Model Context Protocol Gateway

Every tool call passes through one policy gate.

Meandr sits between your AI agents and every MCP server they use. Aggregate, authenticate, authorise, rate-limit, audit — without changing a single line of agent code.

Get notified at launch See how it works

AI agents shouldn't have direct access to your tools.

Without a control plane, every leaked credential is an incident, every misbehaving agent is a bill, and every "what did my agent do" is an archaeology dig.

No revocation path.

Once an agent has a real Stripe key, you can't rotate cleanly. Rotate upstream — every agent breaks. Don't rotate — the leak walks.

No safety net.

Agents will happily refund $50,000 if the model decides to. There's no built-in "ask a human first" for the calls that matter.

No useful observability.

Provider logs tell you the API was called. They don't tell you which agent, under which policy, on whose behalf, with what context.

Everything between your agent and your tools.

Not just routing — a real control plane. Aggregation, identity, policy, throttling, approval, audit. Built for AI agent traffic from the ground up.

One endpoint, every tool

Aggregate GitHub, Stripe, Slack, your internal services — every MCP your agents need — behind a single URL per project. Add a server in the dashboard; your agents see it on their next refresh. No agent restart.

Human-in-the-loop approvals

Flag specific tools (refunds over a threshold, production deploys, anything irreversible) for owner approval. The agent calls; Meandr pauses; you approve in the dashboard; Meandr replays the call to the upstream. Zero agent code changes — the approval flow is invisible to the LLM.

Multi-window rate limits

Configure caps per second, per minute, per hour — independently across tenant, project, agent, or server dimensions. Real-time enforcement. A runaway agent gets throttled before it bankrupts you.

Policy-driven access

Allow, deny, or require-approval rules — match by tool name, server, agent identity, agent tag, IP, headers. Default-deny or default-allow per project. Policies update live; no proxy restart.

Credentials stay in our vault

Your upstream API keys live in our secured vault, encrypted at rest with environment-isolated keys. Your agents only ever see Meandr bearer tokens that you can rotate in one click — no upstream changes required.

Per-call audit trail

Every tool call lands as one row in your audit log: which agent, which tool, status, duration, policy decision. Queryable from the dashboard, exportable, retained for as long as you need. "What did my agent do last Tuesday" becomes one query.

How it works

Three steps. One gate.

Every step is independently observable, configurable, and revocable. The agent doesn't know any of this is happening.

01

Intake

Agent calls a tool.

Every MCP tool call from every agent hits Meandr first. We authenticate the agent, identify the target tool, and prepare the request for evaluation.

You configure: agents and tokens, in the dashboard.

02

Policy

Gate checks the rules.

Policies match against agent identity, tool target, IP, headers, request shape. The matching policy returns allow, deny, or require-approval. Rate limits across multiple scopes evaluate independently in real time.

You configure: policies (allow/deny/approve) and rate-limit caps.

03

Route

Tool runs, response returns.

Approved calls forward to the right upstream MCP server with the right credentials, fetched fresh from our vault. Every decision — allow, deny, approve, error — lands as one row in your audit log. The agent gets the response and never sees the machinery.

You configure: upstream servers, credentials, retention.

Human-in-the-loop

Some calls should pause for a human. The rest shouldn't.

Refunds over a threshold. Production deploys. Anything irreversible. With Meandr, you tag those tools as approval-required in your dashboard — and your agent's code stays exactly the same.

When the agent makes a flagged call, Meandr captures the intent, pauses the call, and notifies the owner. Approve in the dashboard, on email, on Slack — wherever you're working. Meandr replays the call against the upstream, byte-for-byte. The agent gets the result. No re-architecture.

Learn more about approvals

Integrate in minutes

Integrate in minutes.

One URL in your agent config. Everything else is dashboard work.

  • Connect your MCP servers once — GitHub, Stripe, Slack, your own — in the Meandr dashboard.
  • Define policies, rate limits, approvals (or accept the defaults).
  • Drop one URL into your agent's MCP config — that's the agent change.
{
  "mcpServers": {
    "meandr": {
      "url": "https://<slug>.meandr.io/",
      "headers": {
        "Authorization": "Bearer <your-agent-key>"
      }
    }
  }
}

Same shape — point your client's MCP server config at https://<slug>.meandr.io/ with the bearer header.

Claude Desktop currently only speaks the stdio MCP transport, not HTTP. To connect Claude Desktop to Meandr, install the meandr-cli bridge (coming soon — join the waitlist).

Meandr exposes MCP Streamable HTTP at a single endpoint per project. Point your agent's MCP client at https://<slug>.meandr.io/ with Authorization: Bearer <token>. Your agent's tools/list call returns every tool the agent is permitted to call, automatically filtered by your policies.

Built for the data your agents touch.

The control plane for AI agent traffic has to be the resilient and trustworthy layer. Here's how Meandr keeps your traffic flowing — and your data yours.

Credentials in a vault, not in your agent.

Your upstream API keys live in a secured vault — encrypted at rest with environment-isolated keys, never exposed to your agents. Agents only ever see Meandr bearer tokens; rotate them in one click without touching upstream.

Every call is auditable.

Per-call records: which agent, which tool, status, duration, policy decision. Queryable from your dashboard, exportable via API, retained for up to several years. The audit log is the source of truth for billing reconciliation, compliance reviews, and "what happened" investigations.

High availability at edge locations.

Meandr runs at edge locations close to your agents. Requests terminate at the nearest healthy edge — low latency for your agents, and an incident at one location doesn't affect another. Pick the location closest to your workload at project creation; we'll handle the failover.

Enhanced security at every layer.

Encryption in transit (TLS 1.3) and at rest. Token-based authentication with one-click revocation. Per-tenant isolation throughout the request path. DDoS protection at the edge. Independently keyed environments — credentials in production are never reachable from staging. Audit logging across every layer.

Compliance.

SOC 2 (in progress). GDPR-aligned data residency. DPA on request. Standard sub-processor list maintained at /sub-processors.

Questions you'd ask anyway.

Which MCP servers can I connect?
Any MCP server that speaks HTTP — GitHub, Stripe, Slack, and a growing list of community servers. Support for stdio-only servers (Claude Desktop class) is coming via meandr-cli.
Which agents / MCP clients work today?
Anything that supports the MCP HTTP transport with a bearer header: Claude Code, Cursor, Cline, custom OpenAI Assistants, LangChain MCP wrappers. Claude Desktop is stdio-only today and will work via meandr-cli when that ships.
How does pricing work?
Plans and pricing launch with the product. Join the waitlist and we'll send you the details the day they go live. Our intent: you pay only for tool calls that actually reach upstream — calls blocked by your own policies or rate limits don't count toward usage.
Where does my data live?
At the edge location you choose at project creation. Credentials are encrypted at rest with environment-isolated keys; traffic is encrypted in transit with TLS 1.3. We don't retain upstream payloads in cleartext.
Can I bring my own domain?
Yes — point mcp.acme.com at our edge and we serve the cert. This is coming in a future release.
What happens if my agent's token leaks?
Revoke it in the dashboard. The change propagates globally in seconds. Your upstream credentials were never touched — they live in our vault, not in your agent.
Do you support webhooks or push notifications back to my agent?
Not at launch. We're focused on the agent → tool path first. Push-back-to-agent (server-initiated notifications) is on the roadmap.
Is Meandr open source?
The core service is closed-source today. Some components (the bridge CLI, MCP-spec adapters) may be open-sourced as they stabilise. The wire formats and event schemas are documented and stable.

Ready to put a control plane between your agents and your tools?

Meandr launches soon. Get a heads-up the day it ships.

Get notified at launch

Questions? Email us

Coming soon

Meandr is almost live.

The control plane for MCP is in private build. Leave your email and we'll ping you the moment it ships.

→ Get notified at launch

No spam — one email when we launch.

You're on the list. We'll email you the day Meandr goes live.