All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Archestra sells companies running AI agents an open-source platform they host in their own Kubernetes cluster. Policy code rather than the model decides what an agent may touch on the tool calls its gateway carries. Its published overhead of 41 milliseconds at the 99th percentile is measured with the language model replaced by a mock. The same page prices the dual-model check that screens untrusted content at two to three seconds per round. A buyer who turns that check on pays seconds for each quarantine round, which the headline figure does not cover. The London company counts its Fortune 500 deployments itself and shows one named reference, the Latin American payments firm Akua. A buyer checking references starts from that one name.
| Description | Open-source enterprise AI platform that gives AI agents governed access to corporate systems, applying deterministic tool-invocation and trusted-data policies that the vendor states prompt injection cannot bypass. | [f1] |
|---|---|---|
| Founded | 2025 | [f2] |
| HQ | London, United Kingdom | [f2] |
| Funding | $13.5M total | [f3] |
| Latest funding | $10M seed led by 20VC (June 2026) | [f3] |
| Product | What it does |
|---|---|
| Archestra Platform | Self-hosted platform that runs MCP servers as isolated Kubernetes pods, proxies LLM and MCP traffic, and enforces deterministic tool-invocation and data policies with audit logs and cost tracking. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Archestra Platform runs MCP servers in isolated containers, applies deterministic guardrails against prompt injection, and controls agent access through a private registry. These capabilities are mapped to the AI Defense Matrix. [f4]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | The buyer is the platform and security team putting AI agents on corporate data without leaks, and Tech.eu frames the same hesitation in its own words, but the pain is argued through the company's own account of injection risk rather than quantified by independent research. [s5, s1, s8] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Public documentation covers the gateway's four client authentication paths and two MCP protocol revisions, the latency benchmark states its own mocked-model method, and the base platform implementing the policy engine is published under AGPL-3.0 with 4.2k stars and 1.2k forks on the repository page. [s18, s10, s12, s9] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Anthropic open-sourced the Model Context Protocol in November 2024, the credible enabler for a governed agent-access layer, but the buyer-side evidence runs to a single kind of signal, the June 2026 enterprise-authorization launch the company documents on its own blog. The four Fortune 500 deployments are the chief executive's count rather than an independent demand signal. [s21, s15, s5] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | A SiliconANGLE article states that Matvey Kukuy and Ildar Iskhakov founded Amixr, which Grafana Labs acquired in 2021, and that Kukuy co-founded Keep Alerting, which Elastic acquired in May, two prior builds evidenced independently of the company's own pages. [s6, s3, s7] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | Akua is the one named reference, endorsing the product on the homepage through its head of cybersecurity, and the four Fortune 500 production deployments are the chief executive's own count as Tech.eu attributes it, with no deployment named and no customer-side source corroborating scale. [s1, s5, s4] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | The $13.5 million raised across ten months is proportional to a seven-person team shipping a self-hosted open-source platform, and the repository page reports 5,881 commits, but no revenue, margin or growth-efficiency figure appears in the cited record. [s4, s5, s2, s12] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | Buyers can place the product as an MCP gateway, but the company sells a composable enterprise AI stack spanning chat, an agent runtime, retrieval and proxies, so the budget line still needs vendor explanation in a category that formed after the protocol's late-2024 release. [s8, s21] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Deployment inside the customer's own Kubernetes cluster, a component surface spanning chat, an agent runtime, retrieval and gateways, and an open-source community are absorption friction, and that friction is what keeps this above the quarterly-feature line. The company's own blog nonetheless records that Okta's Cross-App Access removes much of the authorization work a gateway used to do. [s15, s17, s12] |
Enterprises want AI agents working on corporate data, and the connection between the two is what Archestra sells against. Anthropic open-sourced the Model Context Protocol in November 2024 as a standard way to wire AI assistants to business systems. The company writes that MCP adoption inside large organizations runs into authorization at scale. A Tech.eu article states that enterprises deploy agents for basic tasks while worrying about what an agent touches and who it talks to outside the company.
The company states the mechanism concretely. An agent that can read private data, process untrusted content, and send messages outward can be steered by an injected instruction into leaking what it reads. Archestra's answer is policy enforced in code at the point where an agent calls a tool, plus a rule that marks a conversation tainted once a tool call returns sensitive data and switches off the tools that could leak it.
The buyer spans the platform team that runs agent infrastructure and the security function that must approve it. Independent quantification of the pain stays thin. The reviewed press repeats the company's framing, and no analyst estimate or incident count specific to MCP deployments appears in the captured sources. [s21, s15, s5, s1, s8]
Archestra Platform is a full enterprise AI stack rather than a single gateway. The documentation describes a set of composable components: a chat interface for non-technical staff, an agent runtime, a retrieval layer over company documents, LLM and MCP proxies, and an orchestrator that runs each MCP server as an isolated pod in the customer's Kubernetes cluster. Deterministic tool-invocation and trusted-data policies gate what agents may call, and the company states prompt injection cannot bypass them.
Buyers can inspect the capability claims directly. The base platform is published under AGPL-3.0 beside a separate enterprise licence file, a Docker quickstart runs the platform locally, Helm charts target production Kubernetes, and the repository page reports 5,881 commits across 318 releases. The gateway documentation goes to the level a buyer can test, covering four client authentication paths and two MCP protocol revisions served from one endpoint with a table of what differs between them.
The published benchmark states its own limits. Archestra reports roughly 30 to 50 milliseconds of added overhead per request, 31 milliseconds at the 95th percentile and 41 at the 99th, and the same page records that the language model was mocked out to isolate platform overhead. It also prices one round of the dual-model quarantine that screens untrusted content at two to three seconds, so that check costs far more than the routing does. [s8, s12, s9, s17, s18, s10]
Archestra differentiates on scope and on openness. Its MCP servers run as containers in the customer's own Kubernetes cluster and its core is published under AGPL-3.0, so a buyer evaluates an AI stack rather than a single gateway. The documentation makes the components separable, which lets a team adopt one piece next to tools it already runs.
The company has published its own read of where the pressure comes from. When Okta announced Cross-App Access in June 2026, Archestra wrote that a gateway existing only to hold a static key and forward requests becomes much less useful once authorization moves into the identity layer, and said it can now focus on security, logging, data-exfiltration protection and the agent runtime. Archestra appears in that launch lineup alongside Cloudflare, Cursor, Datadog, Docker, WorkOS and Zoom.
Enterprise licensing covers administration rather than the guardrails. The paid list runs to role-based access control, single sign-on with OIDC, an access-controlled knowledge base, data-retention windows, real-user monitoring, encryption of logs and chat messages at rest, two-factor authentication, and idle hibernation for self-hosted MCP servers. The deterministic policy engine that carries the security pitch is not on that enterprise list, and a company under 30 users gets everything on it at no charge. [s8, s15, s9, s12, s1]
Funding compounded quickly. A $3.3 million pre-seed was announced in August 2025, then a $10 million seed led by 20VC in June 2026, taking the total to $13.5 million about ten months after the company unveiled itself.
Customer proof has not caught up with the funding. The one named reference is Akua, a Latin American payments-infrastructure company whose head of cybersecurity endorses the product on the homepage. The four Fortune 500 production deployments are the chief executive's own count, which Tech.eu attributes to him, and no deployment is named in the captured sources.
The visible motion is open-source-led. The homepage offers a free self-host path, the enterprise features cost nothing for companies under 30 users, and the repository page reports 4.2k stars and 1.2k forks. Archestra joined the Cloud Native Computing Foundation as a Silver Member in September 2025 and appears in Okta's Cross-App Access launch lineup. [s3, s6, s2, s4, s5, s1, s9, s12, s20, s15]
Serial founders with two exits lead the company. Matvey Kukuy and Ildar Iskhakov, childhood friends, founded the incident-management platform Amixr. A SiliconANGLE article states that Grafana Labs acquired Amixr in 2021 and that Kukuy went on to co-found Keep Alerting, which Elastic acquired in May.
The bench comes out of Grafana. The about page places the chief executive, the chief technology officer and a founding engineer in London, names a founding engineer who previously worked on Grafana Mimir, and lists a founding AI engineer with more than ten years in applied machine learning. The exits are in incident response and observability rather than in security products, so the domain fit is adjacent. No named security-research leadership appears in the captured pages. [s3, s6, s7]
No compliance attestation surfaced in a probe of the company's trust surfaces on 29 August 2026. The trust and security subdomains do not resolve, and neither does a nonsense control subdomain, so the result reflects the record rather than wildcard DNS. The /security, /trust, /compliance and /soc2 paths return 404, the served homepage HTML carries no SOC, ISO or trust-platform badge strings, and the documentation's own security page lists a contact address and a bug bounty program still in development.
Self-hosting is the trust posture the company offers. The platform runs in the customer's cluster, knowledge-base embeddings sit in the customer's own Postgres, retrieval is indexed alongside the source systems' access lists so a query returns only what the asking user could already open, and the code is public for inspection. One OpenAI-compatible endpoint sits in front of the model providers each customer connects, and each environment carries its own credentials and network egress policy. The marketing goes further than the evidence. The chief executive is quoted saying the platform guarantees 100% protection against data leaks, an absolute claim that one demonstrated bypass would falsify. [s16, s19, s1, s2, s4]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| MintMCP | competes with | Competes for the same buyer, the enterprise team deciding how its AI agents reach internal systems. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Runlayer | competes with | Competes for the same governed-agent-access budget. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Natoma | competes with | Competes for the same decision about who authorizes an agent's tool calls. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Okta | adjacent | Ships the Cross-App Access pattern Archestra integrates with, and Archestra's own blog describes that pattern absorbing work a gateway used to do. |
Add analyzed competitors to compare them side by side with Archestra.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Archestra runs inside the customer's own Kubernetes cluster, where it executes MCP servers, proxies model calls and enforces access policy. Leaving means re-pointing the agents and tools it fronts at a replacement. The assets behind that position are open. The core is published under AGPL-3.0, and the server catalog the private registry draws on is public too. A probe of the company's trust surfaces on 29 August 2026 found no compliance attestation. The repository page reports 1.2k forks and 5,881 commits. That activity is a head start, not yet a durable lead.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Archestra delivers software the customer self-hosts and operates, an AGPL core with a licensed enterprise feature set, and the customer's own team runs the platform and owns the outcomes. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Once the platform hosts an organization's MCP servers, model proxying and access policies, leaving means re-pointing the agents and tools it fronts at a replacement, which is integration effort. The gateway speaks standard MCP revisions and standard authentication paths, and the cited record does not size the migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | A probe of the trust surfaces on 29 August 2026 found no attestation, the documentation's security page offers a contact address and a bug bounty program still in development, and the captured record names no regulation that mandates this product class. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Running arbitrary MCP servers as isolated Kubernetes pods while enforcing policy on every model call and tool invocation, serving two MCP protocol revisions from one endpoint across four client authentication paths, and publishing measured overhead at the 99th percentile is real-time systems work. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | The named buyer is the enterprise platform and security team, but a free tier under 30 users, self-serve open source, and a single named reference that is a payments-infrastructure vendor in Latin America blend the profile rather than gating on regulated-enterprise procurement. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | Agents built in other frameworks reach their tools through Archestra's gateway, MCP servers run as its Kubernetes pods, and model calls pass through its proxy, so the platform is infrastructure the customer's agent applications depend on rather than an application in its own right. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | The MCP server catalog the private registry draws on is public, the base platform is published under AGPL-3.0, and knowledge-base embeddings sit in each customer's own Postgres rather than accruing to the vendor, so the cited record evidences no proprietary dataset, content licence or patent. |
Archestra targets organizations rolling out AI agents at company scale, selling to the platform team that runs the infrastructure and the security function that gates it. SiliconANGLE places production use in Fortune 500 functions such as legal, procurement, management and operations. The one named reference is Akua, a Latin American payments-infrastructure company.
Archestra splits the market by adoption rather than by company size. The enterprise features are free in production while a company runs fewer than 30 Archestra users in total, open-source self-hosting serves teams that want to run the platform themselves, and continued production use of the enterprise features needs a licence once company-wide usage reaches 30, so a large enterprise piloting with a small group starts free. Because the documented components run to a chat interface, an agent runtime, a knowledge base and an MCP gateway on one platform, the company competes for the enterprise AI platform budget rather than for a security line item alone.
The differentiating claim is deterministic enforcement rather than better AI. Tool-invocation and trusted-data policies run as code inside the gateway, on the tool calls that pass through it, and the company states prompt injection cannot bypass them because enforcement happens at the proxy rather than in a model's judgment. A taint rule extends that. Once a tool call returns sensitive data the conversation is marked, and the tools that could send it outward switch off for the rest of that conversation.
Engineering evidence is public. The base platform is published under AGPL-3.0 so the implementation is readable, the gateway documentation covers four client authentication paths and two MCP protocol revisions served from one endpoint, and the company publishes its own latency measurements. What the cited record does not identify is a proprietary detection model or a non-public data asset, so the differentiation is architecture and openness.
Distribution leads with free. Self-hosting costs nothing, the enterprise features are free below 30 users, and the repository page reports 4.2k stars and 1.2k forks. Demos and enterprise licensing run sales-led on top of that base.
Named proof has not caught up with the motion. The seed announcement and the coverage of it both describe Fortune 500 production deployments without naming one, and Tech.eu attributes the count of four to the chief executive. The single named reference is Akua's head of cybersecurity endorsing the product on the homepage. Archestra appears in Okta's Cross-App Access launch lineup and joined the Cloud Native Computing Foundation as a Silver Member.
Pricing follows the open-core split. The base platform is AGPL-3.0 and a separate enterprise licence covers eight components: role-based access control, single sign-on with OIDC, an access-controlled knowledge base, data-retention windows, real-user monitoring, encryption of logs and chat messages at rest, two-factor authentication, and idle hibernation for self-hosted MCP servers. No price list is published, and the documentation routes buyers to a sales address for a quote. A licence becomes necessary for continued production use of those features once company-wide usage reaches 30.
The monetized unit is organizational administration rather than the guardrail engine. The deterministic tool and data policies that carry the security pitch are not on that enterprise list, so what a company pays for is the machinery that makes the platform manageable across teams. That machinery decides who sees what, how identity flows in, how long logs live, and who holds the encryption key. The small-team carve-out gives companies under 30 users all of it at no cost.
Delivery is the customer's own infrastructure. A Docker quickstart serves development, production runs through Helm on an external Kubernetes cluster, and the customer operates the platform, so the control plane, the MCP server containers and the knowledge-base embeddings all run inside the customer's environment. What leaves that environment depends on configuration, because one OpenAI-compatible endpoint sits in front of the model providers the customer connects and each environment carries its own credentials and network egress policy.
The published performance work states its own limits. Archestra reports 25 milliseconds at the median, 31 at the 95th percentile and 41 at the 99th, and records that the language model was mocked out to isolate platform overhead. The same page prices one round of the dual-model quarantine at two to three seconds, so a screened call costs seconds rather than milliseconds.
Self-hosting shifts run cost and upgrade work to the buyer. Built-in metrics, tracing and per-team cost tracking ship with the platform, and the open code lets a customer patch without waiting for the vendor. No hosted offering appears in the captured record for buyers who want the platform run for them.
A probe of the trust surfaces on 29 August 2026 found no compliance attestation. Neither a trust nor a security subdomain resolves, and a nonsense control subdomain does not resolve either, so the result reflects the record rather than wildcard DNS. Four trust paths return 404, the served homepage carries no SOC or ISO badge, and the documentation's security page offers a contact address and a bug bounty program still in development.
The trust argument the company makes is architectural. MCP servers run as containers in the customer's own Kubernetes cluster, knowledge-base embeddings sit in the customer's own Postgres, retrieval is indexed alongside the source systems' access lists so a query returns only what the asking user could already open, and the code is public for inspection. Model traffic goes to the providers the customer connects through one OpenAI-compatible endpoint.
The marketing overreaches the evidence in one place. The chief executive is quoted, in the company's own announcement and in SiliconANGLE's coverage of it, saying the platform guarantees 100% protection against data leaks. One demonstrated bypass would falsify that.
Archestra positions itself inside the MCP ecosystem rather than beside it. The gateway exposes a single endpoint for MCP tools and works with agent frameworks including n8n, LangChain, Vercel AI, Pydantic AI and Mastra, and it serves two MCP protocol revisions from that one endpoint so older clients keep working. Archestra appears in Okta's Cross-App Access launch lineup alongside Asana, Atlassian, Cloudflare, Cursor, Datadog, Docker, Figma, Linear, WorkOS and Zoom, and it joined the Cloud Native Computing Foundation as a Silver Member in September 2025.
The ecosystem position cuts both ways, and the company says so. Its own blog records that once authorization moves into the identity layer, a gateway existing only to hold a static key and forward requests becomes much less useful, and that Archestra can now concentrate on security, logging, data-exfiltration control and the agent runtime. The private MCP registry draws on a public catalog of more than 900 evaluated servers, and a public catalog is readable by rivals.
The founding team has built and sold enterprise infrastructure twice. Matvey Kukuy and Ildar Iskhakov founded Amixr, the incident-management product a SiliconANGLE article states Grafana Labs acquired in 2021, and the same article states Kukuy later co-founded Keep Alerting, which Elastic acquired in May. The about page places the chief executive, the chief technology officer and a founding engineer in London, and names a founding engineer who previously worked on Grafana Mimir.
The team's fit is open-source enterprise software rather than security. The founders' prior products were operations tooling, and the security depth the platform claims is expressed through architecture, isolation and deterministic policy rather than through a research or threat-intelligence pedigree. No named security-research leadership appears in the captured pages. Tech.eu put the company at seven people in June 2026, which is the scale at which the platform's breadth has been built.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Archestra docs: Platform Overview | official | 2026-08-29 |
| f2 | Tech.eu: Archestra.AI raises $10M to unlock next-gen agentic use case | press | 2026-08-29 |
| f3 | SiliconANGLE: Archestra raises $10M to broker AI agent access to corporate data | press | 2026-08-29 |
| f4 | AI Defense Matrix Catalog mapping for Archestra | other | 2026-08-29 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.