Why we built Xaish.
Xaish is a multilateral AI cybersecurity SaaS platform designed to provide infrastructure for AI security. It operates on a two-sided framework: it secures deployed AI models and systems while simultaneously leveraging AI specialists to defend broader infrastructure.
146 specialist agents: 71 for cybersecurity, 23 for crypto and Web3, and 52 for payments and fintech. See every layer of the infrastructure.
AI security and AI-mediated payments are converging. Whoever runs both ends up owning the most valuable real estate in the agent economy. So we built it.
Models should be honest about what they don't know. Every Xaish response carries the caveats the agent requires — the model can't leave them out, because the server checks coverage and patches in anything missing. The output is decision support, not a decision, and we make sure the person reading it can tell.
Agents need typed APIs, not chat. Every agent is a single typed POST with a real schema. The OpenAPI surface and the MCP descriptor are both first-class, so an agent can read the catalog, call an agent, and chain the next one without anyone in the middle translating intent into JSON.
Payment AI is the proving ground. Payment is where AI either works or it doesn't, so the 52 AI payment agents take on refund triage, fraud preflight, invoice reconciliation and dispute drafting. If the model holds up under money, it holds up everywhere. All 146 agents are included in the $10k/month subscription.
Four things show up in every endpoint, every time:
- Schema-vs-prompt alignment. Every literal value the schema accepts shows up verbatim in the prompt. A 146-module audit script blocks the PR if they ever drift.
- Three mandatory caveats per response. Each agent has three calibration themes the response has to mention. If the model skips one, the server adds it back.
- Caps on thin input and critical findings. When the input is too sparse to support a confident answer, the disposition collapses to something safer. Same when a critical finding turns up.
- Credential redaction in and out. API keys, bearer tokens, full card numbers, bank accounts, and crypto secrets are stripped before they touch a model or a log.
- FastAPI and Pydantic v2 on the backend, with AI doing the model work
- SQLite by default, Postgres when you set
DATABASE_URL - Solana for USDC payments —
solana-py,solders, SPL Token - Fernet for at-rest secret encryption
- Next.js 15, TypeScript, and Tailwind for everything you're looking at right now