Security overview
The gateway sits between AI agents and the systems they act on. It can decide, inspect and record the tool calls and model requests routed through it. This page summarises the controls and their limits, and points to the detailed evidence.
The boundary
Section titled “The boundary”Controls apply to traffic routed through the gateway, with the relevant settings configured. An agent that holds its own credentials and calls a vendor directly is outside that boundary. Deployments close that path by keeping upstream credentials in the gateway only.
Controls
Section titled “Controls”| Control | What it does |
|---|---|
| Inbound identity | HTTP clients authenticate with your OpenID Connect provider; sessions, caches and artifacts are bound to the verified principal. |
| Policy | A signed, default-deny policy is evaluated against the upstream request the gateway is about to send, not just the tool name. Cedar is available as an optional engine. |
| Credentials | Upstream credentials are brokered by the gateway from the OS keychain, files, Vault, AWS Secrets Manager or Azure Key Vault, and are kept out of tool arguments. |
| Approvals | A call can be held until a second person approves it. |
| Content inspection | Content rules inspect write arguments, tool results, prompts and completions. Detection is probabilistic; the request-side rules remain the enforced boundary. |
| Model requests | With the inference path enabled, model requests are forwarded to one configured provider and decided on the policy’s model rules. |
| Audit | A sealed audit journal records each decision as metadata. Tampering with sealed history is detectable by anyone holding the public key. Records can be forwarded to a SIEM. |
Evidence
Section titled “Evidence”- OWASP MCP Top 10 assessment: each category, its controls, the tests that lock them, and residual risk.
- Threat model: trust boundaries, threats and the controls against them, including what is out of scope.
- MCP security best practices: how the implementation maps to published guidance.
- Governance framework map: traceability from NIST AI RMF, ISO/IEC 42001 and EU AI Act requirements to controls and tests.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Do not post vulnerability details publicly. Until a dedicated security contact is published, send a short message through the request access link saying that you have a security report, without details, and we will arrange a private channel.