Kindo is an AI agent management platform: a registry of agents, policy inherited from the person who runs each one, spend by agent, owner and team, and an agent builder of its own. Smartflow enforces policy inline on every model call and MCP tool call routed through it, on the customer's own infrastructure, and records each decision. Both run on-premises and air-gapped. They diverge on who approves a paused action, whether an agent has a credential of its own, and what the record is built to prove.
The short version
Kindo is where a team builds, runs and pays for agents. It applies DLP and tool policy to traffic through its own APIs and MCP gateway. Smartflow governs calls on the request path, whatever produced them, and pauses an action when policy requires a person.
Deployment is a tie. The decision turns on three questions: who approves when policy says ask first, whether agents built elsewhere get the same approval, and what an examiner receives afterward.
Feature Comparison
| Capability | Smartflow | Kindo |
|---|---|---|
| Primary job | Runtime enforcement inline at the gateway, on every model call and MCP tool call routed through it. | An "AI agent management platform": a registry of agents with owners, policy for what each can reach, spend by agent and team, and an agent builder. |
| Enforcement point | The request path. Policy is evaluated before the prompt reaches the model and before a tool call executes. | Traffic through Kindo's own APIs and MCP gateway. Kindo says it "enforces policy as agents run, records each action." |
| Deployment | On-premises, air-gapped, Kubernetes-native. | Kindo cloud ("SOC 2 SaaS"), self-managed cloud, on-premises and air-gapped. |
| Content inspection | Inline content inspection: PII, prompt injection, output moderation. | DLP filters "run on every request and response," switchable per model. The MCP gateway "refuses to return content it cannot inspect." |
| When a person must decide | The action pauses as an approval ticket until someone with approval rights approves or denies it. With step-up, set per action, the approver re-verifies their identity before the approval counts. | Each user sets a policy per tool, with an organization default: Run automatically, Ask before running, or Block. Ask before running waits for "the user running the agent" to approve, and "is being rolled out gradually." |
| Agents built elsewhere | The same approval ticket covers tool calls through Smartflow's MCP gateway, including from Claude Code. | Approved external agents join "a common governance path." Under an organization setting of Ask before running, tools are hidden from external MCP clients and calls refused, "because external MCP cannot obtain Kindo approval." |
| MCP | MCP JSON-RPC gateway with tool caching, under agent identity. | An MCP gateway for Claude Code, Cursor, VS Code and other clients, on a Kindo API key. Each tool call rechecks organization settings. |
| Agent identity | AIDA issues a cryptographic credential to the agent itself, scoped and revocable independently of its launcher. | Inherited. An agent invoking a tool "uses a connection the running user is authorized to use, not the author." Cross App Access, in beta, uses an Okta-issued "short-lived, user-bound token." |
| Evidence | A record of each decision, bound to the human who owns the agent, hash-chained, time-stamped under RFC 3161 and written to your SIEM, with an optional write-once archive. | "Every action in Kindo is logged," approvals included, with a timestamp and the acting user. Logs export "as CSV from the admin UI." |
| Model routing and cost | Routing and failover across model providers, with caching. | Provider fallback, self-hosted models, and budgets, in beta, that can refuse requests at a monthly limit. Kindo-side response caching is not documented. |
| Regulatory frameworks | Examination packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act, generated from enforcement records. | Audit logging "ensuring compliance with" ISO 27001, GDPR and NIST CSF, and alignment with UAE NESA, SAMA and NCA ECC. Its AI Runbooks and integration pages say its data controls help customers stay compliant with HIPAA, ITAR and FINRA. SOX and the EU AI Act are not documented. |
Who approves, and when
Kindo puts approval at the tool. Each user sets a policy for each tool from inside a chat: run automatically, ask before running, or block. An organization default applies where a user has set none, and administrators decide which tools each user group can reach. With ask before running, execution waits for "the user running the agent" to approve, and approvals and rejections are logged. Kindo says the setting "is being rolled out gradually," shown only to enrolled organizations.
For an interactive session, the approver is clear. For unattended runs, Kindo's Budgets doc says a run started by a schedule, a webhook or an event from a connected integration "runs as the agent's creator," so its spend counts toward the creator's department. Neither that page nor the tool approval page says how an ask-first call is approved when no one is at the session. A buyer with scheduled agents should ask.
In Smartflow, an action that needs a person pauses as an approval ticket: pending until someone with approval rights approves or denies it, redeemed once when the action runs, and expired after 24 hours. With step-up, the approver re-verifies their identity first, and the record shows who decided.
Agents built outside the platform
Kindo manages agents it did not build. Its MCP gateway accepts Claude Code, Cursor, VS Code and any client that speaks Streamable HTTP, rechecks organization settings on every tool call, and applies the organization's DLP policy to results when gateway DLP is on.
The approval step does not extend to those clients. On the external MCP API, the organization setting applies and personal settings do not. Under Ask before running, tools are hidden and calls are refused, "because external MCP cannot obtain Kindo approval." The call fails closed, which is a safe default. For a sensitive tool used from an outside client, the paths Kindo documents are to let it run automatically, to use Kindo chat, or to rebuild the workflow inside Kindo.
Smartflow evaluates every MCP tool call routed through its gateway, and the approval ticket sits on that path. The Smartflow for Claude Code guide shows it for a client APERION did not build. The trade is coverage by routing: a call has to be pointed at the gateway, and commands Claude Code runs directly in a terminal do not pass through MCP.
Who the agent is, and what the record shows
Kindo's identity model runs through the person. An agent invoking a tool "uses a connection the running user is authorized to use, not the author." The homepage's CISO line puts it plainly: an agent can touch "Exactly what its operator can, and nothing more."
AIDA issues the credential to the agent itself, scoped and revocable independently of whoever launched it. An agent can be shut off without disabling an employee, and the agent is a party in the record.
The records serve different readers. Kindo logs every action with the acting user, a timestamp and structured metadata, and exports the log as CSV. Smartflow's records are hash-chained, carry RFC 3161 timestamps and are written to the customer's own SIEM, with an optional write-once archive. Examination packages for FINRA 3110, HIPAA, SOX and the EU AI Act are generated from those records. A firm whose next AI conversation is with an examiner should ask each vendor for a sample.
Where Kindo is strong
Kindo is the broader product for running agents, built for SecOps, DevOps and ITOps teams: chat, an agent builder, scheduled agents, memory and a tool catalog in beta. Kindo says more than 300 enterprises use Deep Hat, its own cybersecurity model, for red team operations. Deep Hat Sift, introduced October 28, 2026, decides which alerts, tickets and log events need a large language model, and runs inside the customer's environment, air-gapped included.
Cost is one of its three promises: tokens and spend by agent, owner and team, with budgets, in beta, that can refuse new model requests at a monthly limit. Its MCP gateway fails closed on content it cannot inspect. It matches Smartflow on deployment, from its SOC 2 Type II cloud to air-gapped. For a SecOps or DevOps team that wants one platform to build, run and pay for agents, Kindo is a strong choice.
When to choose Smartflow
- Approval on the request path: MCP tool calls routed through the gateway pause for a person when policy requires it, including calls from clients such as Claude Code
- An approver on the record: someone with approval rights decides, step-up re-verifies identity per action, and the record shows who decided
- Agent identity: a credential issued to the agent itself, revocable without touching the person who launched it
- Examination evidence: hash-chained records in your SIEM, and examination packages for FINRA 3110, HIPAA, SOX and the EU AI Act
Common questions
Can Kindo run on-premises or air-gapped? Yes. Kindo documents four deployment models: Kindo cloud, self-managed cloud, on-premises and air-gapped.
Who approves a tool call in Kindo? With ask before running, the user running the agent. The setting is being rolled out gradually and appears only for enrolled organizations.
Can an external MCP client obtain Kindo approval? No. On the external MCP API the organization setting applies, and personal settings do not. Under Ask before running, tools are hidden and calls are refused with manual_approval_required. Only Run automatically permits execution, and Kindo points users to Kindo chat when manual approvals are on.
Does Kindo give agents their own identity? Not as documented. Agents act through connections the running user is authorized to use. Cross App Access, in beta, gives outside agents an Okta-issued, user-bound token.
Is Kindo an AI gateway? Its FAQ says a gateway "sees traffic between agents, models and tools," and that Kindo "works alongside gateways and network security rather than replacing them." It runs its own APIs and MCP gateway for traffic sent through Kindo.
Related reading
Agent governance · Smartflow for Claude Code · Human-in-the-loop · Tamper-evident audit log · MCP security · Examination readiness · Air-gapped AI deployment · Smartflow vs. Onyx Security · All comparisons
Verified against each vendor's published documentation in November 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.
Kindo sources: kindo.ai, kindo.ai/pricing, kindo.ai/features and kindo.ai/integration/box; docs.kindo.ai/start/what-is-kindo, /features/governance, /features/models, /features/scheduled-agents, /admin/rbac-tool-actions, /admin/cross-app-access, /admin/budgets, /admin/security-controls, /admin/integration-trust-domains, /admin/faq, /apis/mcp/clients, /apis/mcp/scoping, /apis/mcp/dlp, /reference/tool-catalog and /deploy/prepare-ai-models; and Kindo's October 28, 2026 release on Deep Hat Sift.
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs