Gleipnir
Become a design partner
Let your AI agents run, not run wild

Self-hosted AI agents for ops, with limits they can’t change.

Gleipnir Runtime runs AI agents on your servers with only the tools you grant and a person on risky calls. Gleipnir Relay lets any AI agent work on your Linux fleet through operations each node allows.

for · platform and infra teams who want AI agents in production, with a person signing off.

  • self-hosted
  • air-gapped
  • BYO model
Become a design partner Install Runtime

Design partners: free for three months, installed with you on a call. We never need access to your systems.

One governs the AI agent. One governs the fleet.

Gleipnir Runtime self-hosted AI agent runtime

governs · the AI agent

Runtime runs AI agents on your own servers, woken by your alerts, webhooks and schedules. Each one sees only the tools you grant, waits for a person before any action you mark, and logs every step.

tools
any MCP server
models
Anthropic, OpenAI, Google, or any OpenAI-compatible endpoint, including local
status
available · Docker Compose
Explore Runtime

Gleipnir Relay self-hosted fleet control for AI agents

governs · the fleet

Relay lets AI agents and your ops team inspect and fix a Linux fleet through typed operations defined in advance. Each node runs only what its own root-owned Policy allows, and nothing sent over the wire can change that.

works with
any MCP client, including Runtime
nodes
Linux · relay-daemon dials out, no inbound port
status
available in alpha
Explore Relay
together

From the alert to the fix, across your whole stack.

Runtime wakes an AI agent on your alert and gives it the tools you grant. Relay gives it typed operations on your Linux nodes, and nothing more. One run can find the bad commit, roll back the fleet and open the fix, and nobody hands it a shell.

Runtime on its own

AI agents that wake on your alerts and work across the tools you grant: GitHub, monitoring, tickets. No governed way onto your servers.

Relay on its own

Typed, Policy-bound reach into every Linux node, for any MCP client. It does what it’s asked, and waits to be asked.

Together

One AI agent that notices the outage, reads the code that caused it, fixes the fleet within its limits, and leaves the rest for a person.

Tell us the incident you’d hand it first
security in depth

Every stage enforces its own limits. The strictest one wins.

A rule in a prompt can be argued around, so every check here lives outside the AI. Each stage judges the request on its own terms, against limits set where it runs. Every check that applies has to say yes, and any one of them can say no.

Enforcement happens at the most restrictive layer, not the least.

A compromised Runtime still faces Relay’s role and reach checks and every node’s Policy. A compromised Relay server still faces every node’s Policy.

  1. AI agenttrigger: webhook, schedule or alert
  2. runtime on your Runtime server works alone with any MCP server
    • tool grantStops tools you didn’t grant from entering the AI agent’s context.
    • approval and limitsHolds tools you mark for a person. Stops runs at their token and tool-call caps.
  3. MCP · run_operation
  4. relay relay on the Relay server works alone with any MCP client
    • role and reach capStops callers without the role, and calls that reach too many nodes.
    • approval gateHolds changes your rules gate until they’re approved.
  5. relay-daemon · on each node
    • node PolicyStops anything that node doesn’t allow. The final word.
  6. runs on each node that allows it · recorded in Runtime and Relay

FAQ

Do I need both?
No. Runtime works with any MCP server, and Relay works with any MCP client. Start with either, and add the other when you want one AI agent working across both.
Where do approvals happen?
In Runtime. Runtime holds tools you mark for a person, and Relay holds changes its gate rules match. Both appear on the run’s page in Runtime, and Runtime’s own holds can also be answered from Slack. The AI agent never sees the question.
Can the AI agent run arbitrary commands?
Not by default. Relay runs typed operations your team defines in advance, and each node’s Policy decides which of them it allows. Raw commands are a separate tool: off unless you grant it in Runtime, limited to admin accounts, and matched against each node’s allowed patterns.
What gets recorded?
Runtime records every trigger, tool call, result and approval decision. Relay records every call it receives, every refusal and every approval, with who, what, where and when.
Does anything leave my network?
Only what you send to your model. With a hosted model, prompts and tool results go to that provider under your own API key. Neither product calls home or sends telemetry. With a local model and local tools, Runtime runs fully offline, and Relay’s daemons only dial out to your own Relay server.
Is Relay available?
Yes, in alpha. Install it yourself, or as a design partner we install it with you on a call. Either way, we never need access to your systems.
Can my company use it?
Gleipnir is source-available. The community edition is free for home use and education. Anyone who makes money with it, company or individual, needs a commercial license. Runtime is $250 a month per production install, with staging and development included; see the pricing page. Evaluation licenses for testing are free, and design partners use it free for three months.
Design partners

Run Gleipnir Runtime, Relay, or both, free for three months.

You get
Runtime and Relay free for three months, direct access to the engineering team, and a say in the roadmap.
We ask
Run it on your own work and join a call every other week to tell us what you’ve seen.
How long
Three months free. Then early-adopter pricing (40% off) locked in for 24 months, or walk away and give up the lock-in.
Become a design partner See pricing and licensing