MOUNTAIN THEORY VS SONDERA.AI
Sondera is an open-source harness that intercepts agent tool calls and enforces policy deterministically outside the model. They now compile natural-language rules into Cedar policy-as-code and verify it with a theorem prover, so this is the closest competitor to Mountain Theory on philosophy.
| Sondera.ai | Mountain Theory | |
|---|---|---|
| What it controls | Agent tool calls | The action an AI agent is about to take |
| Where it sits | Hook-based interception | Inline at execution, between the decision and the action |
| How policy is set | Cedar policy code | Plain English, no code |
| Deployment reach | Coding agents in dev frameworks | Model and framework agnostic, including custom and on-prem agents |
| Best fit when | Developer team securing coding agents | An AI acting wrongly has physical or regulatory consequences |
Why you might pick Sondera.ai
Free and open source, which is hard to argue with for developer teams. Their rules are compiled from natural language into Cedar and then formally verified with a theorem prover and adversarially stress-tested before deployment, which is a stronger correctness story than most of this market can claim. Work accepted at ICML 2026 and FLoC 2026 workshops, with a Black Hat Arsenal demo.
Why you might pick Mountain Theory
Both take policy in plain English and both enforce deterministically outside the model, so the honest difference is scope rather than philosophy. Sondera is a developer harness and SDK aimed at coding agents inside development frameworks. Mountain Theory is enterprise infrastructure across any deployment surface, with an identity and session layer at the action level and an append-only record built to be handed to an auditor.
The honest verdict
Sondera is the most intellectually honest competitor here and they are free, so if you are a developer team securing coding agents, start with them. The limit is what they are built for: a harness around development frameworks, owned and run by engineers. When the agents you need to govern are production systems across your business, and the person accountable for the policy is not the person deploying the SDK, that is a different product.
What we can actually show
Claims in this category are easy to make and hard to check, so here is ours on the record. The same 10 actions were run in the same order under three configurations. Ungoverned, 10 of 10 executed. Under NVIDIA OpenShell alone, all 5 sandbox-boundary crossings were denied at the kernel, and all 3 in-bounds bad decisions still went through, including a secrets read that printed credentials to the screen. Under OpenShell plus Mountain Theory, those same 3 actions returned HOLD, HOLD and BLOCK, and the secrets read was stopped before it executed, so the credentials never printed. Terminal recordings of all three runs are published, including the two actions Mountain Theory has no policy for.
Separately, when a third-party provider updated the foundation model driving an autonomous agent, the agent began attempting multi-step actions it had never tried before. Nothing on our side changed. Every attempt was stopped on 30 and 31 July 2026, the days the behaviour first appeared. No new rule, no signature, no patch.
Watch the three-configuration run against NVIDIA OpenShell
See novel agent behaviour stopped the day it appeared
Ask Sondera.ai, and every other vendor you are evaluating, for the same four things: the exact action set, the ungoverned control condition, the outcome per action including the ones the product did not stop, and the recording. A certification, an integration list or a customer logo answers a different question.
Compare all 56 AI security vendors