One engineer proving one governed workflow
FOUNDER PREVIEW- Codex or Claude Code runtime
- One signed session profile
- Local allow, deny, and approval rules
- Session history and remote stop
PRIVATE PREVIEW PRICING
Pay for the governed environment.
Not for every human or token.
Our intended subscription boundary is the infrastructure a team governs: a cloud account, cloud project, or cluster. Final public prices are still being validated with design partners.
WHAT WILL NOT BE THE METERSeatsPrompt tokensTool-call countApproval countNo surprise execution bill.
SUBSCRIPTION SHAPE
Start with one boundary.
Expand when the team does.
No public price is invented before the brokered-credential and provider-verification gates are ready. Preview terms are agreed in writing.
Shared policy for infrastructure work
DESIGN PARTNER- Governed accounts, projects, or clusters
- Versioned team rules
- Central approvals and operator visibility
- Retained action proof and export
Brokered identity and organization controls
DESIGN PARTNER- Short-lived provider credentials
- Enterprise identity and retention
- Private connectivity and regional options
- Provider verification and support
THE BILLING BOUNDARY
One governed scope has one subscription identity.
A scope can represent an AWS account, GCP project, Azure subscription, or Kubernetes cluster when that provider boundary is released. Named sessions, engineers, policies, and retained receipts live inside it.
- 01Choose the environmentAccount, project, or cluster.
- 02Choose the authorityAttach mode today. Brokered mode as it is released.
- 03Freeze the rulesEvery session names an immutable profile and policy.
- 04See the proofActions and outcomes remain attributable.
STRAIGHT ANSWERS
Before you connect anything.
Do you store cloud credentials?
Not in the current runtime. Attach mode uses the identity already present on the engineer's machine. Brokered short-lived credentials are a separate release gate.
Does Misconfig replace Codex or Claude Code?
No. It launches and governs the agent you already use through its supported native hook boundary.
Is attach mode impossible to bypass?
No. An engineer who can use the original local credential can operate outside the governed launcher. The console labels that truth. Brokered identity is the stronger boundary.
Can we buy it today?
Founder staging is open for supervised evaluation. Contact us to define one workflow and one governed boundary.
NO PRICING THEATRE