Selected for GitHub's Secure Open Source Fund. See how it's shaping the future of AI agent security.

Learn more

MCP Gateway

A new capability is a config change, not a redeploy.

Give any agent any tool through one governed endpoint. The MCP Gateway holds the credentials, enforces per-tool permissions, and records every call, so connecting a tool is safe, permissioned, and instant, with zero changes to agent code.

Your agents

Any framework · One endpoint each

The MCP Gateway

Permissions checked · Credentials injected · Every call recorded

Your tools

SaaS toolkits · Your own MCP servers

One governed door between every agent and every tool.

01 · The catalog

Every tool, one catalog

Pre-built SaaS toolkits and your own MCP servers, side by side: one consistent way to connect, share, and grant, whatever runs behind the tool.

  • One catalog

    SaaS toolkits and self-hosted MCP servers in one list, connected, shared, and granted the same way.

  • One-click connect

    Connecting adapts to each tool's auth automatically: keys, tokens, or full OAuth sign-in.

  • Your own servers

    Register any MCP server you run. Registration is hardened, validated, and safe by construction.

  • OAuth built in

    Standards-compliant sign-in with PKCE, and tokens refreshed before they ever expire.

  • Status at a glance

    Every connection shows its state in the catalog: initiated, active, or expired.

  • Always current

    Tool lists stay synced, so permission screens render instantly and never go stale.

02 · Permissions

Allow, ask, or block: per agent, per tool

Grant tools, not servers. Stances shape what each agent can even see, get re-checked on every call, and take effect on the very next request. Try it below.

  1. 01 · Scope

    Grant tools, not servers.

    Permissions go down to the individual tool. An agent that needs one read endpoint gets exactly that, not the whole server.

  2. 02 · Stance

    Allow, ask, or block.

    Every tool carries one of three stances per agent. Ask routes the call to a human before it runs: automation with a supervisor.

  3. 03 · Enforce

    Checked twice, every time.

    Stances filter the tool list, then get re-checked the moment a call lands. There is no window between listing and enforcement.

  4. 04 · Reset

    Back to safe in one click.

    Any agent's permission set resets to defaults instantly, so experiments never harden into accidental policy.

Permissions playground

Per agent · per tool
gmail__search_email
→ forwarded with your credentials
calendar__create_event
→ held for your approval
github__merge_pr
→ not in the tool list
In the agent's tool list
2 of 3 tools
Credentials held by
the gateway
Changes take effect
next call

Stances are enforced twice: once when tools are listed, again when each call lands.

03 · Credentials

Your agents never hold a secret

Credentials live in one hardened service: encrypted per user, written but never read back, and injected only at the moment a permitted call leaves for the tool.

  • Injected at the edge

    Agents never hold a secret.

    The Gateway attaches credentials on the way out to the tool. Agent context stays clean, and rotating a key is one change in one place.

  • Stripped on entry

    Your login stays yours.

    A caller's own session never reaches an agent container, so platform credentials can't be replayed by anything downstream.

  • Write-only vault

    Stored, encrypted, never read back.

    Secrets are encrypted per user with AES-256-GCM and can only be used. No screen, endpoint, or export ever returns one.

  • Short-lived identity

    Five minutes, then it's gone.

    Every request carries its own delegated identity that expires in minutes, so there is nothing long-lived for anyone to steal.

Least privilege

Nothing is visible, connected, or usable by default. Every capability an agent has is one somebody chose to give it, and can take back just as fast.

04 · Sharing

Share the tool, never the login

A grant makes a connector available to a teammate or the whole team. Everyone connects with their own credentials, and revoking cleans up completely, in one step.

  • Share with anyone

    Grant a connector to a named teammate or the whole team, one action either way.

  • Their keys, not yours

    A grant shares the tool, never the login. Every teammate connects with their own credentials.

  • Every agent, instantly

    Share once and every agent a teammate builds can use it, with no per-agent setup.

  • Revoke completely

    Revoking a grant removes the teammate's access and their connection in the same step. Nothing lingers.

05 · Guarantees

What the Gateway holds itself to

Five commitments, each one visible in the product, so trusting the Gateway never means taking its word for it.

  • Minutes, not sprints

    From “we need this tool” to an agent using it: single-digit minutes, fully self-serve.

  • Changes land on the next call

    Permission edits take effect immediately. There is no propagation delay to wait out, ever.

  • Zero redeploys

    Adding, sharing, or restricting a capability is a configuration change. Agent code never ships for it.

  • Zero tickets

    Owners manage permissions and sharing themselves. No engineering involvement required.

  • Every call on the record

    Caller, tool, latency, and outcome are recorded with the run that made it, feeding your cost attribution.