Roadmap & milestones

The authoritative, always-current source is ROADMAP.md.

Shipped so far

Milestone	Focus	Status
M0 Skeleton	transports, auth, passthrough	done
M1 Contain	sandbox, broker, egress, IMDS	broker/egress done; sandbox CI-gated
M2 Decide	policy, limits, breakers, audit	done
M3 Trust	pinning, rug-pull, poisoning	done
M4 Translate	OpenAPI, facade, tokens	done (gRPC deferred)
M5 Operate	metrics, migrations, HA	done (OTLP exporter deferred)
M6 Endure	WIT ABI, conformance, 1.0	ABI + conformance done; WASM host deferred

Beyond 1.0 — the open platform

Everything below is Apache-2.0. Per Directive #3 and our governance rule, anything a company needs is built in the open, or not at all. These are capabilities, not a paid tier.

Observability & response

• Web console — a read-only-by-default UI over live traffic, the audit trail, per-tenant metrics, and the capability catalog. It proposes config diffs; it never holds authoritative state (config stays in files).
• Anomaly detection — behavioural baselines per (tenant, principal, capability) that flag the unusual: volume spikes, brand-new destinations, argument-shape drift, off-hours access, sudden spend.
• Alerting — first-class routes to Slack, PagerDuty, Opsgenie, and webhooks on policy denials over a threshold, circuit trips, rug-pull / poisoning hits, budget breaches, audit-chain verification failures, and sandbox escape attempts.
• Fleet kill switch — one command (or one tap from your phone) pauses tool execution across every gateway in the org, instantly. Contain the blast radius first, investigate second.
• Session forensics & replay — reconstruct exactly what a principal did and what a compromised tool could have reached, with the signed audit chain as the source of truth.

Governance & scale

• Policy-as-code / GitOps — versioned policy bundles with staging, canary rollout, diff review, and instant rollback; policy test against recorded traffic before you ship a rule.
• Approval workflows — human-in-the-loop gates for high-risk capabilities and rug-pull re-approvals, fully audited, approvable from Slack or email.
• Cost & usage analytics — per-team token/request accounting, budgets, and chargeback reports.
• SIEM & OpenTelemetry export — stream the signed audit chain and metrics to Splunk, Datadog, Elastic, S3, and OTel collectors, with tamper-evident chain proofs.
• Open threat-intel format — a signature format for poisoned tools and known-bad MCP servers, so anyone can publish and consume feeds.
• Delegation & agent-to-agent — richer delegation-chain policy, per-hop budgets, and provenance across multi-agent call graphs.

portcullis Cloud — the business model

How this stays free

The gateway is, and always will be, Apache-2.0 with no feature paywall. We monetize the way durable open source does — hosting, operations, curated data, and people — never by locking capabilities. Everything a company needs is in the open; the Cloud is convenience, scale, curated intelligence, and expertise.

Managed gateway

Zero-ops hosted portcullis with SLAs, managed upgrades, multi-region, and autoscaling. A bring-your-own-cloud option keeps all data in your account.

Managed threat feed

Continuously curated, signed signatures for poisoned tools and known-bad MCP servers, plus hosted prompt-injection models that beat the built-in heuristics. The format and the consumer are open; the curation is the service.

Compliance pack

One-click SOC 2 / ISO 27001 evidence, tamper-proof audit archival with legal hold, and auditor-ready reports generated from the hash-chained log.

Red-team-as-a-service

Scheduled, real-kernel escape attempts against your sandbox configuration, with findings, severity, and regression tracking over time.

Fleet control plane

Centralized policy, secret rotation, and capability approvals across many gateways and teams — with SSO/SCIM and org-level RBAC.

Support & response

24/7 incident response, security advisories ahead of public disclosure, and architecture review from the people who built it.

The split is deliberate: security controls are never the upsell. If it keeps you safe, it’s in the binary, for free. The Cloud sells the operational burden you’d rather not carry.