Platform · MCP Gateway
In-band enforcement
1 · ATTRIBUTION
Know who approved what
Every action carries the person who delegated it, the scope they granted and the agent that executed it.
2 · DOWNSCOPE, DON’T JUST BLOCK
Agents keep running
Tool calls are rewritten per parameter in milliseconds: an export of 100,000 records becomes 500.
3 · USAGE ANALYTICS
See every tool call
How many tool calls each agent and MCP server makes, for whom and to which systems.
More than a gateway
One MCP Gateway behind every call
Every MCP tool call is authenticated through your identity provider, tied to the person behind the agent and checked against policy down to the tool and parameter. Credentials are issued just in time, and every call is logged.
MCP server approval
New servers are approved before they are callable, with owner and version pin.
Short-lived credentials
No standing tokens in an agent’s environment.
Step-up for risky actions
Risky actions are held, and admin actions require step-up.
Automatic sync with your IdP
Users, groups and offboarding sync from Okta, Entra ID or Google Workspace, so access follows the person.
Use cases
AT RUNTIME
No deletes by agent on the finance Drive and Metabase
Finance’s AI assistant on Drive can read, edit and share files, but every delete is blocked.
AT RUNTIME
Tool calls that breach the export limit
An agent asks to export 100,000 records. Cygrid blocks the call or reduces it to the 500-record limit before it reaches the app.
AT RUNTIME
Every call bound to the person who asked
An agent working for a support engineer sees only her six GitHub repos, not the 200 its connection could reach.
We’ll show what Cygrid would allow, rewrite and block.