Waxell

03 Enforce · Product

For anyone whose agents or people use MCP tools

Point your agents at one URLand govern each MCP tool call.

MCP Gateway secures every tool call in flight. Claude, Cursor, Copilot and your own agents point at one gateway, credentials stay inside it, and a tool can be cut off without touching a client. Connect customers can switch it on, and it also runs standalone.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

mcp gateway · activity · live
mcp gateway · activity · live
The problem

Every AI tool your people connect is a new door into your systems.

One person connects Claude to Notion. Another connects Cursor to GitHub. Fifty people with a dozen tools each make hundreds of connections, each with its own token, no rules and no record. And if one of those tools quietly changes what it does, nobody finds out.

Where it fits
  1. 01 DiscoverFind the AI tools and agents you build, buy, or didn't know about.
  2. 02 ObserveSee every call, token and dollar your instrumented agents spend, run by run.
  3. 03 EnforceDecide allow, hold, redact, or block while the agent acts.
  4. 04 RunRun the agents you build inside the plane, with a kill switch that works.
  5. 05 ProveEvidence per decision, mapped to the frameworks.

MCP Gateway is how Waxell enforces rules on the tools AI can reach. It's the third of the five moves. Discover and Observe show you what's there; the gateway decides what each call is allowed to do, before it happens.

How a tool call goes through
  1. 01

    Install a tool once.

    An admin installs tools from a catalog of 160+, from Notion, Linear and Slack to Stripe and Snowflake, plus your own internal servers. Many need no setup at all.

  2. 02

    Each person connects their own account.

    People sign in to each tool once, with their own login. That access is stored encrypted, never shared between people, and agents never see it. Calls run as the person, so the tool's own log shows who it was.

  3. 03

    Every client points at one URL.

    Claude, Cursor, Copilot and your own agents connect to the gateway and say which agent they are. Every call carries both the agent and the person it acts for.

  4. 04

    Rules run before the call goes out.

    Deny it, strip fields from it, hold it for a person, rate-limit it or cap its spend. Rules match by tool, person, team, role or agent, so the same person can have different rules for different agents. A change takes effect in seconds.

  5. 05

    A person approves the risky ones.

    A held call waits while a reviewer sees who, which agent, which tool and the exact inputs, then approves or denies. Each rule sets a deadline and what happens if nobody answers, usually deny.

  6. 06

    Changed tools are stopped.

    Every tool is fingerprinted. If a tool's description or inputs change, the change is flagged, and with drift protection on, the tool is blocked until someone re-approves it. Descriptions are also screened for hidden instructions.

What you can do with it
  1. 01

    Data checked in both directions.

    Scanners look for personal data and credentials in what an agent sends and what a tool returns, and can block on a hit. A result that points to a site outside your approved list is stopped before the agent reads it.

  2. 02

    Hundreds of tools, a small context.

    Agents start with a search tool instead of every tool at once, so the model stays fast and cheap. A support agent can preload its support tools and never see the data warehouse.

  3. 03

    Runs inside your network, too.

    For internal tools that can't be reached from the internet, the gateway can run in your own network. Tool traffic stays inside; rules, approvals and the record work the same.

In the record61 tools · 9 upstreams · one URL in the example tenant · offboard a person and every grant goes with them

In practice
mcp-gateway · decision log · today
  1. notion.search · "Q3 board deck"cowork-research · m.chen · read · runs as m.chen allow
  2. stripe.create_refund · $2,400ops-bot · j.ortiz · payments need approval · 15 min hold
  3. github.delete_repositorycursor · r.diaz · destructive tools denied block
  4. zendesk.get_ticket · result has a card numbersupport-agent · a.kim · DLP · result stopped before the agent read it block
  5. linear.search_issues · description changedany caller · fingerprint drift · awaiting re-approval block
Where it leads
Next · 05 ProveEvery call through the gateway leaves a record: who, which agent, which tool, what was decided and which rule decided it. Export it, and the question "what did AI touch last quarter?" has a one-query answer.

Put one governed door in front of every AI tool.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF