Now in Private Beta
Private AI agents on infrastructure you control.
Kovalent deploys agents across your cloud, edge devices, and private nodes, linked by an encrypted mesh. The model, its knowledge, and your data stay on your nodes; Kovalent runs only the coordination that connects them.
Who it is for
AI infrastructure for teams that cannot use shared black boxes.
Kovalent runs the coordination for you, while your sensitive work stays on infrastructure you control, not on another provider's servers.
Regulated and security-sensitive workflowsRun agents near private code, infrastructure, documents, and operational data without routing raw context through a shared AI platform.
Private nodes across cloud and edgeRegister laptops, dedicated cloud instances, private clusters, or customer-controlled networks as verifiable peers in one encrypted mesh.
Coordination is managed, computation is yoursKovalent coordinates identity, routing, and lifecycle. The model, its knowledge, and the agent runtime run on the nodes you choose.
Model support
Run frontier or open models, without lock-in.
The model is just one of the parts you control. Route to hosted frontier models or run open-weight models on your own nodes, and swap providers without re-architecting your stack.
How it works
Kovalent runs the control plane. You own your nodes.
An agent is really several parts: the model, its knowledge base, and the runtime that puts them to work, plus the coordination that ties them together. Kovalent runs only the coordination. The model, its knowledge, and the runtime stay on nodes you own, so computation stays with you and only the coordination is managed.
Register a NodeActive
Connect a machine, cloud instance, or private cluster as a cryptographically identified peer.Attach KnowledgeActive
Store embeddings and retrieval context on your node, next to the data source, instead of in a shared vendor runtime.Route Over MeshActive
Send work over P2P WireGuard paths without exposing raw data through the control plane.Run AgentsActive
Execute reasoning, retrieval, and tool workflows inside isolated node runtimes.Audit MovementIn Beta
Stream lifecycle metadata so operators can see routing and collaboration without inspecting payloads.Extend SafelyNext
Bring private APIs, storage, and future tool runtimes into the mesh behind customer-controlled policy.Deployment options
Start managed, move closer to your data.
Managed CloudIsolated pods for quick onboarding and developer evaluation.Fast Start
Dedicated CloudSingle-tenant compute provisioned for production workloads.Private Node
Edge NodesCustomer devices and private servers joined through Knaix.BYOD
Customer TailnetEnterprise nodes mapped into your existing network perimeter.BYOT
Hub-and-Spoke Topology.
Kovalent handles coordination, not computation. You choose which nodes run your AI, and Kovalent manages the identity and routing that let them find each other, while inference and data stay on infrastructure you control. Those nodes connect directly over an encrypted private network built on standard WireGuard, so Kovalent coordinates the mesh without ever seeing the data that moves across it.
Control Plane (Coordination)
We handle SSO identity, Tailscale ACLs, and node discovery. The control plane issues routing directives but never touches your raw data streams.Data Plane (Inference Nodes)
Agents run on isolated hardware (such as dedicated EC2 instances). Connecting a new peer via knaix login initiates direct NAT traversal for low-latency inference.Zero-Trust Architecture
Every node is assigned a cryptographic identity. A deny-by-default firewall ensures that nodes only accept traffic from authorized peers within the mesh.NEW - DISTRIBUTED INTELLIGENCE
From a secure mesh to a collaborative one.
Your nodes don't just share a network. They share intelligence. Each node keeps its own model and knowledge. Inside a Tenant Mesh, agents discover one another, route each question to whichever node owns the domain, and synthesize answers together. No raw data ever leaves a node; only the answer travels.
Relevance-based discovery
Every node publishes a domain manifest. The orchestrating node scores its peers and delegates only to the best match, never a blind broadcast.Map-reduce consensus
Premium nodes synthesize answers and return a compressed result, so raw chunks never cross the mesh and the token cost of querying it drops.Real-time mesh telemetry
Watch every hop as it happens. Peer selection, federated search, and synthesis stream live to your console. Metadata only; we stay blind to your data.COMING SOON TO TEAM & ENTERPRISE
Deploy your fleet.
A general-purpose model handles most of what your team asks. Specialized work deserves specialized models. Pick purpose-specific models for image generation, document extraction, and storage optimization, deploy them across your nodes, and swap or upgrade each one as your needs change. Every fleet model runs inside your boundary: on your nodes or under your own cloud identity, never through a shared platform runtime.
Curated model catalog
Every catalog entry clears the same provenance and license review as the models the platform ships with today. The right tool for each workload, vetted before it reaches your mesh.Swap and upgrade in place
Pin a version per workload, upgrade on your schedule, and roll back in one step. Your agents keep working while the models underneath them change.Specialist routing, general fallback
Requests route to the specialist you deployed for that job. Everything else falls back to your general-purpose model, so the fleet grows at your pace without breaking anything.NEW
The Knaix CLI/nɑks/ Rhymes with "knocks"
Deploy and manage nodes directly from your terminal. Provision securely, connect instantly, and let the Mesh handle zero-trust networking without complex configuration.
Developer First
- Node Auth
SSO login for your machine. Your key, your private mesh. - Node Bridge
Hardware becomes a trusted peer for local inference. - Skill Orchestration
Trigger reasoning skills on your isolated local data.
Secure by Design
- Zero-Trust Network
No inbound firewall rules. The CLI tunnels out securely. - Ephemeral Operations
Logs and sessions do not leak. Nothing caches centrally.
# Install the Knaix CLI
$ curl -sSL https://knaix.com/install.sh | sh
Info: Starting Knaix SSO Login...
Opening browser: https://app.kovalentai.com/cli-auth...
✓ Successfully logged in!
Info: Synchronizing with private mesh..
⠋ Requesting compute...
⠼ [BUSY] Booting kernel for claude-e146c33e46...
✓ Node claude-e146c33e46 provisioned successfully.
● Memory | Node: claude-e146c33e46
Use `knaix memory --file <filename>` to read a file.
_knaix_durable_memory.md
_knaix_ephemeral_log.md
● Knaix AI Session: claude-e146c33e46 (Type '/exit' to end)
knaix [claude-e146c33e46]> /remember Create an ingress gateway routing rule.
Intent recognized: Create an ingress gateway routing rule.
✓ Explicit memory securely stored and available across sessions.
Security & governance
Ready for your security review.
Every deployment starts from one guarantee: the control plane coordinates identity and routing, and never sees your prompts, your documents, or your model traffic. Here are the controls behind that, what runs today, and what each tier adds.
Available now
Content-blind control plane
Kovalent coordinates identity, routing, and lifecycle. It never sees your prompts, documents, or model traffic.
Available now
Per-tenant inference identity
Model calls run under your own cloud identity and quota, never a shared platform key.
Available now
Encrypted peer transport
Nodes connect directly over WireGuard (Curve25519). Traffic flows peer-to-peer, not relayed through us.
Available now
Deny-by-default mesh
Every node carries a cryptographic identity and accepts traffic only from peers you have authorized.
Personal+
Your knowledge stays on your node
Documents and chat history live in your own node, and the ranking that reads them runs there too. Data residency by architecture, not by policy.
Professional+
Dedicated hardware isolation
Professional and above run on dedicated single-tenant instances with kernel-level isolation, not shared pods.
Professional+
Bring your own network
Map nodes into your existing Tailnet under your own identity provider and ACLs, or peer them into your VPC.
Enterprise
Air-gapped operation
Enterprise nodes can run inference locally with no external model calls at all, for regulated or disconnected environments.
Planned
Audit, SSO, and compliance profiles
Audit logs, SSO and team administration, SIEM export, and regional data-residency profiles that attest which jurisdiction a workload ran in, for governed Enterprise deployments.
Preparing a security review? See what runs on each tier, see the architecture, or talk to us about compliance.
Positioning
How Kovalent compares.
Different approaches to private AI solve different problems. Here is where Kovalent fits and where it does not.
vs. vendor AI suites
ChatGPT Enterprise, Claude for Work, Copilot
Their privacy is contractual: your data stays in their infrastructure under their terms. Kovalent's privacy is architectural: per-tenant identity, a control plane that cannot see payloads, and nodes that run under your own cloud credentials. They centralize; we federate custody.
vs. central RAG platforms
Glean, enterprise search tools
Excellent when every team is willing to share one index. Kovalent starts where that willingness ends: teams that refuse the data lake, subsidiaries with residency constraints, and organizations where combining indexes creates a liability.
vs. self-hosted open source
Open WebUI, AnythingLLM, llama.cpp
Full sovereignty, zero product. No managed provisioning, no encrypted mesh, no cross-node federation, and a permanent ops burden. We deliver the same sovereignty posture with orchestration, networking, and retrieval built in.
vs. assembling it on AWS
Bedrock Knowledge Bases, SageMaker, glue code
A capable team can assemble the retrieval layer. They cannot cheaply assemble the federated mesh, the containment boundary, the per-tenant identity model, or the sovereign inference fallback. That integration surface is what Kovalent is.
Product status
What teams can use now.
Kovalent is in private beta. The homepage highlights the production path without turning the page into a full roadmap archive.
Available now
Private node orchestration
- Knaix CLI login and node lifecycle
- Encrypted mesh connectivity
- Control-plane identity and routing
In beta
Knowledge and inference
- Semantic knowledge base on your own node
- Citation-preserving RAG
- In-pod generation for private tiers
Next
Enterprise readiness
- SSO and team administration
- Audit and SIEM exports
- Regional data residency and compliance profiles
Planned
Deploy your fleet
- Purpose-specific model catalog
- Swap and upgrade deployed models
- Specialist routing with fallback