Products

The platform, then the catalog

ENI6MA replaces reusable credentials with one-shot, request-bound proofs, so a stolen secret is not a stolen capability.

PKI and tokens prove who may speak for a while. ENI6MA envelopes prove that this message may change the world once.

Try the Demo Capabilities See pricing

Capabilities by audience

Cloud estates, AI agents, and live humans share one proof family. Private synonym maps for people; compiled twins and envelopes for machines (Gate and burn-before-validate underneath).

Cloud

Gate in front of APIs and workforce endpoints. Keep PKI; replace reusable tokens.

Open →

Agent

MCP chooses the tool; ENI6MA decides whether the world may change for this call.

Open →

Human

Pass+ Private Synonym Map: prove knowledge without broadcasting a reusable secret.

Open →

Full capabilities page

Four planes

The site is organized around four product names, not repository names. Foundry manufactures identity. Control manages lifecycle and nonces. Gate enforces at the request boundary. Verify attacks the Gate so you can see what holds.

Manufacturing plane

Foundry

Mints cohort zips of per-identity circuit binaries. Licensed appliance; air-gappable.

Open Foundry →

Control plane

Control

Registry, durable nonce ledger, and visibility. Activate, revoke, reserve, burn.

Open Control →

Enforcement plane

Gate

The flagship. Proxy, SDK, MCP wrapper, and sidecar on the roadmap. Runs the eight-stage order.

Open Gate →

Developer surface plane

Verify

Customer-runnable attack suite against your Gate. Prove the mechanism before you buy.

Open Verify →

Foundry ships cohort material to Control. Control activates and revokes for Gate. Gate emits burn events and access logs back to Control. Verify and the Reference Kit integrate against Gate.

Eight-stage gate order

Every untrusted request hits this fixed sequence before application logic runs. Stage 5 (burn before validate) is why replay fails.

Recompute the request hash
The gate hashes the body it actually received and compares it to the envelope.
Rejects: A body that was altered after the proof was made.
Check endpoint and policy
The envelope names the endpoint and the policy it was made for; both must match this route.
Rejects: A valid proof relayed to a different endpoint.
Confirm the circuit is active
The handle is resolved against the registry and must be active. Deactivating a handle is how revocation happens.
Rejects: A proof from a revoked identity.
Check freshness
The envelope timestamp must fall inside the freshness window configured for the route.
Rejects: A captured envelope replayed after the window closed.
Burn the nonce
The nonce is spent here, before the proof is validated. Every submission spends it, including one that is about to fail validation.
Rejects: Any second use of the same envelope. This is where replay dies.
Validate the proof
Only now is the proof itself checked, against the local binary or the registry. Both modes are equivalent at the envelope layer.
Rejects: A forged or malformed proof.
Apply application policy
Ordinary authorization runs in the post-proof zone: arguments, limits, and business rules.
Rejects: A well-proved request asking for something it is not allowed to ask for.
Serve the request
The application does its work, and the response is bound back to the request that earned it.

The Control ledger reserves and burns nonces before proof validation, so every submission spends the nonce.Shippingledger-service reserve/response/commit with NONCE_TTL_SECONDS 300.Holds under the reference architecture

ENI6MA Gate is the enforcement plane: it runs the eight-stage check order at the request boundary before application logic executes.Shipping

Absolute mechanism claims hold under the reference architecture.