Resources
Get started with Meandr.
Point an agent at Meandr, connect the tools it should reach, and set the rules. Three short guides take you from zero to a governed setup.
Quickstart
Connect your first agent: one URL and a bearer token in your MCP config. No SDK, no code changes.
Connect a tool server
Add an MCP server, hand Meandr its credentials — API keys, custom headers, basic auth, OAuth, mTLS or AWS SigV4 — and curate what agents see.
Your first policy
Write a rule: allow, deny, or require approval — matched on the agent, the tool, and even the argument values.
Go deeper
Past the setup steps: short reads on the ideas Meandr is built on and the wider MCP landscape — concepts, security and vendor-neutral references you can hand a teammate.
What is an MCP gateway?
What MCP is, why you would put a gateway in front of it, and exactly what Meandr terminates and forwards.
Argument-level policy vs allowlists
Why tool-level allowlists fall short against coarse tools, and how matching on the argument values closes the gap.
AWS SigV4 without a proxy
Why AWS-hosted MCP needs SigV4, why naive relays cannot sign it, and how Meandr signs the exact bytes it forwards.
What belongs in an audit log
What each per-call record holds, metadata by default, opt-in encrypted capture per rule, and how retention scales with your plan.
Approval patterns & one-time codes
How the approve action pauses a call, the ways it can reach a person, and one-time codes as the attribution model.
Team roles & access control
The roles model: account roles and per-project access, so each person sees only the projects they should.
Policy recipe library
Copy-pasteable, plain-language policies: block deletes, require approval over an amount, read-only a server, rate-limit a project.
MCP tool poisoning
A vendor-neutral field guide: what tool poisoning is, the attack classes, the public data on exposed servers, and concrete defenses.
Gateway vs proxy vs router
A decision framework separating a pass-through proxy from a router from a gateway, with a capability table and honest guidance on when each is enough.
OAuth 2.1 & PKCE for MCP
An implementer's guide to how MCP uses OAuth 2.1 and PKCE for agent identity — discovery, dynamic registration, the flow step by step, and the pitfalls.
OWASP Agentic Top 10
Maps the OWASP Top 10 for Agentic Applications to the MCP-layer controls that mitigate each risk — and says where a gateway does not help.
The MCP 2026-07-28 spec
A vendor-neutral reference to the 2026-07-28 MCP specification, read through the lens of anyone running a gateway: statelessness, header routing, auth hardening and the deprecation clock.
Ready when you are.
Point your agent at one endpoint and you're governed in minutes — no code changes, no proxy to run.
Get startedQuestions? Email us