Jozu builds AI supply chain security for enterprises that run their own models, agents and MCP servers.
Its self-hosted platform checks AI artifacts before they are deployed and controls what agents do once they are running, including in air-gapped environments. It is built for platform, ML and security teams that cannot send their AI estate to a third-party cloud.
At A Glance
| Vendor | Jozu |
|---|---|
| Category | AI supply chain security, AI infrastructure |
| Identities covered | AI agents, AI models, MCP servers |
| Deployment | Self-hosted, on-premises, edge, air-gapped |
| Agentic AI | Agent Guard, Agent Enclave, MCP registry |
| Customers | Arlequin, Single Core Labs, DSV |
| Market classification | AI Engineering & Infrastructure; also Supply Chain Security |
What Jozu Does
Models, agents and MCP servers are pulled into enterprise environments from many places, often without a consistent check on what they contain or a limit on what they can do after they start. A model file can execute code on load, weights can be backdoored, and an agent can call tools nobody approved. Jozu’s goal is to help organisations put AI into production securely and efficiently, with security and governance across the AI lifecycle. It works in two stages: every artifact is verified and recorded before it runs, and every agent action is checked against policy while it runs, with both results kept in one audit record. A common packaging format lets models, datasets, code and prompts travel together as one versioned artifact.
Products
Jozu Hub
Jozu Hub is a private, self-hosted AI model registry for Kubernetes. Security teams use it as the single approved source for models and agent components.
- Scanning across nine vulnerability classes, from code that executes on load to backdoored weights
- Cosign signatures and OCI attestations attached to each artifact
- An MCP registry of approved agents, skills and MCP servers
- A cryptographically chained, tamper-evident audit repository
- Rapid Inference Containers, built at pull time from a hardened base image and a ModelKit
Jozu Agent Guard
Agent Guard puts policy around every agent action, including local tool calls and stdio operations that network controls never see. Its Policy Engine includes Tool Access Control, and Prompt Filtering and I/O Filter guardrails screen what goes into and comes out of the agent. It is aimed at organisations letting agents act on desktops, servers and edge devices. Two related products sit alongside it:
| Policy Gateway | Endpoint policy for agent tool calls, a lighter entry point before the full Agent Guard |
|---|---|
| Agent Enclave | Runs coding agents in disposable microVMs, so an agent working on a codebase is isolated from the host and discarded after use |
KitOps
KitOps is an open source tool for packaging, versioning and sharing AI projects, used by ML teams that want AI artifacts handled like any other software release.
| ModelKit | An OCI-compliant artifact bundling models, datasets, code, prompts and docs |
|---|---|
| Kitfile | A YAML manifest that describes what goes into a ModelKit |
| Signing | ModelKits can be signed with Cosign, key-based or keyless via OIDC |
| ModelPack | A specification extending the OCI 1.1 standard to the large artifacts common in AI |
| Kit CLI | The command-line tool to create, inspect, run and automate ModelKits |
How It Works
| Component | What it does |
|---|---|
| Deployment | Everything is self-hosted, on premises, at the edge or air-gapped, with no cloud dependency. Hub runs on the customer’s Kubernetes, on premises or in a private cloud. |
| Hub components | Hub combines a registry server, security scanning, policy administration and the audit repository. |
| Attestations | Scan results travel with the artifact as signed attestations, so any environment pulling it can check what was verified. |
| Runtime | Agent Guard enforces policy wherever agents run and ships tamper-evident logs back to Hub, so pre-deployment checks and runtime decisions end up in the same audit record. |
Identities And Systems Covered
| AI models | Scanned, signed and served from Hub |
|---|---|
| AI agents | Every action governed by Agent Guard, coding agents isolated in Agent Enclave |
| MCP servers | Curated and scanned in the Hub MCP registry |
| Environments | Kubernetes, desktops, servers, edge devices, IoT and air-gapped networks |
Agentic AI Capabilities
MCP Registry
Hub implements the MCP registry specification, so clients such as VS Code, Cursor and Claude Desktop can point at Hub and see only scanned, approved MCP servers. The same registry lists the agents and skills an organisation has approved, so developers install agent components from one vetted source instead of public listings.
Human Approval
Where an action is sensitive, Agent Guard can ask a person to approve it through MCP elicitation, putting a human in the loop only where it matters while routine tool calls continue under policy without interruption.
Integrations
| Area | Integrations |
|---|---|
| Identity | Okta, Entra, Keycloak |
| Data loss prevention | Forcepoint, Proofpoint |
| Code and container scanning | Snyk, Trivy, Chainguard |
| CI/CD | Jenkins, GitLab CI, GitHub Actions, Dagger, OpenShift pipelines |
Company Background
| Leadership | Brad Micklea, co-founder and CEO; Gorkem Ercan, co-founder and CTO; Jesse Williams, co-founder and COO |
|---|---|
| Funding | A $4 million seed round in May 2025, led by HalfCourt Capital with Mozilla Ventures, Sentiero and Union Bay Partners |
| Open source | The Jozu team created KitOps and the ModelPack specification, both now hosted under the CNCF |
| Recognition | Assessed Awardable in the CDAO Tradewinds Solutions Marketplace and the US Air Force Platform One Solutions Marketplace |
Note: This overview is compiled from Jozu’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.