Your coding agents, running in your cloud with enterprise-grade security and control.

llmonade's cloud infrastructure runs in your AWS account. The control plane manages access and session lifecycle. The AI gateway handles model requests. Isolated MicroVMs run the agents, while your storage holds workspace files, conversation history, and session records.

Your organization controls the infrastructure, network policies, and data. Model requests pass through the AI gateway so you can control model access, track usage, and enforce budgets. The gateway connects to your approved model providers.

The developer front end runs locally and displays the agent's actual terminal UI from the cloud. Developers interact with Claude Code, Codex, or another supported agent using its familiar interface and keybindings. It looks and feels like a local session, with execution in your AWS account.

Developers authenticate through AWS IAM Identity Center using your organization's workforce identity. llmonade uses an AWS profile backed by temporary credentials to authorize access to their agent sessions and connect to the MicroVMs running them.

IAM Identity Center integrates with Okta, Microsoft Entra ID, Google Workspace, CyberArk, JumpCloud, OneLogin, and Ping Identity. It also supports Microsoft Active Directory as an identity source.

Your administrators assign access through AWS permission sets, with separate developer and administrator roles. Human SSO credentials stay outside the agent's MicroVM.

An agent can reach the resources allowed by its runtime identity and network policies. Each session runs in an isolated MicroVM with storage permissions scoped to that session. Model requests use the configurable AI gateway; approved tool connections follow your tool-access policies.

Traffic leaving the MicroVM is routed through your VPC. Security groups, subnet network ACLs, and routing control access to internal services and external destinations. We help your infrastructure and security teams configure access to the repositories, APIs, and model services your engineers need.

You can configure advanced traffic inspection along that network path. VPC Flow Logs show connection metadata and accepted or rejected traffic. AWS Network Firewall adds filtering and can inspect supported encrypted traffic when TLS inspection and certificates are configured.

Each coding session runs in its own MicroVM with a separate workspace and session-scoped storage permissions. Developers use a consistent workspace setup, while each session keeps its own files and conversation history.

The MicroVM workspace contains the repository and the agent's durable session state. Session files persist in your AWS storage and synchronize automatically to your S3 bucket.

The compute environment can be suspended or replaced while the session's files remain available. Developers can return to their work without maintaining a particular machine.

The coding agent sends model requests to a local relay inside its MicroVM. The relay routes them to a private AI gateway in your AWS account.

The gateway checks session authorization and supplies provider credentials on the server side. Provider keys stay outside the MicroVM and off developer laptops. Private networking and session authorization control access to the gateway.

The gateway provides a central point for approved model access, usage attribution, and budget enforcement. You can connect model spending to the sessions and developers doing the work.

llmonade preserves the coding agent's native conversation history in your session storage. This includes developer messages, agent responses, and the tool calls and results captured by the agent. Instructions and corrections remain part of that history.

These records help your team extract useful lessons across developers: repeated failures, effective instructions, and successful approaches that can improve future sessions.

Access decisions and session operations have their own audit records. The AI gateway records model usage and cost, while your configured network monitoring provides traffic visibility.

During pilot setup, we agree on recording scope, retention, access, and redaction requirements with your security team.

A pilot starts with an internal champion, a group of engineers, and the infrastructure or security team that will administer llmonade.

Together, we choose the coding agents and model providers, define access to repositories and internal services, and configure network security. We also agree on budgets, cost controls, session-data handling, and administrator responsibilities.

We scope the deployment and the workflows your engineers will try. Success means engineers completing useful work, administrators verifying the access boundaries, and your team understanding the operating effort and costs.

A demo shows how developers work with llmonade and how administrators manage access, infrastructure, and costs.