AI Agent Security

Each agent gets its own key, tools and limits

Meandr shows each agent only the tools you allow and checks its tool calls against your policies before they run.

Try for free Quick tour video

How it works

How to secure AI agent tool calls

AI agent security in Meandr: give each agent a key, its tools and the policies that name it.

  1. 01 Identity

    Issue a key for the agent

    Add an agent, then issue a key for it under Keys. Meandr keeps only a hash, so the full key appears once, in the Save this key now dialog.

    • Policies and rate limits apply to the agent the key belongs to
    • A key can carry an expiry date

  2. 02 Control

    Control every agent's key from one list

    The workspace's Keys page shows each key's agent, last use and expiry.

    • Rotate a key at any time, and the new one is shown once
    • Revoke a key, and Meandr stops accepting it
    • Filter active or expired keys, from the dashboard or OAuth
    Agents never hold your servers' credentials

  3. 03 Scope

    Choose which tools your agents can use

    A tool has to be switched on twice: your team turns it on in the Server catalog, then a workspace imports it. Policies narrow the choice further for each agent.

    • An agent can call only the tools its policies allow, and the rest don't appear in its tool list
    • Prompts and resource templates from the server work the same way: the agent sees only the ones its policies allow

  4. 04 Policies

    Name the agent or its tag in a policy

    A policy can link to specific agents or match an agent tag. Two agents in one workspace can then get different rules.

    • A call that matches an Approve policy waits for a person to allow or deny it
    • Every call is recorded with the agent that made it and the policy that decided it
    MCP Governance: access control AI Governance: the audit record

What you control

Stay in control of every agent

Cap each agent's calls and contain a tampered prompt.

Contain a tampered prompt

An agent whose prompt is tampered with still reaches only the tools and argument values its policies allow.

Questions about AI agent security

Does Meandr stop prompt injection?
No. Meandr runs no prompt filter or PII scan. Its policies limit which tools an injected agent reaches and which argument values pass.
Do I need to change the agent's code?
No. The agent connects to your Meandr endpoint over standard MCP, Streamable HTTP or SSE, and sends its key as a bearer token.

Set up your first agent

Point each agent at one endpoint with its own key, and your policies apply from its first call.

Try for free

Questions? Email us