> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Frequently asked questions about MeshAI

## General

<AccordionGroup>
  <Accordion title="What is MeshAI?">
    MeshAI is the Agent Control Plane, the only platform that monitors AND governs AI agents. It provides unified observability, governance, cost intelligence, and EU AI Act compliance for enterprise AI agent deployments, regardless of framework or vendor.
  </Accordion>

  <Accordion title="How is MeshAI different from Langfuse, AgentOps, or LangSmith?">
    Those tools focus on observability: tracing, debugging, evals. MeshAI does observability **plus** governance: 8 policy types, with inline enforcement for allowlists, provider blocks, and human approval at the proxy, kill switch, agent quarantine, prompt injection detection, PII filtering, and EU AI Act compliance scoring. Nobody else combines monitoring and governance in one platform.
  </Accordion>

  <Accordion title="Do I need to change my code?">
    No. The MeshAI proxy works with one environment variable change, zero code modifications. Set `ANTHROPIC_BASE_URL` or `OPENAI_BASE_URL` to point at the proxy and you're monitoring instantly. For deeper integration, our Python SDK supports 11 frameworks.
  </Accordion>

  <Accordion title="What frameworks do you support?">
    OpenAI, Anthropic, CrewAI, LangChain/LangGraph, AutoGen, Google Gemini, AWS Bedrock, LlamaIndex, Agno (ex-Phidata), Pydantic AI, and Microsoft Semantic Kernel. Platform integrations for enterprise tools like Copilot Studio, Salesforce Einstein, and ServiceNow are on the roadmap; today MeshAI covers custom agents built on any framework through the SDK, OpenTelemetry, or the proxy.
  </Accordion>

  <Accordion title="What LLM providers do you support?">
    Anthropic (Claude), OpenAI (GPT, o1), Google Gemini (via the Vertex AI route), AWS Bedrock, NVIDIA Nemotron, all through the transparent proxy with zero code changes.
  </Accordion>
</AccordionGroup>

## EU AI Act & Compliance

<AccordionGroup>
  <Accordion title="Does the EU AI Act apply to non-EU companies?">
    **Yes.** The EU AI Act has extraterritorial reach, the same as GDPR. If your non-EU company's AI system reaches the EU market or its outputs are used by EU residents, the Act applies. Any company outside the EU, whether based in the US, UK, Asia, or elsewhere, using AI agents for EU customer support, hiring, or financial services must comply. High-risk (Annex III) obligations are postponed to December 2, 2027 under the 2026 Digital Omnibus (Council-adopted 29 June 2026, pending Official Journal publication); prohibited practices (in effect since February 2025) and general-purpose AI model obligations (since August 2025) are unchanged. Fines are based on **global** turnover, not just EU revenue.
  </Accordion>

  <Accordion title="What if my non-EU company uses third-party AI that serves EU customers?">
    You're classified as a **deployer** under the EU AI Act (Article 26). Even though the AI is from a third party, you can't shift responsibility to the provider. If your service uses AI (e.g., speech-to-text, chatbots, content generation) and EU residents consume the output, you must comply. This includes maintaining audit trails, informing users they're interacting with AI, and classifying the risk level of your AI systems. MeshAI automates all of this.
  </Accordion>

  <Accordion title="What are the different roles under the EU AI Act?">
    The Act defines 6 roles:

    * **Provider**: develops the AI system and places it on the market (e.g., OpenAI, Anthropic, Google). Must do conformity assessments, technical documentation, CE marking, and post-market monitoring.
    * **Deployer**: uses an AI system in their business (e.g., a SaaS company using GPT for customer support). Must ensure human oversight, maintain logs, inform users, and classify risk. **This is MeshAI's primary customer.**
    * **Importer**: brings non-EU AI systems into the EU market. Must verify CE marking and conformity documentation.
    * **Distributor**: makes AI systems available within the EU without modifying them (e.g., cloud marketplaces). Must verify compliance before selling.
    * **Authorized Representative**: EU-based entity acting on behalf of a non-EU provider.
    * **Product Manufacturer**: integrates AI into a physical product (e.g., autonomous vehicles). Same obligations as provider for the AI component.

    **Important:** If a deployer modifies the AI system's intended purpose or makes substantial changes, they become reclassified as a **provider** under Article 25, inheriting all provider obligations.
  </Accordion>

  <Accordion title="What are the fines for non-compliance?">
    * **Prohibited AI practices**: up to 35 million or 7% of global annual turnover
    * **High-risk AI obligations** (Articles 26, 27): up to 15 million or 3% of global turnover
    * **Incorrect information to authorities**: up to 7.5 million or 1.5% of global turnover

    For SMEs and startups, fines are the **lower** of the percentage and fixed amount (not the higher).
  </Accordion>

  <Accordion title="What articles of the EU AI Act does MeshAI cover?">
    MeshAI provides tooling for 8 articles:

    * **Article 6**: Risk classification (4 levels with AI-assisted suggestion)
    * **Article 12**: Record-keeping (immutable audit trail, 6-month retention, CSV/JSON export)
    * **Article 13**: Transparency (auto-generated transparency cards)
    * **Article 14**: Human oversight (HITL approval workflows)
    * **Article 26**: Deployer obligations (12 obligations covered)
    * **Article 27**: FRIA with all 6 required fields (a-f)
    * **Article 50**: Transparency obligations
    * **Article 73**: Serious incident reporting (15-day/2-day deadlines)
  </Accordion>

  <Accordion title="What is a Fundamental Rights Impact Assessment (FRIA)?">
    Article 27 requires deployers of high-risk AI systems to assess impacts on fundamental rights before deployment. MeshAI provides structured FRIA templates with all 6 required fields: intended purpose, usage period/frequency, affected person categories, specific risks, human oversight measures, and risk mitigation measures. FRIAs are versioned and can be submitted for authority notification.
  </Accordion>

  <Accordion title="What is the compliance readiness score?">
    MeshAI computes a 0-120 score across 7 components: audit trail active (Art 12), risk classification coverage (Art 6), human oversight for high-risk agents (Art 14), documentation completeness (Art 11), data retention (Art 12), FRIA completion (Art 27), and incident response (Art 73). Target: 100+ for enforcement readiness.
  </Accordion>

  <Accordion title="When is the enforcement deadline?">
    High-risk AI system obligations (Articles 26, 27, Annex III) are postponed to **December 2, 2027** under the 2026 Digital Omnibus (Council-adopted 29 June 2026, pending Official Journal publication). Prohibited practices have been in effect since February 2025, and general-purpose AI model obligations took effect August 2025; both of those dates are unchanged.
  </Accordion>
</AccordionGroup>

## Security & Privacy

<AccordionGroup>
  <Accordion title="Does MeshAI store my prompts or completions?">
    **No.** MeshAI never stores prompt text or completion content. The proxy forwards request and response bodies to LLM providers in real-time but only persists operational metadata: token counts, cost estimates, latency, model name, and error type. No conversation history, no message content.
  </Accordion>

  <Accordion title="How is data encrypted?">
    All data is encrypted at rest (AES-256) and in transit (TLS 1.2+ on all connections). API keys are hashed with bcrypt, never stored in plaintext. Provider API keys can be stored in AWS Secrets Manager with only reference pointers in the database.
  </Accordion>

  <Accordion title="Is there tenant isolation?">
    Yes. Every database query includes tenant-scoped filtering. Cross-tenant data access is architecturally impossible through the API. Each customer's agents, policies, audit events, and billing are completely isolated.
  </Accordion>

  <Accordion title="What about prompt injection protection?">
    MeshAI scans all request bodies at the proxy layer for 15+ known injection patterns including instruction override, system prompt extraction, role hijacking, delimiter attacks, and encoding evasion. Patterns are normalized with Unicode NFKC to prevent homoglyph bypasses. Detected injections return 403 before reaching the LLM provider.
  </Accordion>

  <Accordion title="What about PII in AI responses?">
    MeshAI can detect PII in LLM responses (emails, phone numbers, SSNs, credit cards, IPs, passports, IBANs) and apply one of three actions per your policy:

    * **Block**: return 403, don't forward the response
    * **Redact**: replace PII with `[EMAIL_REDACTED]`, `[SSN_REDACTED]` etc.
    * **Allow**: log the detection but return the response unchanged

    You choose the mode based on your use case. Agents that need PII (e.g., customer support) can use "allow" mode.
  </Accordion>

  <Accordion title="What happens if MeshAI goes down?">
    The proxy is designed to fail gracefully. If MeshAI is unavailable, configure your agents to fall back to direct provider URLs. The proxy itself runs on Cloud Run with auto-scaling (2-50 instances) and adds less than 5ms latency. Governance policies fail open on Redis errors. Your agents keep working.
  </Accordion>
</AccordionGroup>

## Pricing & Plans

<AccordionGroup>
  <Accordion title="How much does MeshAI cost?">
    * **Starter**: \$299/month, up to 25 agents
    * **Professional**: \$799/month, up to 100 agents
    * **Enterprise**: \$1,999/month, up to 1,000 agents
    * **Enterprise Plus**: Custom pricing, unlimited agents, dedicated infrastructure

    All plans include the proxy, dashboard, SDK, and governance features.
  </Accordion>

  <Accordion title="Is there a free tier or trial?">
    We're offering free Professional tier (3 months) for early beta users. [Contact us](https://meshai.dev/contact) or [join the waitlist](https://meshai.dev/#waitlist).
  </Accordion>

  <Accordion title="What happens when I hit my agent limit?">
    You won't be able to register new agents until you upgrade or remove existing ones. Existing agents continue to work. We never block running agents due to billing limits.
  </Accordion>

  <Accordion title="Can I pay annually?">
    Enterprise Plus plans support annual contracts with invoicing. Contact sales for details.
  </Accordion>
</AccordionGroup>

## Technical

<AccordionGroup>
  <Accordion title="What latency does the proxy add?">
    Less than 5ms. The proxy evaluates governance policies locally from Redis cache and forwards requests to the upstream provider. Telemetry is fire-and-forget (async, non-blocking).
  </Accordion>

  <Accordion title="How does the kill switch work?">
    When you block an agent, a flag is set in both PostgreSQL and Redis. The proxy checks Redis on every request. Blocked agents get an instant 403 response. No waiting for cache expiry. Unblocking is equally instant.
  </Accordion>

  <Accordion title="What is agent quarantine vs kill switch?">
    **Kill switch**: immediate block for a known agent that's behaving badly. Admin action.
    **Quarantine**: isolation for unknown or suspicious agents. Can be auto-triggered when the proxy detects an unregistered agent. Both result in a 403 at the proxy, but quarantine implies investigation is needed before release.
  </Accordion>

  <Accordion title="Can I use MeshAI with my existing monitoring tools?">
    Yes. MeshAI focuses on AI agent governance. It complements Datadog, Grafana, PagerDuty, etc. We integrate with PagerDuty and Slack for alerting, and the audit trail can be exported as CSV/JSON for ingestion into any SIEM or compliance tool.
  </Accordion>

  <Accordion title="Is the SDK open source?">
    The Python SDK (`meshai-sdk`) is MIT licensed and available on PyPI and GitHub. The platform (API, proxy, dashboard) is proprietary.
  </Accordion>

  <Accordion title="Do you support languages other than Python?">
    Currently the SDK is Python-only. However, the proxy requires no SDK. Any language that can set an environment variable works. JavaScript, Go, Rust, Java agents all work through the proxy with zero code changes.
  </Accordion>

  <Accordion title="Can MeshAI monitor developer tools like Cursor, Claude Desktop, or VS Code?">
    **Yes**, two integration paths:

    **Path 1: Proxy (tools with custom base URL support)**

    * **Claude Code**: `ANTHROPIC_BASE_URL=https://proxy.meshai.dev/v1/anthropic/k/msh_KEY`
    * **Cursor**: Settings → Models → Custom Base URL
    * **Cline / Roo Code**: Settings → API Base URL
    * **Codex**: `OPENAI_BASE_URL=https://proxy.meshai.dev/v1/openai/k/msh_KEY`

    **Path 2: MCP Server (tools without proxy support)**

    No install needed. Configure `npx -y @meshailabs/mcp-server` in your tool's MCP settings. Supports **19+ tools**: Claude Desktop, VS Code Copilot, JetBrains IDEs, Windsurf, Zed, Warp, AWS Kiro, Continue.dev, Amazon Q Developer, Gemini CLI, Tabnine, Goose, and more.

    The MCP server registers the tool as a governed agent, tracks usage, checks policies, and reports compliance, all without proxying traffic.

    See the [MCP Server guide](/getting-started/mcp-server) for setup instructions per tool.
  </Accordion>
</AccordionGroup>