You handed a program your keys, your files and an open socket. Cinctus is a self-hosted control plane that runs OpenClaw, Hermes, Claude Code — any MCP client — inside a sandbox that is locked down before you touch a single setting. Your keys, your files, your machine.
No account. No telemetry. One email when it ships, then we leave you alone.
AGPL core · Runs on a Pi or a €4 VPS · No vendor account
You handed a program your keys, your files and an open socket.
Personal agents went mainstream in 2026 faster than any self-hosted tool before them. The security did not come along for the ride. These are the numbers from the last few months. None of them required an attacker to be clever.
1 click
Remote code execution
CVE-2026-25253. One link, and the agent's host is not yours any more.
Plaintext, in a config file, next to the code that reads your email.
The tooling that fixes this exists — agent firewalls, MCP gateways, policy engines. All of it assumes you are a security engineer with a spare afternoon. Cinctus is the same primitives, assembled, with the safe setting already on.
02 — WHAT IT DOES
Six things, and it does them from the first boot.
No hardening guide, no policy language to learn. The defaults are the product; the settings are for loosening them on purpose.
$ docker compose up -d
▸ perimeter up
▸ vault up · 0 keys in plaintext
▸ egress deny-all
$ cinctus adopt openclaw
scanning 34 skills … 2 flagged
agent openclaw is now cinctus
Per-agent sandbox
Rootless container, read-only mounts, hard wall-clock and memory limits. An agent that gets owned takes its own box down with it and nothing else.
Egress allowlist
Deny by default. The agent reaches the hosts you named and no others, and every outbound request is inspected and written down before it leaves.
Credential vault
Keys never enter an agent's config. They are injected for the call that needs them and revoked from one place when something smells wrong.
Skill & MCP scanner
Every skill and MCP server is checked against a reputation feed before it is allowed to run once. The feed gets better every time an install reports back.
Human approval
Spending money, sending mail, touching a repo — the actions you mark wait for your yes on Telegram, or whatever channel you already read.
Audit timeline
What ran, what it read, where it called, what it cost. One timeline you can scroll at 2am, and export when somebody asks you to prove it.
03 — WHAT YOU GET BACK
The same trail that proves what happened shows you what to fix.
Security was the reason you installed it. The receipts are the part you'll actually open every week. Nothing else in your stack can tell you this: a firewall sees requests, not spend, and never sees the pattern.
01
Where the money went
Cost per agent, per model, per run. The month that cost €40 usually turns out to be one agent stuck in a loop at 4am — and you find it in one screen instead of in the bill.
02
What your agent does over and over
The same three-step task, two hundred times, paying tokens for every one. Once you can see the repetition, you can write it as a skill and let it run for free — deterministic, no model call, no surprise.
03
Which calls didn't need a big model
Every call carries the model it used and what it cost. Half a bill is often a task a small local model handles perfectly well — you can only make that trade once you can see it.
04
Which skills never fire
Installed once, never used, still loaded, still attack surface. The scanner tells you what is dangerous; the timeline tells you what is simply dead weight.
05
Which hosts your agent really needs
The egress log is how you tighten the allowlist from evidence instead of guesswork: start in deny-all, watch what it legitimately asks for, allow exactly that.
Same data as the compliance export a company needs. On your own box it's just the thing that makes your agents cheaper and less noisy — the team version is here.
04 — THE CAVEATS
What Cinctus does not do.
You are going to run this on the machine that holds your life. You deserve the caveats before the pitch, not in a changelog eight months in.
It does not stop prompt injection.
Nobody's product does. Cinctus assumes the agent will eventually be talked into something stupid and makes that survivable.
It does not police what the agent is allowed to think.
Inside the permissions you granted, an agent can still do a bad job. That is your call to make, not ours.
It is not a managed service.
Nothing runs in our cloud. If your box is down, Cinctus is down, and that is the trade you came here for.
It does not exist yet.
This is a waitlist, not a download. First build lands late September 2026 — and if it slips, you get the email that says so.
05 — PRICING
Free for a person. Paid for an organisation.
The line does not move. Everything one human needs to secure their own agents is free forever and stays in the open-source core — not a trial, not a seat count that shrinks next year.
CORE
AGPL
Freeforever
The whole cockpit, self-hosted
Sandbox, egress control, vault, approvals
Audit timeline and cost dashboard
One user, one instance
Open source. Fork it if we let you down.
PRO
€9/ month
Live reputation feed and rule updates
Secure remote access to your panel
Config backups and restore
Alerts when an agent trips a rule
Everything in Core, still on your box.
BUSINESS
€99/ month and up
Multiple users, SSO, roles
Central policy per agent
Exportable audit and log retention
Compliance reports
Priced per managed agent. Card, not a sales call.
Get one email when it ships.
We are building this in the open, alone, fast. The waitlist is how we decide whether to keep going — and it is where the first install instructions land.
Stored on our own box in Germany. Unsubscribe link in every mail. Never sold, never shared.