The sprawl you already have
MCP is becoming the default way agents reach tools. So every team builds its own server — its own auth, its own tool list, its own credential handling, its own audit story. Or none.
Security can't approve that pattern at scale. Not because MCP is risky, but because thirteen half-built copies of the same boundary are.
every box = a security review nobody did
Tools you can't see can't be called
Most systems deny a forbidden call after the agent finds the tool. The gateway treats discovery itself as authorization: an agent's tool list contains only what policy allows it to call.
Everything else isn't greyed out. It simply isn't there — powered by default-deny Cedar policy, where an explicit deny always wins.
hidden ≠ denied later. hidden = never offered.
The agent never holds the key
Credentials stay behind a broker. At call time the gateway resolves the right mode — service account, user-delegated OAuth, agent-scoped, or workload-mapped — and hands the agent an opaque reference.
Secret material never appears in prompts, logs, traces, or audit events. There is no credential for an agent to leak — and nothing for a prompt injection to steal from the agent's context.
agents carry a claim ticket, not the key
Every decision, written down
Allow or deny, every decision lands in a metadata-only audit trail: who, what, when, why, and which policy version decided. Searchable, exportable to your SIEM — payloads and secrets never recorded.
When something goes wrong, you don't grep thirteen servers. You revoke the tool, credential, agent, or session — and the ledger shows exactly what the blast radius was.
- Stable machine reasons for every deny
- Emergency disable with blast-radius preview
- Revocation that reaches live sessions
Runs in your basement, not ours
Helm chart into your Kubernetes. Your PostgreSQL, your Valkey, your identity provider, your secret manager, your telemetry. In fully self-hosted mode there is no required vendor egress at runtime — the governed path works with the internet unplugged.
Rust data plane, Cedar authorization, signed artifacts with SBOMs. Boring on purpose, everywhere an operator has to trust it.
your infra. your keys. our gate.
Bring us one boundary. We'll govern it together.
The pilot: 4–6 weeks, your infrastructure, one real MCP server or internal API. One allowed call, one denied call, one revocation — proven end to end with your security team watching.
Postcard received.
We'll write back to schedule a walkthrough and scope your pilot boundary.