Ask a Maxim AI customer how they govern their agents and the answer depends entirely on which of two products they mean.

If they mean Maxim, the eval and observability platform, the answer is about quality: simulation runs across thousands of scenarios, online evaluators scoring production traces, human annotation queues, alerts wired to Slack when a regression crosses a threshold. If they mean Bifrost, the open-source AI gateway the same company ships, the answer is about control: a virtual key that carries a budget, a rate limit, a model allow-list, and a strict allow-list of MCP tools that defaults to allowing nothing at all.

Both answers are good. They are also two different products, sold on two different pricing pages, with two different deployment stories — and the governance capabilities a security team actually asks about are split across them, with the content-safety layer sitting behind an enterprise license on the second one.

Maxim AI (legal entity H3 Labs Inc.) is a GenAI evaluation and observability platform — prompt experimentation, agent simulation, online evals, and production tracing — and separately the publisher of Bifrost, an Apache-2.0 open-source AI gateway that governs LLM and MCP traffic through virtual keys carrying budgets, rate limits, and deny-by-default tool allow-lists. Waxell is an AI control plane where enforcement is the primitive across the whole lifecycle: Observe instruments agents in two lines of code and evaluates every run against 50+ policy categories before the next step executes, the MCP Gateway governs tool calls in flight across 160+ upstream connectors, Runtime gates each step of high-stakes workflows, and Endpoints finds the AI running on employee machines. Maxim measures agent quality and Bifrost controls the traffic in front of the model. Waxell governs the agent itself.

What is Maxim AI built for?

Maxim's core platform is an evaluation product first, and a genuinely well-built one. The homepage verb list is simulate, evaluate, observe — and the feature set follows: a prompt IDE with versioning and one-click deployment, simulation runs that exercise an agent across thousands of scenarios, a library of pre-built and custom evaluators spanning LLM-as-a-judge, statistical, programmatic, and human scorers, plus CI/CD integrations so evals gate a release rather than trailing it. Production observability adds trace visualization for multi-agent workflows, online evaluation on live traffic, and real-time alerts on regressions.

The collaboration angle is a real differentiator. Maxim is explicit that non-engineers should be able to run experiments and evaluations without writing code, and its customer quotes lean hard on that: product and design teams owning prompt development, human evaluation pipelines managed in-product. Teams that want evaluation to be a cross-functional practice rather than an engineering side-quest will find Maxim built for exactly that.

Bifrost is the more governance-relevant of the two products, and the stronger story. It is Apache-2.0 open source, starts with npx @maximhq/bifrost, and publishes hard numbers: 20 microseconds of added latency, 5,000 requests per second, 3.3 GB peak memory, with a vendor benchmark claiming roughly 50x lower P99 latency than LiteLLM at 500 RPS on identical hardware. Governance centers on virtual keys, and it is not decorative. A budget breach returns HTTP 402. A rate or token limit returns 429. A model or provider outside the key's allow-list returns 403. An expired key fails closed at both LLM inference and MCP tool execution.

The MCP story is the sharpest part. Bifrost's documentation states the rule plainly: a virtual key with no MCP configuration sees no tools at all — deny-by-default — and when a key does carry configuration, Bifrost enforces the allow-list both at inference time and again at tool execution time. That is real pre-execution access control, documented rather than implied, and it is stronger than what most observability vendors put in writing. The Bifrost CLI extends the same controls to coding agents including Claude Code, Codex CLI, and Gemini CLI.

Where does Maxim's scope end?

These are boundaries of a two-product architecture, not defects.

Governance is split across two products with different licenses. Bifrost's published OSS-versus-Enterprise comparison puts virtual keys, budgets, rate limits, MCP Gateway, and MCP tool filtering in the free open-source tier — a genuinely generous line to draw. But Guardrails, role-based access control, SAML/OIDC SSO, audit logs, in-VPC deployment, and log exports are all listed as Enterprise-only. A team that adopts Bifrost OSS for cost control and tool allow-listing, then later needs content safety and an audit trail, is starting a commercial conversation, not flipping a config flag.

Content safety is largely brokered, not built. Bifrost's Guardrails page lists two native providers — Custom Regex and Gitleaks-backed Secrets Detection — and then integrations with Microsoft Presidio, Azure AI Language PII, AWS Bedrock Guardrails, Azure Content Safety, Google Model Armor, CrowdStrike AIDR, Gray Swan Cygnal, and Patronus AI. The orchestration around them is sophisticated: CEL-based rules, reusable profiles, dual-stage input and output validation, three redaction modes, and a documented HTTP 446 block response. But PII detection, prompt-injection screening, toxicity, and hallucination checks come from providers you contract, credential, and pay for separately. That is a defensible architecture — bring the detector you already trust — and it is a different proposition from a policy set that ships with the platform.

Core Maxim's own pages describe measurement, not enforcement. The platform's language is evaluate, monitor, debug, alert. PII management appears in the pricing grid as a Business-tier data-handling feature for logs. Maxim's public product pages do not describe the core platform blocking an agent action, and this comparison does not assert that it cannot — enforcement is Bifrost's job in Maxim's architecture, and that division of labor is deliberate rather than accidental.

The gateway governs traffic, not the agent's internal reasoning. Bifrost sits in the request path, which is exactly what makes its controls unbypassable by application code. It also means the unit of governance is the call — LLM request, MCP tool invocation — rather than the agent's decision to make that call, its multi-step plan, or what happens between steps in a durable workflow.

Bifrost Enterprise has no published price and no self-serve path. The OSS tier is free forever and genuinely self-hostable. Enterprise is "Custom pricing," entered through a 14-day trial form that asks for company size and region and ends at "Request license."

What Waxell adds

Waxell collapses that split. Observe installs with pip install waxell-observe, instruments an agent in two lines of code with no rebuilds, auto-instruments 200+ libraries, and evaluates each run against 50+ policy categories — Audit, Content, Control, Cost, Kill, LLM, Operations, Quality, Rate-Limit, Safety, Scheduling, Compliance, Delegation, Identity, Privacy, Reasoning — at 0.045ms p95 across 1000+ policies. Those categories ship with the platform and map to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, and HIPAA, so the same enforcement that stops a bad action also produces the attestation an auditor asks for. There is no separate detector to procure for PII redaction or content gating.

The MCP Gateway covers the same ground Bifrost does and extends past it: one URL per tenant in front of 160+ upstream connectors, PII redacted in flight, secrets blocked so they never leave the gateway, tool descriptions scanned for prompt injection at fingerprint time before any agent calls them, and every tool tracked through a five-state trust model — Pending, Drift, Trusted, Blocked, Removed — so a server that silently rewrites its tool definitions is caught as drift rather than trusted by inertia. Destructive actions park for a human, with the MCP connection held open during the approval.

Beyond the request path, Runtime gates each step of financial, clinical, and infrastructure workflows with kill switches at every level, durable checkpoint-and-resume, and US or EU data residency. Endpoints discovers AI across employee machines — 60+ provider domains, macOS and Windows, MDM-deployable — which is a surface neither Maxim product addresses.

Feature comparison

Three scenarios, two different centers of gravity

Scenario: your problem is agent quality, and product managers need to own part of it.
Maxim, clearly. Simulation across thousands of scenarios, a deep evaluator library, human annotation pipelines, and a deliberate no-code path for non-engineers is a stronger evaluation practice than Waxell offers. Waxell has a Quality policy category; it is not a replacement for an evaluation platform.

Scenario: you want unbypassable cost and tool controls in front of a model, for free, self-hosted.
Bifrost is an excellent answer and hard to beat on price. Virtual keys with real budget enforcement and deny-by-default MCP allow-listing sit in the Apache-2.0 tier. Confirm before committing that the pieces you will need later — Guardrails, RBAC, SSO, audit logs — are Enterprise-tier features in Bifrost's own comparison table.

Scenario: you need one governance program across agents you build, assistants you didn't build, and laptops you don't watch.
Waxell. Policy evaluates before the step runs across 50+ categories that ship with the platform, the same policy set covers gateway tool calls with drift detection and human approval holds, Runtime gates high-stakes workflows step by step, and Endpoints finds the shadow AI. One control plane, one audit trail, no second product and no third-party detector to procure.

When to use Maxim AI

• Evaluation is your primary need — simulation, evaluator libraries, human annotation, and CI/CD-gated release checks.

• You want non-engineers running experiments and evals directly, without code changes.

• You need a fast, open-source, self-hosted gateway and value published performance numbers and an Apache-2.0 license over a bundled policy set.

• Deny-by-default MCP tool allow-listing at the gateway is the specific control you're shopping for, and you already have a content-safety vendor you trust to plug in.

When to use Waxell

• You want enforcement and observability in one product line rather than governance split across an eval platform and a gateway.

• You need policy categories that ship with the platform — PII redaction, content and safety gates, cost ceilings, kill switches — rather than assembled from third-party detectors on an enterprise tier.

• Your governance has to reach past the request path: execution-step gating, tool-description drift detection, human holds on destructive actions, and shadow AI on employee devices.

• You want mapped compliance evidence — OWASP, NIST AI RMF, ISO 42001, EU AI Act, GDPR, HIPAA — falling out of the same enforcement that stops the action.

How Waxell handles this: Waxell is an AI control plane where enforcement is the primitive and observability is what enforcement produces. Observe instruments the agents you build in two lines of code, auto-instrumenting 200+ libraries, and evaluates every run against 50+ policy categories at 0.045ms p95 across 1000+ policies — cost ceilings that halt execution, PII redaction, content and safety gates, kill switches — mapped to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, and HIPAA so the same enforcement yields an audit you can hand over. The MCP Gateway governs the tool calls those agents make across 160+ upstream connectors, with five-state fingerprinting that catches a server silently changing its tool definitions and human-in-the-loop holds on destructive actions. Runtime gates each step of workflows where being wrong is expensive, and Endpoints finds the AI running on employee machines. A dashboard after the fact is not governance. It's an autopsy.

FAQ

Is Waxell a Maxim AI alternative?

For governance, yes. Waxell covers agent instrumentation, execution-level policy enforcement across 50+ categories, MCP tool-call governance with drift detection, and endpoint shadow-AI discovery in one product line. Maxim is the better choice if your primary need is evaluation — simulation runs, evaluator libraries, and human annotation pipelines are a depth Waxell does not match. The two overlap on production observability and diverge on where enforcement lives.

What is the difference between Maxim AI and Bifrost?

They are two products from the same company, H3 Labs Inc. Maxim is the GenAI evaluation and observability platform: prompt experimentation, agent simulation, online evals, and production tracing, priced per seat. Bifrost is a separate Apache-2.0 open-source AI gateway that sits in the request path and governs LLM and MCP traffic through virtual keys carrying budgets, rate limits, model allow-lists, and MCP tool allow-lists. If you are evaluating Maxim for governance rather than evaluation, Bifrost is the product you are actually comparing.

Does Bifrost actually block agent actions, or only monitor them?

It blocks, and the documentation is specific about it. A virtual key over budget returns HTTP 402, a rate or token limit returns 429, a disallowed model or provider returns 403, and a guardrail violation returns 446. On MCP specifically, a virtual key with no MCP configuration sees no tools at all — deny-by-default — and the allow-list is enforced both at inference time and again at tool execution time. This is one of the more clearly documented enforcement stories among the platforms in this category.

What is in Bifrost's free tier versus its enterprise tier?

Bifrost's own comparison table puts virtual keys, budget and rate limits, the MCP Gateway, MCP tool filtering, custom routing, semantic caching, built-in observability, and the CLI in the free open-source tier. Guardrails, role-based access control, SAML and OIDC SSO, audit logs, in-VPC deployment, vault integrations, clustering, and log exports are listed as Enterprise, which carries custom pricing and a license request rather than a published figure. Teams should confirm which side of that line their required controls fall on before adopting.

How does Maxim AI's pricing compare to Waxell's?

Maxim publishes real self-serve prices: a free-forever Developer tier with 3 seats, 10,000 logs a month, and 3-day retention, then $29 per seat per month for Professional and $49 for Business, with log overages at $1 per 10,000 and a custom Enterprise tier. Bifrost OSS is free under Apache 2.0 and self-hosted; Bifrost Enterprise is custom-priced. Waxell is free to start with a two-line setup, and governance features are not partitioned behind a separate product.

Sources

• Maxim AI, Pricing — accessed July 28, 2026

• Maxim AI, The GenAI evaluation and observability platform — accessed July 28, 2026

• Maxim AI, Bifrost: The Fastest Enterprise AI Gateway — accessed July 28, 2026

• Maxim AI, Bifrost OSS and Enterprise Pricing — accessed July 28, 2026

• Bifrost Documentation, MCP Tool Filtering — accessed July 28, 2026

• Bifrost Documentation, Virtual Keys — accessed July 28, 2026

• Bifrost Documentation, Guardrails — accessed July 28, 2026

Running evals but still can't stop an agent mid-action? Get started with Waxell.