Call QoBot from your code and your agents, over a REST API or an MCP server. Your agents ask it security questions, hand it questionnaires and check a risky change before they make it. QoBot answers like a CISO, with sources, and sends what needs a decision to a named person. The API is in preview and comes with the waitlist.
API and MCP server in preview · Free desktop app, on your own AI
Hi, I'm QoBot. You're joining the waitlist, and a few quick questions help me get ready for you.
You're a company, right? And how many people work there?
Fernway's IT-ops agent gets a ticket asking to turn off MFA on an account. Before it acts, it asks QoBot. The verdict: needs a human, with a safer option and Inès, the IT lead, as approver.
Agents used to answer security questions from the model's memory, from hard-coded rules, or by escalating everything to a human. Now they can ask a CISO.
Fluent answers, with no sources and no idea of your actual setup.
Plausible answers you can't defendChecklists and prompts your team maintains for every framework and customer.
Your engineers' time, foreverEvery security question goes to a person who answers by hand.
A human queueQoBot answers with sources, flags what it can't confirm and routes decisions to a named human.
API in preview, with the waitlistOur agent gets asked security questions and makes things up.
Your agent asks a question in plain words. QoBot answers from your evidence and its CISO knowledge, cites each source and returns what it can't confirm as an open point, with the person who can.
Customers ask our AI product to fill in their security questionnaires.
Your agent sends the file. QoBot drafts the answers from your approved library and sends back the questions only a person can answer.
Our agent is about to grant an admin role. Should it?
Your agent describes the change before it makes it: an admin role, MFA turned off, a bucket opened to the public. QoBot checks it against your policies and answers with a verdict and its reasons. A "needs a human" goes to a named approver, and your agent waits for the decision.
The agent API and MCP server are in preview and come with the waitlist. No public docs yet.
One schema defines every operation, so your code and your agents get the same answers either way. Docs come with access.
POST /v1/ask for a question, POST /v1/tasks for longer work: a questionnaire, a policy, a check before a change. Long work returns a task right away; follow it by polling or a stream, or get a webhook.
The same operations as MCP tools (qobot_ask, qobot_run_skill, qobot_get_task), for Claude, Cursor or your own agent runtime.
Design goals: structured JSON, stable IDs, an explicit status, errors that say how to fix the call, idempotency keys on every POST, a versioned /v1.
The desktop app is designed to serve QoBot over MCP on your machine, so Claude Desktop, Cursor or your own agents talk to your local QoBot and your security data stays there. QoBot Cloud runs the same operations as a hosted API, with keys scoped per workspace.
QoBot answers what it can back with sources. A decision that needs judgment, a signature or an exception goes to a person.
Each kind of decision goes to the person you named for it, with QoBot's reasons and, when there is one, a safer option.
In a workspace, a "needs a human" verdict comes with a task. Your agent follows it by polling, a stream or a webhook, and acts once the person has decided.
Each answer, verdict and approval is logged: which agent asked, who decided, and why.
QoBot never invents evidence. It tells your agents what it knows, what it assumes, and when a person, an auditor or a lawyer must step in.
For years, Qontrol has helped vCISOs and companies run their cybersecurity. QoBot puts that know-how into an AI CISO your agents can call. Articule SAS, Paris.
QoBot runs on your Claude subscription or an API key from Anthropic, OpenAI or Mistral. You pay your AI provider directly.
Design partners describe their agents and the changes they want checked. Their cases decide the first verdicts, MCP tools and docs.
The agent API and the MCP server are in preview and come with the waitlist. There are no public docs yet. Tell us your use case when you sign up, or write to us to become a design partner.
Security and compliance questions, answered with sources; questionnaires, policies and reviews, handed over as tasks; and a check before a risky change, such as granting an admin role or turning off MFA, answered allow, deny or needs a human.
In a workspace task or thread, QoBot keeps it in a defined waiting state, "needs a human", until the approver decides; your agent follows it through the task's stream, polling or webhook. Nothing changes on a timer: no timeout, no expiry, nothing approves itself. A one-off call without a workspace just returns the verdict "needs a human" with who should decide and why, and your agent takes it from there.
Your own: a Claude subscription, or an API key from Anthropic, OpenAI or Mistral. You pay your AI provider directly.
The desktop app is free on macOS, Windows and Linux, on your own AI. Paid plans come later: Cloud (QoBot always-on, hosted in France) and Team (several people, roles, shared approvals). No prices yet, for the API either.
With the desktop app, on your computer: your security workspace is a folder on your machine, and data goes only to your own AI provider, or wherever you approve. QoBot Cloud, hosted in France (OVHcloud), is opt-in. More: where your data goes.
QoBot answers, checks and drafts. Your agents and your people make the changes, and decisions that need a person go to a named approver.
Join the waitlist and tell us what your agents need. The API comes with it.
About a minute · unsubscribe in one click