The Compliance Evidence
Layer for AI Agents.
Pre-flight compliance checks your agents call before they act, each producing a signed, tamper-evident record of the decision, mapped to the regulations you answer to. One API call, any framework. EU AI Act Article 12 logging lands December 2, 2027. The date moved, the obligation did not. VIGIL covers it today.
The date moved. The obligations didn't.
Article 12 still requires high-risk AI systems to allow automatic recording of events over their lifetime, with logging retained for at least six months (Articles 19 and 26). Article 26 still puts operating duties on deployers, including keeping those logs. On May 7, 2026 the EU agreed (Digital Omnibus) to delay the start dates, not the duties: stand-alone Annex III high-risk systems now apply December 2, 2027, and regulated-product systems August 2, 2028. Transparency and watermarking duties (Article 50) land earlier, on December 2, 2026. Penalties are unchanged at up to 15 million euro or 3 percent of global turnover.
VIGIL answers this today. The EU AI Act classifier sorts your use case into prohibited, high-risk, limited, or minimal. The HMAC-signed, non-repudiable delivery log is the automatic event record. The MCP server lets your agent check its obligations before it acts. The delay is not a reprieve. It exists because compliance takes real engineering work, and 18 months is exactly enough time to do it right or to waste. We map the evidence to the obligation, and we do not claim attestations we do not hold.
Fixed-fee readiness assessment available →
Updated June 12, 2026, the same week as the EU's omnibus agreement. Tracking regulatory change is the product.
Six things VIGIL does today.
SIEM-grade event logging
Every agent action captured + normalized (CRITICAL / HIGH / MEDIUM / LOW / INFO), severity-scored CEF/LEEF-compatible, exported to Splunk, Datadog, QRadar.
Real-time event feed
Live activity timeline. Decisions, tool calls, errors, anomalies stream to your dashboard the moment they happen. Like a SOC console, built for AI agents.
Compliance auto-mapping
Events tagged to SOC 2, PCI DSS, ISO 27001, NIST CSF, GDPR Article 30. India DPDP-Sec-8 added in the compliance fabric. One-click audit exports.
Threat detection
Six categories built in: SQL destructive, shell dangerous, secret leak, prompt injection, exfiltration, suspicious network. Aadhaar with Verhoeff checksum validation.
Any agent, any framework
REST, SDK, ElizaOS plugin, MCP proxy. OpenAI, Anthropic, LangChain, custom. VIGIL ingests events regardless of how the agent runs.
Local + cloud, your choice
Cloud dashboard or VIGIL Desktop with a local SQLite store. Same UI, same threat detection, your data never leaves the machine if you don't want it to.
More to explore.
Why VIGIL?
Side-by-side vs Datadog (observability only) and Drata (compliance only). One tool, one database. AI agents now produce regulated data flows, and your existing stack doesn't cover that.
read the pitch →[ docs ]Integration paths
REST · SDK · ElizaOS plugin · MCP. Wire VIGIL into your agent in under five minutes regardless of framework. OpenAPI 3.0 spec lives at /api/.well-known/openapi.
open the docs →[ status ]Live operational status
Real-time component health: primary DB, regional residency, webhook signing, reference-token pepper, sub-processors. Machine-readable mirror at /api/status.
check status →One API call. Any framework.
Send VIGIL the event from any framework. We threat-scan it, tag compliance, persist with severity. The right side of the panel below is exactly what you'd see as the operator on call: the captured event with threat classification, the severity it landed at, the compliance tag attached, and the alert routed to your channel. Time-to-instrument under 5 minutes.
See what your agent
has actually been doing.
Every event lands in a force-directed graph that reads the same way Obsidian's graph view does. Nodes are action types or individual events; edges follow the causal chain through parent_id, trace_id, and run_id, with a temporal fallback when no explicit parent exists. Hover a cluster to see its time range, status mix, and sample payloads.
- ·Status-aware coloring: success, error, warning, info.
- ·Toggle baseline noise (heartbeat, ping, idle) per agent. Pref stored locally.
- ·Click a node for sample payloads, time range, and status breakdown.
- ·Custom Verlet integrator. No D3, no external graph lib, zero added bundle weight.
Operator-first. Not ML-engineer-first.
The category leaders chose the ML engineer corner. The on-call operator is unclaimed.
| Feature | VIGIL | AgentOps | LangSmith | LangFuse | Helicone |
|---|---|---|---|---|---|
| SIEM-standard severity levels | ✓ | · | · | · | · |
| CEF / LEEF export (Splunk etc) | ✓ | · | · | · | · |
| Compliance auto-mapping | ✓ | · | · | · | · |
| Incident correlation engine | ✓ | · | · | · | · |
| Threat detection at ingest | ✓ | · | · | · | · |
| Real-time event feed | ✓ | ✓ | · | · | · |
| Any agent, any framework | ✓ | · | · | · | · |
| Financial / crypto support | ✓ | · | · | · | · |
| Persistent audit trail | ✓ | ✓ | ✓ | ✓ | ✓ |
| Local desktop mode | ✓ | · | · | · | · |
| Free tier | ✓ | ✓ | ✓ | ✓ | ✓ |
Local mode. Same dashboard. Your data, your machine.
VIGIL Desktop runs the same threat detection + event ingest against a local SQLite store. Nothing leaves the box unless you want it to. Free.
Simple. USD. No hidden seats.
Solo builders testing the waters.
- 1 agent
- 10k events / month
- 7-day history
- REST + SDK + MCP
- ElizaOS plugin
Serious agent deployments.
- Unlimited agents
- 1M events / month
- 90-day history
- Smart alerts
- Email + webhook notifications
- Priority support
Mission-critical deployments.
- Everything in Pro
- Unlimited events
- Custom retention
- SLA guarantee
- On-prem deploy
- Dedicated support