Both enforce policy before an agent acts, with approval gates and audit. Cordum is a self-hosted control plane you run on your own infrastructure, governing agent actions across frameworks. PolicyLayer is a hosted, MCP-native gateway: deterministic, argument-level policy on every tool call, with nothing to operate. Here is where each one fits.
Same instinct, opposite form factor. Cordum is a stack you run; PolicyLayer is a gateway you point at.
PolicyLayer is the hosted gateway your MCP traffic runs through. Connect your servers and every tool call is checked against deterministic, deny-by-default policy before it executes: allow, deny, rate-limit, or require approval, with argument-level rules and a per-call audit log. It is MCP-native, ships recommended policy pre-classified across 220,000+ catalogued tools, and has nothing to deploy or operate.
Cordum is a source-available control plane for autonomous agents. It runs on your own infrastructure (Go services on a NATS bus and Redis, with a dashboard and CLI) and evaluates agent jobs against declarative YAML policy in a safety kernel, returning allow, deny, require-approval, or allow-with-constraints. It is framework-agnostic across LangChain, CrewAI, and MCP, with approval queues and a hash-chained audit trail, deployed via Docker Compose or Kubernetes.
A self-hosted, framework-broad control plane, versus a hosted, MCP-native gateway.
| PolicyLayer | Cordum | |
|---|---|---|
| Primary job | Enforce policy on every MCP tool call across the servers you run | Gate agent jobs and actions across frameworks before they execute |
| Scope | MCP-native: gateway, server and tool directory, per-tool risk classification | Framework-agnostic: LangChain, CrewAI, MCP, and others |
| Policy model | Deterministic JSON policy, deny by default, in a visual editor and as code | Declarative YAML policy evaluated deterministically in a safety kernel |
| Verdicts | Allow, deny, rate-limit, or require approval | Allow, deny, require-approval, or allow-with-constraints |
| Granularity | Per tool and per argument (deny refunds over $1k, block DELETE without WHERE) | Per job and per tool; argument-level matching not documented |
| Starting policy | Recommended rules pre-classified across 220,000+ catalogued tools | Author your own YAML policy |
| Approvals | Human approval gates on any call | Approval queue with multi-approver gates |
| Audit | Every call logged with the tool, its arguments, and the decision | Tamper-evident, hash-chained audit trail |
| Licence | Commercial hosted service | Source-available (BUSL), with Community, Team, and Enterprise tiers |
| Deployment | Hosted; point your client at a URL, nothing to run | Self-hosted; Docker Compose or Kubernetes on your infrastructure (managed cloud in early access) |
| Best fit | Teams running MCP servers who do not want to operate a control plane | Teams with a platform squad that wants to self-host agent governance across frameworks |
PolicyLayer is hosted. You point your client at a gateway URL, with no Go services, NATS, Redis, or Kubernetes to operate.
You route AI clients through MCP servers and want a gateway built for MCP, with a tool directory, per-tool risk, and argument-level policy.
Deny a refund over a threshold or a DELETE without a WHERE clause, starting from recommended policy rather than authoring YAML.
Enforcement in minutes, with nothing to deploy, instead of standing up and running a control-plane stack.
Running the entire governance stack inside your own infrastructure is a hard requirement, and you have the team to operate it.
You run agents across LangChain, CrewAI, and other frameworks and want one control plane gating jobs across all of them.
Inspecting and modifying the source, under a source-available licence, matters to you.
They target the same instinct from opposite ends. Cordum suits teams that want to self-host a framework-broad control plane and have the platform capacity to run it. PolicyLayer suits teams that want hosted, MCP-native enforcement with nothing to operate.
Whatever your agents touch, the same engine, audit, and access model is doing the work underneath every rule you write.
Rules run as code, not model judgement: argument-level conditions, quotas, deny-by-default. The same call gets the same decision every time.
Writing policies →Your security or compliance team writes and attaches policy without ever holding the upstream credentials or grant tokens.
Roles →Every call is logged with its decision and the rule that fired, attributed to the identity, in an append-only record. Argument values are redacted, never stored.
Logs & security →Upstream secrets are encrypted at rest and injected by the gateway. The agent only ever holds a scoped token.
Logs & security →Every person and agent connects with its own scoped grant. Rotate or revoke any one of them instantly, without disrupting the rest.
Core concepts →Hosted gateway. Point your clients at it, register a server, issue a token. Nothing to install.
Quick start →Cordum is source-available under a Business Source Licence, with Community, Team, and Enterprise tiers. That is not the same as an OSI-approved open-source licence. PolicyLayer is a commercial hosted service.
No. PolicyLayer is hosted: you point your MCP client at a gateway URL with nothing to run. Cordum is self-hosted, deployed on your own infrastructure via Docker Compose or Kubernetes (a managed cloud service is in early access).
No. Cordum is framework-agnostic, governing agent jobs across LangChain, CrewAI, MCP, and others. PolicyLayer is MCP-native, with a gateway, tool directory, and per-tool risk classification built for MCP tool calls.
Cordum evaluates jobs and tools deterministically, but argument-level matching on tool-call parameters is not documented publicly. PolicyLayer evaluates the specific call and its arguments before it runs. Confirm current capability with each vendor.
Deterministic, deny-by-default policy on every MCP tool call: approval gates, per-identity scopes, argument-level rules, and a tamper-proof audit log. Route your existing MCP servers through the gateway, live in minutes.
Instant setup, no code required.