The governed autonomous agent
Autonomy you can sign off on.
An autonomous AI agent that plans, remembers, and works around the clock — but outward actions wait for your sign-off, your secrets are never shown to the model, and your data is stored in Switzerland.
Stored in Switzerland. Processed in the EU. Any model — including Swiss-hosted open source.
- Mutation-capable actions held for your approval
- Write-only vault — the model never sees a secret
- Stored in Switzerland. Processed in the EU.
- Every proposal, decision and dispatch logged
mcp: crm.update_contact
{
"contact_id": "cnt_8412",
"properties": { "stage": "customer" },
"api_key": "{{secret:HUBSPOT_KEY}}"
}Secret substituted only at dispatch — the model never sees the value.
Every proposal, decision and dispatch is written to the signed audit chain.
Powered by the models you choose — routed under one governance layer
- Qwen
- Mistral
- Infomaniak
- Anthropic
- OpenAI
- Gemini
- GLM
- DeepSeek
- Llama
Swiss track: Qwen3.5-397B · Mistral 24B · Nemotron — hosted by Infomaniak in Switzerland.
The problem
Autonomy arrived before control did.
In 2026, open agent frameworks put shell access and marketplace skills behind no approval gate — the OpenClaw incident class showed how that ends. The EU AI Act’s Article 14, enforceable since August 2026, requires human oversight as an external control. Monopea is the middle path: full autonomy, governed as architecture.
Built for founders, fiduciaries, and small practices that want an agent working for them — without operating an exposed box or settling for a chat window.
| Unguarded open agents | Single-vendor chat | monopea | |
|---|---|---|---|
| Plans and works autonomously toward goals | |||
| Outward actions gated by default | Partial | ||
| Unknown tools fail closed to review | Curated tools | ||
| Secrets kept out of the model’s context | Partial | ||
| Signed, tenant-owned audit trail | |||
| Your choice of model | |||
| Data residency you can point to | Your server | Vendor cloud | Zurich, CH |
| What you manage | Patching & exposure | Prompts | Approvals |
How it works
Propose. Approve. Dispatch & log.
monopea runs autonomously between the gates — but every outward action passes through the same three-step control, by architecture.
- Step 1
Propose
The agent plans the work and drafts the exact tool call — name, arguments, target. Mutation-capable calls are never dispatched inline: they become pending proposals and the run blocks until you decide.
- Step 2
Approve
You see the call and its args, then approve or reject. Unknown tools fail closed to review — default-deny. When you do trust a play, per-tool and per-agent policies are explicitly and auditably grantable.
- Step 3
Dispatch & log
Only after approval is the call executed — secrets substituted at dispatch, never shown to the model. Every proposal, approval, rejection and dispatch lands in an audit chain with Ed25519-signed checkpoints.
Why Monopea
Safety as architecture, not a system prompt.
Three controls no instruction can talk the agent out of — each one an external mechanism, not a promise.
Governance that travels with the model
Switch models without switching safety. The approval gate, the policies, and the audit trail are Monopea’s — not the model vendor’s.
How · One default-deny policy engine and a tenant-owned audit ledger across Claude, GPT, Gemini, Mistral, GLM, DeepSeek, Qwen and Llama.
Residency-aware, end to end
Stored in Switzerland. Processed in the EU. On the Swiss track, inference runs on Infomaniak-hosted open-weight models in Switzerland.
How · Chat, summaries and embeddings all re-resolve the same region — no side channel that quietly routes part of a request elsewhere.
A vault the model can never read
Give the agent your keys without ever showing it your keys. Rotate or revoke a secret and every workflow keeps working.
How · Write-only PUT: the API returns name and last-4 only. {{secret:NAME}} is substituted at dispatch and scrubbed from tool results. Envelope-encrypted per tenant.
For developers
A governance harness with an API.
Everything the dashboard does, the API does: send work, stream the reasoning, list pending proposals, decide them, and manage secrets the model can never read.
- REST /v1 — chat, conversations, memory, knowledge, goals
- WebSocket chain-of-thought — wss://…/v1/ws — watch the agent reason live
- Proposals API — GET /v1/proposals · POST /v1/proposals/:id/decide
- Write-only secrets — PUT /v1/secrets/:name — never readable back
curl https://monopea-runtime.fly.dev/v1/chat \
-H "Authorization: Bearer brain_live_..." \
-d '{"message":"Reconcile this week\'s invoices and propose the transfers"}'MCP
Both sides of MCP.
MCP (Model Context Protocol) is the open standard that lets AI agents connect to tools. monopea speaks it in both directions.
MCP client
Bring any MCP-compatible tool — CRM, inbox, calendar, your own server. Every tool onboards default-deny: mutation-capable calls become proposals, and unknown tools fail closed to review.
MCP server
@monopea/mcp-server exposes the brain to Claude Desktop, Cursor, or any MCP host:
ask_brain · search_knowledge · traverse_knowledge · remember · list_memory · list_personas …
- Default-deny tool policy
- Write-only vault, envelope-encrypted
- Postgres RLS tenant isolation
- Ed25519-signed audit checkpoints
- Stored in Zurich
Pricing
Priced for founders, not enterprises.
Start free with the approval gate on. No per-action surprises.
Founder
For the solo operator delegating real work.
- One governed agent brain
- Approval gate on mutation-capable actions
- Write-only secrets vault
- Long-term memory, goals & skills
- Full audit trail & live activity
Team
For a small team operating in parallel.
- Everything in Founder
- Up to 5 seats with shared memory
- Full MCP catalog access
- Per-tool & per-agent approval policies
- Sub-agents in parallel — all gated
- Priority agent runtime
Scale
For companies wiring the agent into their own stack.
- Everything in Team
- Bring-your-own MCP tools
- Custom skills & private memory
- SSO & audit log export
- Dedicated onboarding
FAQ
Straight answers
Secrets, risk, residency, models, the AI Act — and the brake.
No. The vault is write-only: you PUT a secret once and it can never be read back — the API returns only its name, description, and last four characters. The agent references {{secret:NAME}}; the plaintext is substituted at dispatch and scrubbed from tool results before they re-enter the model’s context.
Mutation-capable tool calls are never executed inline. Each becomes a pending proposal, the run blocks with status blocked_on_user, and you approve or reject with the exact arguments in front of you. Unknown tools fail closed to review, and every proposal, decision, and dispatch is written to the audit log.
Your persistent data — conversations, memory, knowledge graph, documents, encrypted secrets — is stored in Zurich, Switzerland. Processing runs on EU infrastructure: the agent runtime in Paris, the dashboard and API on Cloudflare’s edge. If you choose the Swiss model track, inference also stays in Switzerland on Infomaniak-hosted models.
Claude, GPT, Gemini, Mistral, GLM, DeepSeek, Qwen, and Llama are all selectable — the governance layer is identical whichever you pick. Swiss-hosted open-weight models are the default on the Swiss track: Qwen3.5-397B, Mistral 24B, and Nemotron, hosted by Infomaniak, so inference can stay in Switzerland.
Article 14 requires human oversight to be an external control, not a prompt instruction. monopea’s proposal gate was built as exactly that control, and the architecture maps to those obligations. We do not claim certification — formal certification has not yet been obtained — and your own compliance assessment still applies.
Yes. You can steer a run mid-flight with a message, or stop it instantly — and the stop cascades to everything it delegated, since every sub-agent inherits the same gate. Work already completed is preserved and logged, so you can see exactly what happened up to the moment you stopped it.
Ready when you are
Delegate the work. Keep the decision.
Start free with the approval gate on. Connect your tools, set the goals, and let monopea propose the work — nothing outward dispatches without your sign-off.
Free to start · Approval gate on by default · No card required