NeuralQ Platform
Agents are about to start acting. Someone has to be able to prove who let them.
India built the best public digital infrastructure in the world for people. UPI, ONDC and DigiLocker all assume a human at a screen, tapping to consent. The next user of those rails is an agent acting on someone’s behalf — and at that moment one question becomes load-bearing: on whose authority did it act, over what data, and who can prove it afterwards?
Nothing answers that today. Frameworks build the agent. Observability watches it. Nobody stands in the path of the action with the authority to say no. That layer is what we build. The reasoning behind it is in /engineering; the beliefs underneath are at /beliefs.
The interception point
The Model Context Protocol is how agents discover and invoke tools. Because every tool call passes through it, MCP is the right place to enforce governance — policy can apply there without modifying the agent or the systems behind it. Governance stops being something each application reimplements badly and becomes infrastructure.
Our founding constraint, and the one that decides most design arguments: MCP is a transport, never a bypass. Our MCP server holds no privilege of its own. It forwards the calling client’s own token, so an agent is subject to exactly the checks its principal would face in a browser. An agent cannot reach anything its principal could not. Audit is unconditional — there is no flag that turns it off.
Credentials for the public rails are the opposite case: they belong to the company, not to whoever holds the MCP client. So they live in a second, separate server, in its own process, on its own port, bound to localhost, holding no mock mode. A tool either reached the real rail or raised an error naming the exact configuration it still needs. A developer console that can quietly return a fabricated UPI or KYC response is worse than one that does nothing.
What one tool call passes through
The governance argument is easy to make abstractly and easy to fake concretely, so here is the whole path. An agent asks to do something; five things happen in this order, and the order is the design.
Identity
The client presents its principal’s own token. The server mints nothing and holds no standing privilege, so there is no identity to escalate to.
Policy
The requested tool, the arguments and the tenant are checked against what that principal is allowed to do. A denial is an error the agent can read, not a silent empty result.
Call
The adapter talks to the real system with the forwarded credential. There is no mock path to fall back to, so a missing configuration surfaces as a named error instead of a plausible answer.
Provenance
Anything returned for a model to reason over carries the source it came from, down to the span. Text without a citable origin does not leave the boundary.
Audit
Principal, tool, arguments, decision and outcome are recorded on every path — allowed, denied or failed. There is no flag that turns this off.
The expensive property here is the last one. Audit that can be disabled for convenience is audit that will be disabled on the day it matters, so it is not configurable.
What this is not
A platform defined only by what it includes eventually claims everything. These are the boundaries we hold, and each one is a decision rather than a gap we intend to fill later.
It is not an agent framework. We do not want to own how you build the agent, and an agent built elsewhere should be governable here without being rewritten. Standing at the tool boundary is what makes that possible.
It is not observability. Tracing tells you what an agent did after it did it. That is necessary and it is not the same as being in the path with the authority to refuse. We would rather deny one call than explain a thousand.
It is not a credential custodian for end users. The platform forwards a principal’s token; it does not accumulate one. The only credentials it holds are the company’s own rail credentials, which is exactly why those live in a separate process bound to localhost rather than beside user traffic.
It is not a model. We train nothing and host nothing. Model choice is configuration, and it is meant to change without any call site knowing.
India’s public rails
None of these networks publishes an MCP server. They expose ordinary HTTPS APIs with India-specific authentication, so the adapters are ours. Status below is deliberately precise: built and tested is not the same as live, and each of these needs credentialed access that is granted, not bought.
UPI
Collect requests, intent links, VPA validation, refunds, and signed webhook verification. NPCI does not issue endpoints directly to application developers, so production access runs through a payment aggregator or sponsor bank.
ONDC (Beckn)
Ed25519 request signing and verification in both directions, the full search / select / init / confirm / status cycle, and a callback sink. Signing conformance is covered by tests rather than asserted.
DigiLocker
OAuth 2.0 through Meri Pehchaan, issued-document listing, document fetch, and eKYC. Consent stays with the citizen; we hold no document we were not handed a token for.
Startup India, MSME Udyam and GeM are not on this list because there is nothing to wrap: none exposes a public developer API. We would rather say so than imply coverage we do not have.
Answers that can be checked
Governing what an agent does is half the problem. The other half is what it claims. Retrieval that returns fluent text with no provenance is tolerable in a marketing tool and disqualifying in a bank, a hospital or an insurer.
So the retrieval layer preserves provenance to the source span, combines hybrid scoring with graph evidence, budgets context deterministically, and defends against cross-tenant results as a tested property rather than a promise. It is built to abstain — to decline when the evidence is insufficient instead of producing its most plausible guess.
Abstention is the hard part, and not for the reason people expect. Standard benchmarks reward fluency and penalise refusal, so measuring whether a system correctly declines means building the evaluation methodology alongside the system. We intend to publish it.
The substrate underneath
Governance is only credible if the thing enforcing it can outlive its vendors. So every external dependency — language model, speech, storage, queue — sits behind an interface with exactly one place that maps configuration to an implementation. Adding a provider is a new module and a new branch, never a change to the call sites that use it.
The same rule pushed us away from infrastructure we could not afford to operate honestly. The work queue is Postgres rather than Kafka, because a queue we can reason about at 3am beats one we run because it is expected. The stack is polyglot for domain reasons rather than fashion. Both decisions, with the numbers, are written up in /engineering.
The uncomfortable version of this rule: it costs more up front, every time. We think that is the right trade for a layer whose entire value is that it still works when something underneath it is replaced.
How to check any of this
Everything above is a claim, and claims about governance are worth what you can verify. Four things are checkable without talking to us.
Run the rail server without credentials: every tool raises an error naming the configuration it needs, because there is no mock mode to fall through to. Read the status line on each rail above: built and tested means the adapter and its tests exist, not that we have production access. Watch what a denial returns: a readable refusal, never an empty success. And live service state is published continuously at /health rather than asserted here.
The one claim we cannot yet hand you is abstention quality, because the measurement does not exist to borrow. We are building the evaluation alongside the system and we intend to publish the methodology, not just the score.
Why a practice product sits on top of it
Swaya is NeuralQ's AI communication coach: you rehearse an interview, a pitch or a difficult conversation, and get private feedback you can act on. It is also the first governed agent running on this platform, and it was chosen deliberately.
Coaching feedback has to cite the exact moment in a transcript that justifies it, which is the same provenance-preserving retrieval the verification layer provides. It handles private personal recordings, which forces tenant isolation and audit to be real rather than planned. Building the platform against a live product instead of a demo is why the constraints on this page are enforced in code rather than described in a diagram.
Service status is public at /health. If you are evaluating this for a pilot, or you operate a rail and want to talk about credentialed access, /talk-to-team reaches a person.