Zero egress by default
Closed unless a policy opens it
Developer machines reach only the internal gateway and approved private Git and CI services; every other outbound route stays closed unless a policy allows it. Unknown domains are blocked at the endpoint and again at the gateway, so secrets and source code have nowhere to go.
Deep packet inspection
Allowed traffic passes through a transparent forward proxy. TLS is terminated and re-encrypted at the gateway for inspection, and JSON and binary payloads are parsed, not just headers.
Smuggling detection
High-entropy blobs, Base64 hidden in headers, cookies or oversized parameters, and other covert-channel patterns trip the gateway's circuit breaker and raise an alert.
Covert networking and P2P probes
Attempts by an agent to scan the local network, open peer-to-peer channels or coordinate with other agents are detected and cut off.
Deception proxy
Instead of a hard block, suspicious sessions can be routed to decoy endpoints that look real, so the attacker's next steps are observed safely.
Works with the endpoint layer
Egress rules are enforced twice: on the developer machine by the FFaX daemon and again at the gateway, so a hijacked agent cannot get around one by abusing the other.
Design partner program
Install the demo for free and shape the product
Engineering teams using AI coding agents can run the six-week demo at no cost: open-source client, an action log that never leaves your machine, three default policies, decoys and a one-page console.