Agent Index by Heritage Services
Submit / Claim
Home / Agents / OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI)

OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI)

Vendor: OnFinance AI (Mindweave Transformers Private Limited, Bengaluru) · HQ: India · Category: Compliance · Security

Last verified · Added · 5 sources · How we verify

Visit official site (opens in new tab) Claim this listing

Vendor? Get your “Listed on Agent Index” badge

What it does

Maxwell was released by OnFinance AI in September 2026 as its first open-source product. It runs headlessly on Claude Code or OpenCode on the customer's own infrastructure. Per the vendor's GitHub README and its announcement in OnFinance's own newsletter, deterministic workflow scripts send work to specialist agents. Every candidate finding is challenged by a separate 'refuter' agent, and only findings that survive are written, through validated helpers, into a schema-checked workspace and an append-only state-of-controls ledger. The 26 workflows cover: context maintenance (rechecking the company profile against regulator registers, rebuilding the control inventory, refreshing vendor assurance and discovering vendors from IaC and environments); static probes of repositories (IaC, Kubernetes manifests, schemas with unprotected PII, CI/CD, secure code review, LLM-agent code against the OWASP Agentic Top 10); read-only runtime probes of live environments under rules of engagement (workloads, sandboxes, data pipelines, network perimeter, IAM); and remediation and reporting. In that last group, it groups findings into change-management initiatives with owners and SLA deadlines, drafts fix diffs without modifying the target repo, and writes audit-findings reports. Every finding must cite a clause from a fixed library of 37 instruments. Indian instruments include SEBI CSCRF, RBI cybersecurity/IT and outsourcing directions, IRDAI guidelines, CERT-In Directions and the DPDP Rules 2025; global ones include DORA, ISO 27001, SOC 2 and NIST. Candidate security incidents are never confirmed automatically, and production probing is read-only. Regulation look-ups use OnFinance's ComplianceOS (a read-only account is available on request). Pricing: the software is free under AGPL-3.0; users pay only for their own AI model usage.

Frameworks (vendor-stated)

CERT-InDPDP

Pricing (as published)

Free and open source (AGPL-3.0, github.com/OnFinance/Maxwell); you pay only for your own AI model usage. OnFinance's separate ComplianceOS platform pricing is not part of this listing.

India relevance

India-headquartered (CIN U62099KA2023PTC173821, Karnataka). Built for Indian regulated entities first: its control library maps SEBI CSCRF, RBI cybersecurity and outsourcing directions, IRDAI guidelines, CERT-In Directions and the DPDP Rules 2025, and it derives CERT-In, SEBI, RBI and DPDP incident-reporting clocks. Confirm coverage for your entity type with the vendor.

Tasks

compliance posturecontrol monitoringevidence collectionvendor riskremediationaudit management

Sources

  1. github.com/OnFinance/Maxwell (primary)
  2. onfinanceainewsletter.beehiiv.com/p/700-sebi-rbi-and-dpdp-requirements-1-ai-agent-maxwell-by-onfinance-ai
  3. onfinance.ai/
  4. onfinance.ai/company
  5. onfinance.ai/privacy-policy

Last verified 20 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email [email protected]. See our methodology.

Not legal or audit advice. Confirm current pricing, framework coverage and India-regulatory claims with the vendor before purchasing.

Next step: find an auditor

After you pick a tool, the usual next step is an independent audit. These are directory listings (Verified or registry-listed), not rankings or endorsements.

Auditors by framework

Existing directory filters for frameworks this listing tags, shown only where at least three Verified firms are listed. A tag is vendor-stated relevance, not a certification.

Narrow by region

This listing’s HQ country is India. That is a starting point only — choose any published country page.

United States · India (suggested) · United Kingdom · Japan · Germany · Australia · Netherlands · Canada · Brazil · Singapore · Ireland · United Arab Emirates

Audit firms in India (131)

Send a request Get matched with verified auditors All verified audit firms

Send my request to up to 3 matches

Choose up to 3 listed tools and/or audit firms, or tick Match me and we will pick from the directory. We store the request for review. Nothing is sent to any firm from this form. Not a ranking.

Listings (up to 3)

0 of 3 selected

Framework(s) (select all that apply)

Next steps

Working aids from official sources and this directory. This is not a ranking.

Guides

Request a demo

We'll pass your request to the vendor later; no automatic emails. Nothing is sent to the vendor now.

Use-case comparisons

Compare OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI) with

Alternatives

  • Transcend — Data privacy infrastructure for DSRs, consent and data governance, plus Transcend Rails policy-as-code controls for what AI agents may do. (shared tags: DPDP)
  • VibrantiX agentic compliance platform (Evidence Review, Vendor Risk Scoring, Risk Detection, Customer Trust, Policy Drafting and Control Remediation agents) — Singapore-headquartered agentic compliance platform whose named agents review uploaded evidence against framework controls and flag gaps, score vendors from 12+ external sources without questionnaires, scan cloud posture and auto-escalate critical findings to the risk register, draft answers to customer security questionnaires (SIG, CAIQ, custom) from live policies, draft policies, and generate fixes for failed controls and mark them ready for re-audit. (shared tags: DPDP)
  • BigID (incl. AgentIQ agents) — Data security, privacy and DSPM platform whose AgentIQ agentic layer runs data-risk work from a request: four BigID agents at launch (Remediate Sensitive Data, AI Governance Enforcement, Access Exposure Analysis, Privacy Operations) investigate, prioritise and act, e.g. revoking access, remediating exposure, applying retention, quarantining data and fulfilling data subject requests. (shared tags: DPDP)
  • Crest TPRM AI agents (Vendor Outreach, Questionnaire Intelligence, Continuous Monitoring, Risk-Based Scoring, Finance, Screening and Efficiency agents) — New Delhi-headquartered third-party risk platform with seven agents marked Live: an outreach agent that autonomously sends and follows up vendor emails and voice reminders and escalates non-response, a questionnaire agent that distributes, chases and analyses vendor questionnaires, plus continuous adverse-media/watchlist monitoring, risk-based scoring, financial analysis, screening and efficiency agents that auto-approve low-risk vendors and trigger re-assessments. (shared tags: DPDP)
  • Data Adhikaar DPDPA agents (ten-agent compliance fabric) — India DPDP Act compliance platform run by ten scoped agents for data discovery and RoPA, consent, data principal rights requests, breach response, DPIAs, regulatory intelligence, policy drafting, processor risk and audit evidence, with human approval gates for Board notifications, policy publication and severity downgrades. (shared tags: DPDP)
  • IDfy AI Agents — Governed AI agents for KYC/KYB onboarding, credit underwriting, due diligence and DPDP-oriented privacy compliance in regulated finance. (shared tags: DPDP)

See all OnFinance AI Maxwell alternatives →

FAQ (from this dataset)

What does OnFinance AI Maxwell do?

Free, self-hosted, open-source (AGPL-3.0) agent from India's OnFinance AI for banks, brokers, NBFCs, AMCs, insurers and fintechs. It runs 26 workflows of specialist agents that keep a company's regulatory profile current, probe repositories, infrastructure and vendors for gaps against SEBI, RBI, IRDAI, CERT-In and DPDP controls, and write findings (each citing a specific clause), remediation plans and audit reports into a validated, append-only ledger for human review.

How much does OnFinance AI Maxwell cost?

Free and open source (AGPL-3.0, github.com/OnFinance/Maxwell); you pay only for your own AI model usage. OnFinance's separate ComplianceOS platform pricing is not part of this listing.

Where is OnFinance AI (Mindweave Transformers Private Limited, Bengaluru) headquartered?

India

Which frameworks does OnFinance AI Maxwell support?

Frameworks (vendor-stated): CERT-In, DPDP. Framework tags indicate relevance, not certification.

What are alternatives to OnFinance AI Maxwell?

See the OnFinance AI Maxwell alternatives page for category-sharing listings in relevance order, not a ranking. OnFinance AI Maxwell alternatives.

Stay updated

We use your email only to send the newsletter. See our privacy policy.