoning · MCP
full gate
Kimi Code
Structured events · resume · models · thinking
supported
Gemini CLI
Text stream — runs, but has no structured approval gate
no gate
Cursor & custom
Detected and configurable — session creation stays gated until the adapter is validated
gated
Direct API
Anthropic · any OpenAI-compatible endpoint · OpenAI Responses
supported
Local model
Ollama, on your own machine
supported

Where a runtime can’t be gated, we say so rather than dressing it up — a report-only rail is never labelled as enforced. And “keys stay local” means exactly that and no more: your provider credentials never leave the daemon, but the model provider you pick still receives your prompts and context, and an enrolled organization still receives metadata and audit records. The full data paths are here.

TWO POSTURES · ONE LOCAL WORKBENCH

Governed by design.

Zilix is the same application either way. On your own it is a local tool with no account. Inside an organization it gains a signed ceiling it cannot talk its way out of — and in neither case does your code move to somebody else’s machine. Hosted workspaces are not what this is.

Solo
No account, no organization, nothing to sign up for. Repositories, agent processes, credentials, local rules and the audit log stay on your machine. Your own rules and approvals still apply.
Managed
Join an organization from Settings and it adds a signed policy ceiling, approved container environments, per-device trust, and centralized audit and spend reporting. Enrollment discloses all of it before anything changes.
Every failure lands on the safe side
A bad signature, a stale roster, a revoked device or an unreachable server does not quietly return a managed machine to having no rules. Leaving is a deliberate act — and it leaves your repositories, rules and audit log intact.

Running this across a team? Managed organizations are set up with us directly, self-hosted or hosted. Tell us about your setup — or read exactly what is and isn’t true today first.

FAQ · STRAIGHT ANSWERS

What is zilix?

zilix runs governed AI coding on your own machine. A desktop workbench hosts local agent sessions, a local daemon controls execution and policy, and every consequential action stays visible to a human. Solo use is local and account-free. Managed teams add a signed organization policy ceiling, device trust, and centralized audit and spend reporting — without moving execution into a hosted workspace.

01What is zilix?+
zilix runs governed AI coding on your own machine. It hosts your agent sessions locally, checks every tool call they make against policy before the call runs, holds the ones that need a person, and writes what happened to a hash-chained record. Solo use is local and account-free; managed teams add a signed organization ceiling on top.
02How is zilix different from Cursor, Claude Code, or Windsurf?+
Those are coding agents. zilix is the layer that governs them — it evaluates each tool call against policy before it runs, holds the ones that need a human, and records the outcome. You keep using the agent you already use.
03Do I need an account?+
No. Solo use is local and account-free — install the desktop app, open a repository, start an agent. An organization account only matters if your employer enrols the machine, and enrolment discloses the policy, environment and collection posture before it changes anything.
04What can an organization policy actually do to my agents?+
A rule can deny an action, or require human approval for it. Those are the only two actions that exist — there is no “allow”. Organization policy can therefore take permissions away from a developer’s agents and can never hand new ones out. Rules match on a tool name, a file path glob, a command pattern, or a per-session spend ceiling.
05What can my employer see if my machine is enrolled?+
Identity and device metadata, the policy state they published, organization requests, and the audit and spend records created after enrolment. Raw prompts and responses are not audit records, and repository contents don’t travel through the organization endpoint — browser-to-daemon traffic stays end-to-end encrypted through it.
06Which coding agents and models does zilix work with?+
Claude Code and Codex CLI have the fullest support, including structured events, resume, model selection and pre-execution approval. Kimi Code is supported. Gemini CLI runs but has no structured approval gate. Cursor and custom CLIs are detected and configurable, but session creation stays gated until their adapters are validated. You can also point zilix straight at Anthropic, any OpenAI-compatible endpoint, OpenAI Responses, or a local Ollama model.
07Do my API keys pass through zilix servers?+
No — provider credentials stay in the local daemon’s config directory and are never returned over the wire. That’s a narrower claim than “nothing leaves your machine”, deliberately: the model provider you choose receives your prompts, context and tool results, and an enrolled organization receives metadata and post-enrolment audit and spend records. We’d rather name the paths than blur them.
08What platforms does zilix run on?+
macOS on Apple Silicon, Windows on x64, and Linux on x64 as an AppImage. There are no native iOS or Android apps — remote access is an installable web app served by your organization endpoint, which is why it needs a managed organization rather than a personal setup.
09How do parallel sessions avoid overwriting each other?+
Every session in a repository shares a coordination stream and can see its peers. Each allowed edit records an advisory claim on that file path; when a different session tries to edit a path a peer just touched, that one call is escalated to you with the conflict named. It’s advisory and time-bounded rather than a lock — sessions on separate files never interact with it. The point is that a collision becomes a decision instead of a silent overwrite.
10Is the audit log tamper-proof?+
Tamper-evident, not tamper-proof, and the difference matters. Each record is hash-chained to the one before it, so an inserted, edited, deleted or reordered record breaks the chain and shows up on verification. But the checkpoint signing key sits on the same machine as the log it signs, so local verification alone can’t defeat an attacker who already holds the daemon’s privileges. Shipping records off-box is the stronger copy. Full detail here.
11Is zilix HIPAA, SOC 2, or FDA compliant?+
No, and we won’t claim otherwise. What ships is signed policy, approval gates and a hash-chained audit log — real mechanisms for auditable development, not a certification. There’s no SOC 2, HIPAA, FedRAMP, ISO 27001 or FDA claim today, and no PHI-specific data handling. See zilix.app/security for the honest breakdown of what’s real and what isn’t yet.
12How do I contact the zilix team?+
Email zilixide@gmail.com or use the support page at zilix.app/support for help, bug reports, and questions about running zilix across a team. zilix is also on X (@zilix_app) and LinkedIn (zilix-app) for product updates.