Sold by: Marquor
Deployed on AWS
Marquor is a runtime security and governance platform that controls what autonomous AI agents are authorized to do across cloud, SaaS, APIs, and enterprise tools.
Overview
Marquor is a cloud-neutral, API-first runtime security and trust platform for autonomous AI agents. It provides organizations with an independent control layer for discovering agents, governing delegated authority, enforcing runtime policy.
Highlights
- AI Agent Security - Discover and govern autonomous AI agents at the tool-call boundary without inspecting or storing sensitive customer payloads, helping reduce data exposure, privacy, and compliance concerns.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
Kubernetes (Amazon EKS) - Helm
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Launch Edition( Govern+Discover) | Up to 25 governed agents, 3 enforcement GW points. | $0.001 |
Platform Edition( launch included+Posture+Assure) | Up to 75 governed agents, 6 GW enforcement points. | $0.001 |
Complete Edition(Platform +Detect) | 150 governed agents, 12 GW enforcement points, all engines. | $0.001 |
Enforcement Point Pack | Adds 3 enforcement points (AgentShield gateways) to any edition. | $0.001 |
Adjudication Pack | Automated adjudication analytics for one venue. Regulated FS only. | $0.001 |
Automated Decisions | Adjudication decisions, per 1,000. Regulated financial services only. | $0.001 |
Compliance Regime | One compliance framework crosswalk with signed evidence bundles. | $0.001 |
Sealed Engine | Self-hosted or VPC-isolated sealed enforcement engine deployment. | $0.001 |
Additional Tenant | One additional isolated tenant organization on the control plane. | $0.001 |
Premium Support + TAM | Named technical account manager and 99.95% availability SLA | $0.001 |
Dimensions summary
Pricing starts with three stacked editions. Launch Edition covers up to 25 governed agents and 3 enforcement gateway points. Platform Edition adds capacity and posture features. Complete Edition adds detection and all engines. From there, you add capacity or capability packs to any edition: extra enforcement point packs, adjudication analytics and per-1,000 automated decisions (regulated financial services only), compliance framework crosswalks, self-hosted sealed engines, and additional isolated tenants. Premium Support + TAM adds a named account manager and a 99.95% availability SLA. Editions set your baseline; packs and add-ons scale it.
Top-of-mind questions for buyers
A governed agent is an AI agent whose authority Marquor certifies and enforces. Each agent identity counts once against your edition limit. Launch covers up to 25, Platform up to 75, and Complete up to 150 governed agents.
Each edition includes a set number of enforcement gateway points, where agent actions are checked in real time. When you need more, add an Enforcement Point Pack. Each pack adds 3 AgentShield gateway points to any edition, on top of your baseline.
Both apply only to regulated financial services. The Adjudication Pack covers automated adjudication analytics for one venue. Automated Decisions bills separately per 1,000 adjudication decisions processed. The pack sets up the analytics capability; decision volume drives the per-1,000 charge as usage grows.
marquor.io
Helpful?
Vendor refund policy
Contract fees are charged in advance for the full term and are non-cancellable and non-refundable, except as stated below or required by law. Unused agent, enforcement point or decision capacity does not carry over and is not refundable. If Marquor cannot be successfully deployed in your environment within 30 days of purchase and we are unable to remedy it, we will refund the unused portion of the term on a pro-rata basis. Refund and billing requests: support@marquor.io .
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Kubernetes (Amazon EKS) - Helm
Supported services: Learn more
- Amazon EKS
- Amazon EKS Anywhere
Helm chart
Helm charts are Kubernetes YAML manifests combined into a single package that can be installed on Kubernetes clusters. The containerized application is deployed on a cluster by running a single Helm install command to install the seller-provided Helm chart.
Version release notes
Marquor Runtime Security - Enterprise 1.1.0 - initial Enterprise release.
Runtime least-privilege enforcement, tamper-evident receipts, and default-deny egress control for AI-agent tool calls, with AWS Marketplace entitlement verification.
Everything in the Trial listing, plus:
- AWS Marketplace entitlement verification via license-manager:ListReceivedLicenses, a non-consuming read that can never draw down purchased quantities.
- Edition and enforcement-point capacity discovered from the granted license. Subscription changes reach running gateways on the next check, with no redeploy.
- Default-deny egress enforcement with signed egress observations in the ledger.
- Fail-closed entitlement: /mcp and the egress proxy answer 402 Payment Required until a subscription is verified. A bounded grace window keeps a verified gateway serving through a transient AWS outage, then closes.
Unchanged from Trial. Single-writer ledger (the chart refuses to render above one replica), fail-closed configuration loaders, persistent /data required, payload-free evidence: the ledger records declared metadata, never tool-call content.
Multi-architecture image supporting x86-64 and AWS Graviton (arm64) on Amazon EKS, EKS Anywhere, and self-managed Kubernetes. Runs as a non-root user on a minimal base image.
Additional details
Usage instructions
-
Prerequisites. A Kubernetes cluster (EKS 1.25+ recommended), an OIDC issuer your agents authenticate against, and a StorageClass supporting ReadWriteOnce.
-
Provide four OAD documents. identity.yaml (issuer/audience/JWKS; PUBLIC keys only), policy.yaml (the global default-deny floor), and per agent a dossier manifest plus a clearance allow-list. Every loader is fail-closed: the gateway refuses to boot on anything invalid, and a verified-but-uncertified caller gets deny-all.
-
Install. Set upstreamUrl to your MCP server and supply the OAD documents. The chart mounts them read-only from ConfigMaps and the admin token from a Secret. The chart ships with inert placeholder defaults so it renders out of the box: an unconfigured install denies everything and reaches nothing. Replace upstreamUrl and the identity document before expecting it to serve traffic.
-
Two constraints the chart enforces by refusing to install:
- Exactly one replica. The gateway is single-writer: one Ed25519 signing key, one hash-chained traces.jsonl, one ReadWriteOnce volume. Two replicas fork the chain into branches signed by different keys, destroying tamper-evidence silently. The Deployment strategy is Recreate, never RollingUpdate.
- Persistent storage is required. /data holds the signing key and the ledger. Losing it restarts the chain under a new key.
-
Verify. GET /healthz returns {"status":"ok"}. Point your agents at the gateway's /mcp endpoint - no agent code changes are required. Start in monitor mode, review the receipts, then switch to enforce.
-
Entitlement (Enterprise only). This listing verifies your subscription before it serves traffic.
- On Amazon EKS, the gateway's ServiceAccount "marquor-gateway" must carry an IRSA role annotation granting license-manager:ListReceivedLicenses, and the cluster needs outbound access to license-manager.<region>.amazonaws.com. Set the annotation with: --set serviceAccount.annotations."eks.amazonaws.com/role-arn"=<your-role-arn>
- On EKS Anywhere or self-managed clusters, generate the license Secret from the AWS Marketplace console; the licenseSecretName Override Parameter is populated automatically.
- Entitlement is a READ (ListReceivedLicenses), never a checkout, so verification can never draw down purchased quantities.
- Until a subscription is verified the gateway fails closed: /mcp and the egress proxy answer 402 Payment Required. A verified gateway that later loses contact with AWS keeps serving through a bounded grace window and then closes, so a transient AWS outage is not an immediate outage for you. Service resumes automatically on the next successful check.
-
What your license controls. Edition (mq_launch, mq_platform, mq_complete) and enforcement-point capacity (mq_gw_pack) are read from the granted license, never configured in the chart. Adding dimensions to your subscription reaches already-deployed gateways on the next check with no redeploy.
Support
Vendor support
Marquor provides technical support for product onboarding, deployment, configuration, integrations, policy setup, runtime enforcement, and troubleshooting.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Marquor is a payload-free runtime security and governance platform that controls what autonomous AI agents are authorized to do across cloud, SaaS, APIs, and enterprise tools.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.