127.0.0.1 labs // sentinel signal
// dev by Chris
// observability for the agent era

The sky is cluttered
with airplanes
and escaping data.

Both obscured by clouds, in every sense of the word.

Airplanes get safety systems and control towers.
Data, mostly, does not.

We bring target visibility to the ground —
the control tower your machines never had.

[01]

// the premise

Every modern endpoint runs at least one autonomous agent. Claude. Copilot. ChatGPT. Cursor. They have access to your files, your keychain, your network. They act on your behalf — usually without asking, usually without telling.

In 2025, 88% of organizations had an AI-agent security incident. Only 21% had real visibility into what their agents were doing. 1,800+ publicly exposed MCP servers run with no authentication, and 66% of scanned MCP servers carry security findings.

// sources: Gravitee · Akto · Red Hat · AgentSeal

The instinct in this industry is to push observability up — into the cloud, into central platforms, into someone else's logs. We think the opposite. We think the only place where agent-behavior is actually observable is at the endpoint, before it leaves the box.

[02]

// the position

127.0.0.1 labs builds local-first sentinels. The address is the metaphor: data stays here. Classification happens here. Decisions about what crosses the boundary are made here.

We don't stream raw HTTP to a SaaS-LLM and pray for compliance. We don't ship telemetry to anyone. We don't run cloud-side models that need to see your secrets to be useful.

Watch. Classify. Gate. Sovereignty as architecture, not as marketing.

[03]

// the language

Our visual and behavioural grammar is Sentinel Signal — the way severity wants to be rendered when nothing is decorative. Cyan for active scanning. Amber for warning. Coral for critical. Green for clear. Black for the medium itself.

Every glyph is evidence. Every motion is a heartbeat. Density is honesty. Restraint is respect. You will see it everywhere we build — from a menubar pulse to a SOC-floor dashboard.

[04]

// the products

  • rAIzr runtime-aware AI zero-trust response The endpoint observer. Per-process attribution at kernel level.
  • Mimir multi-source intelligence monitoring & incident response The intelligence layer. SecOps + OSINT, 100% local.
  • — more to come when the next gap appears …and it always does.
Enter the lab