AI governance & security · MCP gateway

Put a control plane between your agents and every tool they call.

A wrong delete, a runaway loop, no record — Meandr adds policy, approvals and audit in front.

Get started See how it works

Meandr holds your keys and signs every call.

Your agents get a Meandr token instead — cut one off in a click, and rotating the real credential breaks nothing.

Revoke one agent in a click.

Give an agent a real Stripe key and you're stuck: rotate it and every agent breaks, leave it and the leak stays live.

Big calls wait for a human.

An agent will refund $50,000 if the model decides to — and nothing asks a human first.

A log that names the agent.

Provider logs say the API was called. Not which agent, under what policy, or on whose behalf.

Everything between your agents and your tools.

A control plane, not a router. Meandr aggregates your servers, checks identity, applies policy, throttles, holds calls for approval, and logs every one — for AI agent traffic.

One endpoint, every tool

GitHub, Stripe, Slack, your own services — every MCP server behind one URL per project. Add one in the dashboard and your agents pick it up on their next refresh, no restart.

Human-in-the-loop approvals

Flag the tools that need a person — refunds over a limit, production deploys, anything irreversible. The agent calls, Meandr pauses, you approve, Meandr replays it upstream. The LLM never sees the wait.

Multi-window rate limits

Set caps per second, minute, and hour — independently for a tenant, project, agent, or server. Enforced in real time, so a runaway agent gets throttled, not invoiced.

Policy-driven access

Rules that allow, deny, or require approval — matched on tool, server, agent identity, tag, IP, or headers. Default-deny or default-allow per project. Edits apply live, no restart.

Credentials stay in our vault

Your upstream API keys stay in our vault, encrypted at rest with keys isolated per environment. Agents only ever hold a Meandr token you can rotate in one click — nothing upstream changes.

Per-call audit trail

Every call is one row in the audit log: agent, tool, status, duration, policy decision. Query or export it from the dashboard, kept for your plan's retention window — Enterprise, as long as you need. "What did my agent do last Tuesday" is one query.

How it works

Three steps. One gate.

Watch, configure, or revoke each step on its own. The agent never notices.

01

Intake

Agent calls a tool.

Every tool call from every agent hits Meandr first. We check who's calling, find the tool they want, and get the request ready for the gate.

You configure: agents and tokens, in the dashboard.

02

Policy

Gate checks the rules.

Policies match on agent, tool, IP, headers, and request shape, then answer one of three ways: allow, deny, or require approval. Rate limits run alongside in real time.

You configure: policies (allow/deny/approve) and rate-limit caps.

03

Route

Tool runs, response returns.

An approved call goes to the right upstream server with credentials pulled fresh from our vault. Every decision — allow, deny, approve, error — is one row in the audit log. The agent just gets its response.

You configure: upstream servers, credentials, retention.

Human-in-the-loop

Some calls should pause for a human. The rest shouldn't.

Refunds over a limit, production deploys, anything you can't undo — mark those as approval-required in the dashboard. Your agent's code doesn't change.

When the agent hits one, Meandr holds the call and pings you. Approve from the dashboard or the email, and Meandr replays it upstream byte-for-byte — the agent gets its result like nothing happened.

Learn more about approvals

Integrate in minutes

Integrate in minutes.

One URL in your agent config. Everything else is dashboard work.

  • Connect your MCP servers once in the Meandr console — GitHub, Stripe, Slack, or your own.
  • Write the policy that decides what your agents may call. Until you do, their tool list is empty.
  • Drop one URL into your agent's MCP config. That's the entire change on the agent side.

Create an access key in console.meandr.com — add an agent, then an Access Key — and point your client at Meandr:

{
  "mcpServers": {
    "meandr": {
      "url": "https://<slug>.meandr.io/",
      "headers": {
        "Authorization": "Bearer <your-access-key>"
      }
    }
  }
}

Settings → Connectors → Add custom connector. Name it Meandr, set the URL to https://<slug>.meandr.io/, and sign in once. No token to paste.

Connecting ChatGPT, Codex, Cursor, or a custom client? See the full guide →

Built for the data your agents touch.

A control plane only works if it stays up and keeps secrets. Here's how Meandr keeps your traffic flowing — and your data yours.

Credentials in a vault, not in your agent.

Your upstream API keys live in a vault — encrypted at rest with environment-isolated keys, never exposed to your agents. Agents only ever see Meandr bearer tokens; rotate them in one click without touching upstream.

Every call is auditable.

Per-call records: which agent, which tool, status, duration, policy decision. Queryable from your dashboard, exportable via API, kept for your plan's retention window — Enterprise as long as you need. The audit log is the source of truth for billing reconciliation, compliance reviews, and "what happened" investigations.

High availability at edge locations.

Meandr runs at edge locations close to your agents. Requests terminate at the nearest healthy edge — low latency, and an incident at one location doesn't affect another. Pick the location closest to your workload at project creation; we'll handle the failover.

Security at every layer.

Encryption in transit (TLS 1.2+) and at rest. Token-based authentication with one-click revocation. Per-tenant isolation throughout the request path. Independently keyed environments — credentials in production are never reachable from staging. Audit logging across every layer.

Compliance.

Built to SOC 2 — preparing for the audit. GDPR-aligned (EU SCCs; US processing). DPA on request. Standard sub-processor list maintained at /sub-processors.

Questions you'd ask anyway.

Does it work with the MCP servers I already use?
Yes, if the server speaks HTTP. GitHub, Stripe, Slack, and a growing list of community servers all do — and they all connect the same way.
Will my agent connect, or only the big-name clients?
Any client that can send MCP over HTTP with a bearer header works today: Claude Code, Cursor, Cline, custom OpenAI Assistants, LangChain MCP wrappers. Claude Desktop is the one exception — it connects over OAuth instead, one click to sign in, no token to paste.
What am I actually paying for?
Tool calls that reach an upstream, and nothing else — a call your own policies or rate limits block costs you nothing. Registration is free, so you can sign up, connect your servers, and write policies first, then subscribe when you're ready to send real traffic. The numbers are on the pricing page.
Where does my data actually end up?
On our primary US infrastructure, with Standard Contractual Clauses covering EU, UK, and Swiss transfers. Traffic enters at a regional point close to you before it gets there. Credentials sit encrypted at rest under environment-isolated keys, everything in transit runs TLS 1.2 or newer, and we don't keep upstream payloads in cleartext.
Say an agent's token leaks. Then what?
You revoke it in the dashboard, and it's dead globally within seconds. That's the whole blast radius: your upstream credentials live in our vault, not in your agent, so the leaked token never touched them.
Is any of this open source?
Not today — the core service is closed-source. Some components, like the MCP-spec adapters, may be open-sourced as they stabilise. What you can build against right now: the wire formats and event schemas, which are documented and stable.

Put a control plane between your agents and your tools.

Point your agent at one endpoint and you're governed in minutes — no code changes, no proxy to run.

Get started

Questions? Email us