Sources and integrations
Bring anything the AI factory runs on, from wherever it comes from. Kronos Lab checks it on the way in and reports to the tools your teams already use.
Any model, any source
Same gates, wherever the model comes from
Open weights from Hugging Face, a fine-tune your team trained or a commercial API: Kronos runs the same four bands over every one of them.
- 01
Register the model
Point Kronos at any artifact: a local file, an S3 bucket, a Hugging Face repo or an OCI registry. Supply chain starts on intake.
- 02
Scan and sign
Malware, unsafe pickles and CVEs are checked, the ML-BOM is built, Cosign signs it and OPA decides whether it may serve.
- 03
Attach guardrails
Runtime policy is set once per model class and follows the model wherever it serves, whatever the runtime.
- 04
Keep the record
Every inference, policy decision and drift signal streams to the audit trail and your SIEM, from first request to retirement.
Supported model sources
Hugging Face Hub
Any public or gated model. Kronos fetches, scans and signs it before it reaches your cluster.
Your own fine-tunes
Models your team trained, in GGUF, ONNX, Safetensors or PyTorch format.
OCI and container registries
Pull from any OCI-compliant registry. Cosign signatures are verified on every pull.
NVIDIA NIM
Optimised inference containers from NVIDIA, with runtime guardrails bound at the serving layer.
Meta Llama
Every Llama generation and variant. The ML-BOM tracks the base model and each fine-tune made from it.
Commercial APIs
GPT, Claude and Gemini over their APIs. Guardrails wrap the call, inbound and outbound.
Any data source
Whatever feeds retrieval or training passes the data band first.
Object storage
Buckets and prefixes ingested as batches, each tagged with tenant and source before scanning.
Document repositories
PDFs, office files and exports from the systems your knowledge lives in, scanned and traced to a signed source.
Notebooks and uploads
Notebook files and runtime uploads, with active content detonated in a sandbox first.
Fine-tuning datasets
Signed manifests, recorded in the ML-BOM of every model trained on them.
Agents, skills and MCP servers
Treated as untrusted software until they clear the gates.
Agent packages
Scanned, given an SBOM and checked for provenance on every dependency.
Skills
Inspected for hidden instructions and injection payloads before they are registered.
MCP servers
Checked for identity, authentication and dangerous tool exposure. Reachable is not approved.
Also integrates with
Works with the tools you already have
Kronos extends your security stack to cover AI rather than replacing it. Telemetry flows to your SIEM, findings land in your tracker and policy lives where your team already works.
Security, analytics and DevOps
Splunk
SIEM telemetry over the HTTP Event Collector, in CEF.
Microsoft Sentinel
Log Analytics workspace ingestion through the CEF connector.
IBM QRadar
AI security events forwarded in LEEF format.
Elastic
Audit logs shipped to Elasticsearch for custom SIEM builds.
Jira
Red-team findings and policy violations opened as issues.
AI infrastructure
Milvus
The vector store behind the data band, holding ciphertext, not content.
NVIDIA NIM and Triton
Model serving with runtime guardrails attached at creation.
Open Policy Agent
Policy as code, enforced at every gate in every band.
Sigstore and Cosign
Keyless signing and verification for model artifacts.
The platform underneath
The fabric runs on what you already run.
Kubernetes platforms
SUSE Rancher, Red Hat OpenShift, Rafay and NVIDIA's AI platforms.
Serving
KServe, NVIDIA NIM and Triton, with guardrails bound when the endpoint is created.
Registries
MLflow for models and Harbor for images, with lineage back to source.
Identity and keys
SPIFFE and SPIRE for workload identity; your own HSM or KMS for every key.