# CortexHub

> The governed agent operating system: bring any AI agent, keep files and memory every agent can use, automate work with Co-workers, and stay in control of every action under one policy and one audit trail.

Last updated: 2026-10-31

## What CortexHub is

CortexHub is the governed agent operating system: one platform to run every AI agent a company uses and to stay in control of every action those agents take. Companies bring the assistants their people already use (Claude, ChatGPT, Copilot, any MCP client or SDK agent), give every employee a governed AI Co-worker, and give every team a shared organisation agent. All of them share the same files and memory (the Brain), and every tool call from every agent is checked, approved or blocked before it runs, under one policy and one tamper-evident audit trail. It is built for companies from a five-person team to a regulated enterprise.

## Products

- Governed Co-workers (https://cortexhub.ai/co-workers): a personal AI co-worker for each employee in web, mobile, Slack and live meetings. It learns the business in a Brain that can be explored and corrected, creates documents, decks, spreadsheets, charts and interactive dashboards saved as versioned files, and runs routines on a schedule. In meetings it presents decks, pulls live numbers and builds charts while it keeps talking, and holds back internal detail when someone from outside the company is in the call. It uses only what its employee is allowed to use.
- Organisation agents (https://cortexhub.ai/organization-agents): shared agents owned by the organisation for a team, such as finance, IT helpdesk, sales operations or policy questions. They run on company credentials connected once by an admin, follow their own agent-level policies, route approvals to the person asking (or to chosen operators for scheduled routines), work from the organisation Brain, and install in Slack as their own named bot.
- Bring your own agents (https://cortexhub.ai/products#gateway): Claude, ChatGPT, Copilot, VS Code and any MCP client or SDK agent connect through the CortexHub MCP gateway at https://mcp.cortexhub.ai/v1/mcp and follow the same policy as hosted agents.

## Platform capabilities

- MCP gateway: every tool call is evaluated against policy before it runs and is allowed, held for human approval, or blocked. Tools are split into read, write and destructive actions per team, and anything no policy covers is denied by default.
- Shared context across agents: files and the Brain live in CortexHub, not inside any one assistant. Work started in Claude can continue in ChatGPT and be handed to a Co-worker in Slack without starting over. Any agent can open and edit a file in any format; every save is a new version, whoever made it, with the latest on top.
- File sharing between employees: an employee can share a file, for example an interactive dashboard their Co-worker built, with a colleague. The colleague is notified and their own Co-worker can use the file straight away. Nothing is copied, owner edits show up live, and unsharing ends access at once.
- Routines and workflows: scheduled, multi-step work. Every run shows each step, why the agent took it, which model it used, what it cost and where a person approved. A routine waits for an approval decision, then continues if approved or adapts if denied.
- Model router: reads each request, considers the models the organisation has enabled, scores them on benchmarks refreshed nightly, picks one and records why, and fails over to another provider automatically.
- Secured sandbox: hosted agents (Co-workers and organisation agents) run in an isolated sandbox for each session. Code they write runs in a separate sandbox with no network access and no cloud credentials. The only way from an agent to company systems is the governed gateway, and credentials stay in a vault and are injected at the gateway for the one call that needs them. External agents never touch company systems directly; they reach them through the same gateway.

## Governance and runtime guardrails

Every guard acts in the path of the agent, applies to every kind of agent (Co-workers, organisation agents, external agents and SDK agents), and opens a risk signal that records what happened, why it was a risk and what was done.

- Policies and approvals: per team and per tool; risky actions wait for a person in the app, on mobile or in Slack, with the reason the agent gave.
- Content moderation: requests typed by people in any chat surface, and routine instructions, are screened before they reach a model. A platform floor (threatening harassment, threatening hate, violent illicit content, self-harm instructions and sexual content involving minors) is always on; an organisation can add categories but cannot remove the floor.
- Prompt-injection defence: everything a tool returns is fenced as untrusted data before the model sees it, and detection reports hidden instructions as risk signals. After untrusted content enters a session, sending or exporting to a destination the owner never named, and irreversible actions, need human approval.
- Automatic pause on breach: an agent that keeps hitting denied actions (20 in 15 minutes by default), floods calls past the rate floor, or loops without finishing is paused automatically with the reason recorded. A paused agent is refused on every request, including through Claude or ChatGPT, and an admin resumes it in one click.
- Approval breaker: three refused approvals in 15 minutes ends the session, so an agent cannot keep asking.
- Spend caps: per agent, by day, week and month (UTC), with defaults per agent type that new agents inherit. Alerts go out at 80% and the agent stops cleanly at 100%.
- Kill switch: any agent can be paused instantly.

## Compliance and framework readiness

CortexHub measures eight readiness dimensions across every agent. Four are guaranteed by the platform: every action authorized, a tamper-evident audit trail, cryptographic attribution of each record to the agent and person, and full activity telemetry exportable over OpenTelemetry. Four depend on configuration: human approval on high-risk actions, least-privilege access, prompt-injection defence and sensitive-data protection. The dimensions are mapped to control ids in SOC 2, ISO/IEC 42001, the EU AI Act, NIST AI RMF, NIST AI 600-1 (GenAI profile), ISO/IEC 23894 and the OWASP Top 10 for LLM applications. Every gap names the one setting that fixes it, and evidence for any period can be exported and verified offline without trusting CortexHub.

## Security

- CASA certified.
- Hosted agents and their code run in a secured sandbox with one governed exit.
- Credentials are kept in a vault and never reach the model.
- Personal and secret data is redacted before it is stored.
- Encryption in transit (TLS 1.2+, TLS 1.3 preferred) and at rest (AES-256).
- Each organisation is a hard boundary for policy, credentials, audit and usage.
- Every action is attributed to a named person, and audit records are hash-chained and verifiable offline.

## Who it is for

- Security and CISO: runtime control at the point of action, sandboxed execution, credentials kept out of prompts, automatic pause on misbehaving agents.
- IT and platform teams: one governed gateway every approved agent connects through, least privilege per team, per-agent spend caps.
- Compliance and risk: evidence mapped to SOC 2, ISO/IEC 42001, the EU AI Act and NIST, verifiable offline.
- Every employee and team: a Co-worker and team agents that do real work in the tools they already use.

## Pricing

One self-serve Growth plan; enterprise terms via contact. See [Pricing](https://cortexhub.ai/pricing) and [book a demo](https://cortexhub.ai/book-a-demo).

## Key pages

- [Home](https://cortexhub.ai/): The governed agent operating system. Run every AI agent, control every action.
- [Platform overview](https://cortexhub.ai/products): The MCP gateway, the three kinds of agent, shared context and knowledge.
- [Governed Co-workers](https://cortexhub.ai/co-workers): A governed AI co-worker for every employee, in chat, Slack and meetings.
- [Organisation agents](https://cortexhub.ai/organization-agents): Shared agents for each team, owned by the organisation.
- [Governance](https://cortexhub.ai/governance): Policies, guardrails in action (moderation, injection defence, auto-pause, spend caps) and framework readiness.
- [How it works](https://cortexhub.ai/how-it-works): Entry points, routines, the model router and framework readiness.
- [Security](https://cortexhub.ai/security): The secured sandbox, architecture, data handling, tamper evidence and compliance posture.
- [Pricing](https://cortexhub.ai/pricing): One self-serve Growth plan; enterprise terms via contact.
- [About](https://cortexhub.ai/about): The team and mission behind CortexHub.
- [Book a demo](https://cortexhub.ai/book-a-demo): See CortexHub on your own agents.
- [Developer docs](https://docs.cortexhub.ai/docs/): API, SDK and MCP gateway reference.

## Company

CortexHub builds the governed agent operating system for companies of every size. More at [About](https://cortexhub.ai/about). Contact: hello@cortexhub.ai.

## Developer facts

Primary developer docs: [https://docs.cortexhub.ai/docs/](https://docs.cortexhub.ai/docs/)

- MCP endpoint: https://mcp.cortexhub.ai/v1/mcp
- MCP auth: interactive clients use OAuth browser consent; programmatic clients use a member OAuth client or an organization MCP key
- Programmatic MCP: exchange client credentials at POST /v1/mcp/oauth/token; send X-CortexHub-Agent on each POST /v1/mcp
- Platform REST: control-plane OAuth Bearer from POST /v1/oauth/token
- Query-string credentials are not supported
- The gateway exposes 5 CortexHub meta-tools for search, schema lookup, invoke, task polling, and consent, plus built-in Brain, Files and Skills tools (brain_recall, files_save, skills_find and more) when the agent is entitled to them
- Downstream tool invocation goes through cortexhub_invoke_tools
- Toolkit connections happen in CortexHub Cloud via connect_required.portal_url
- Co-workers, organisation agents and external agents share the same Brain and files through governed tools; every call is policy-checked and audited
- Agents should treat policy_denied, awaiting_user_consent, awaiting_operator_approval, autonomous_consent_required, agent_toolkit_required, rate_limited, and upstream errors as normal governed outcomes
- Parked approvals complete via MCP Tasks, call cortexhub_get_task once (blocks server-side until complete)
- Custom REST APIs: import Swagger 2.0 or OpenAPI 3.x specs (upload or URL) as governed toolkits; operations are discovered from the spec and invoked through cortexhub_invoke_tools.