Skip to main content
Gartner® adds agentic AI to the Global Attack Surface Grid.
SecureAuthSecureAuth

MCP Authority

Authorize every MCP call, down to the arguments

MCP Authority is an MCP gateway, and much more: five pillars built as one system, for enterprise scale, data privacy and fast adoption.

  1. MCP Gateway
  2. MCP Catalog
  3. Self-service access
  4. Authorization & data protection
  5. MCP Security

At a glance

What's in MCP Authority

Authorization depth

Every call is decided on the whole chain

A gateway asks whether a server can be reached. MCP Authority asks whether this person's agent should run this tool, with these arguments, right now.

  • Each agent run gets its own identity
  • Every tool call is authorized in real time
  • Responses are filtered before the agent sees them

Why MCP Authority

How deep authorization goes

Depth is what decides whether an agent can do real damage. Here is every layer MCP Authority checks on each call.

A typical MCP gateway

  1. 1. MCP serverChecked: Reachable or not
  2. 2. ToolChecked: Shared key or server-level roles
  3. 3. Person and groupNot checked
  4. 4. AgentNot checked
  5. 5. Arguments inside the requestPassed through
  6. 6. Response dataPassed through
  7. 7. Live risk: anomalies and findingsNot checked

MCP Authority

SecureAuth
  1. 1. MCP serverChecked: Approved servers, picked by tag
  2. 2. ToolChecked: A specific tool, or any tool
  3. 3. Person and groupChecked: Groups from Okta or Entra
  4. 4. AgentChecked: Its own identity, every run
  5. 5. Arguments inside the requestChecked: Conditions look inside the call
  6. 6. Response dataChecked: Redacted before the agent sees it
  7. 7. Live risk: anomalies and findingsChecked: Checked on every call

Closed loop

Authorization that learns from what it sees

What an agent has just been doing should change what it can do next. MCP Authority feeds what it detects back into the decision.

See how anomalies and findings are raised in Agent Threats & Findings.

  • Anomaly

    An agent's tool calls jump to six times its normal rate. It's flagged, and policy can deny its next call, with no waiting for a person or for a token to expire.

  • Finding

    An agent identity is flagged for a secret that never expires. Policy can keep it off sensitive MCP servers until the finding is fixed.

Pillar 1 · MCP Gateway

One gateway, or one per business unit

Run a single MCP gateway for the whole company, or split it into virtual gateways, such as one per business unit. Each has its own endpoint and its own set of MCP servers, configured to fit how your organization works.

  • Start with one gateway and add more as teams need them
  • Give each business unit only the MCP servers it uses
  • Manage every gateway from the same console

Pillar 1 · MCP Gateway

Works with your stack, no code changes

No agent rewrite and no SDK. You point an MCP-capable agent at the Agent Authority endpoint in its configuration, and each person signs in with their own login.

Connect your sign-in, add your apps, then change one line in each AI tool.

Identity providers

  • SecureAuth
  • Okta
  • Ping Identity
  • Microsoft Entra ID

Agent Authority sits downstream of your IdP and delegates authentication to it. You keep the IdP you have.

Agents

  • Claude Code
  • Cursor
  • Codex
  • GitHub Copilot
  • ChatGPT
  • Gemini
  • Any MCP-capable agent or framework

Every agent connects the same way, so the same rules, redaction and audit trail apply to all of them.

Pillar 2 · MCP Catalog

50+ MCP servers, plus your own

Start from a curated catalog of 50+ MCP servers, including vendors' official servers, grouped by category and listing the tools each one offers. An internal, custom or third-party server you add gets the same registry, access control, policy and audit.

Covers any MCP server

  • Remote MCP servers, hosted by the vendor
  • Your own internal or custom servers, added by URL
  • Local servers on people's machines, found and checked by Endpoint Authority
The Add a resource catalog in the Agent Authority console: connectors grouped by category, such as Communication, Developer tools and Sales & CRM, each showing how many tools it offers. Atlassian, Cloudflare, Datadog, DocuSign, GitHub, Granola, Microsoft 365 Graph, Salesforce, Slack, Vitally and Zoom are marked Added; Apollo, Asana and Box are marked Requested. A Custom server option sits under the categories.
From the Agent Authority console

Pillar 3 · Self-service access

Request a tool, get it approved

Nobody files a ticket. People browse the tools on offer by category, request the one they need, and can withdraw the request if they change their mind. Your Requests queue shows the tool, who asked, how many times and when, so the tools many people ask for stand out and get reviewed first.

  • Once approved, the tool is available to that person's agents under the same rules as everything else
  • People connect with their own work login through MCP OAuth, so there are no shared API keys to manage
Browsing tools by category in the Agent Authority console, on the Docs & knowledge tab: Box is marked Requested with a Withdraw button, and Notion offers a Request button.
From the Agent Authority console
The Requests tab under Tools & Services in the Agent Authority console, listing requested resources such as Apollo, Google Workspace, Miro, Asana and Box, with who requested each, the number of requests, and when each was first and last asked. Requester names are blurred.
From the Agent Authority console

Pillar 4 · Authorization & data protection

Set rules and conditions

Getting a tool approved isn't the same as being allowed to do anything with it. Every call is checked against policy, and each policy reads like a sentence: the agents, the people and groups they act for, the MCP servers, the tools, and an optional condition that looks inside the request itself.

  • Use the groups you already have in Okta or Entra
  • Cut off one misbehaving agent without touching the rest
An allow policy in the Agent Authority console: agents tagged ChatGPT and Microsoft Copilot, used by anyone in the Product and Devs groups, on MCPs tagged For Product Testing and Engineering Apps, may use any tool when a condition on the request body is met.
From the Agent Authority console

  • Same tool, different people

    Product and Devs can use tools on Engineering Apps. Everyone else is refused.

  • Same person, different agent

    Agents tagged Sanctioned can use the GitHub tools. Any other agent is refused the delete-branch tool.

  • Inside the call

    A request whose body is over 10,000 characters is stopped, because the condition looks inside the arguments.

Pillar 4 · Authorization & data protection

Protect data privacy

Apps often send back more than the agent asked for. A redaction policy picks the responses it applies to the same way a rule picks calls, then filters them before they reach the agent.

  • Pattern filters catch exact, known formats such as card or routing numbers and dates of birth
  • An AI judge handles what a pattern can't describe, such as "redact any driver's license or SSN"
  • You choose what happens if the judge fails
A redaction policy in the Agent Authority console for responses from MCPs tagged PII: a pattern-match filter that replaces dates of birth with REDACTED:dob, and an AI judge instructed to redact driver's licenses, SSNs and Medicare Beneficiary Identifiers.
From the Agent Authority console

Pillar 5 · MCP Security

Approved tools can't quietly change

An MCP server's tool definitions tell the agent what each tool does. If they change after you approve the server, MCP Authority flags the change and blocks the tool until an admin re-approves it.

  • Stops "rug pull" attacks, where a trusted tool is changed after you approve it
  • Catches silent schema drift when a vendor updates its server
  • An admin reviews the change, then re-approves the tool or keeps it blocked

Pillar 5 · MCP Security

Every call on the record

The Authority Graph shows who can reach what: which groups use which agents, and the policies standing between them and each MCP server.

The Authority Graph in the Agent Authority console: groups on the left, agents such as Claude, Claude Code, Codex, Copilot and ChatGPT, a membrane of allow and deny policies, and MCP server groups on the right, with allowed and blocked traffic flowing between them. Some policy names are blurred.
From the Agent Authority console

Every call, with the decision behind it

Each tool call is written to Agent Trail, in order: the agent, the person it acted for, the MCP server, the rule that allowed or blocked it, and any redactions. Redactions are recorded as counts only. The matched text is never stored, so the audit trail doesn't become a second copy of the data you were protecting.

Agent Trail in the Agent Authority console, filtered to the Atlassian MCP and the Claude agents, showing tool calls such as searchConfluenceUsingCql and getConfluencePage. One expanded call shows the tool, the MCP server, the agent, the policy decision Allowed by the General Apps Access rule, and one DLP redaction. User names and IP addresses are blurred.
From the Agent Authority console

Deployment

Runs where you need it

Let SecureAuth run MCP Authority for you, or keep it inside your own environment, down to networks with no internet connection.

  • SecureAuth cloud

    Hosted and run for you by SecureAuth, as SaaS.

  • Dedicated or private cloud

    Your own dedicated or private cloud environment.

  • On-premises

    Self-hosted in your own data center.

  • Air-gapped

    For networks with no connection to the internet.

Compliance

  • SOC 2 Type II
  • ISO 27001

Part of Agent Authority

One authority for every path an agent takes

MCP Authority is one of three enforcement paths in Agent Authority, alongside LLM Authority and Endpoint Authority.

Agent Authority

One policy on every path

From

Employees and desktop agents

Endpoint Authority

Discover AI apps, block unsanctioned tools

To

Local files and shadow AI

From

Agents calling tools over MCP

MCP Authority

Authorize every tool call, scoped to the task

To

Enterprise apps and data

From

Prompts from users and agents

LLM Authority

Redact sensitive data, stop prompt injection

To

Model providers

MCP Authority FAQ

Is MCP Authority an MCP gateway?

Yes. MCP Authority is an MCP gateway: your AI tools connect to one endpoint, and every MCP call passes through it. It is also more than a gateway. It brings five pillars together as one system: the MCP gateway, a catalog of 50+ MCP servers plus your own, self-service access with approval, fine-grained authorization with data protection, and MCP security such as blocking tools that change after approval.

What is an MCP gateway, and how is MCP Authority different from an MCP proxy?

An MCP gateway puts your MCP servers behind one URL, so AI tools connect to it instead of to each server. A plain MCP proxy stops there: it routes the calls. MCP Authority adds a catalog of MCP servers, self-service requests with admin approval, a policy check on every call against both the person and the agent, redaction of sensitive data in responses, and an audit trail of who did what and why.

How deep does MCP authorization go?

A typical MCP gateway checks whether a server can be reached and which tools it offers, using a shared key or server-level roles. MCP Authority checks the MCP server and the tool, then the person and their groups, the agent acting for them with its own identity for each run, and conditions on the arguments inside the request. Responses are filtered before the agent sees them, and Agent Trail records each decision with the rule that made it.

Can anomalies and findings change what an agent is allowed to do?

Yes. Anomalies are measured against each agent's own baseline, and findings flag risky agent identities. Policy can take both into account, for example by denying an anomalous agent's next call, or by keeping a flagged identity off sensitive MCP servers until the finding is fixed.

How do people sign in to MCP servers through MCP Authority?

Each person connects with their own work login through MCP OAuth, so there are no shared API keys to manage. Groups come from the identity provider you already use, such as Okta or Entra, and policies can use them directly.

Can different teams see different MCP servers?

Yes. You can run one MCP gateway for the whole company or split it into virtual gateways, such as one per business unit, each with its own endpoint and its own set of MCP servers. Every call is still checked against policy, so the same server can let one team's agents through and refuse another's.

Which MCP servers can we connect to MCP Authority?

Start with a curated catalog of 50+ MCP servers, including vendors' official servers, grouped by category. You can also add your own internal, custom or third-party MCP server by URL, and it gets the same registry, access control, policy and audit as a catalog server. Local MCP servers running on people's machines are found and checked by Endpoint Authority.

What happens if an approved MCP tool changes?

If an approved MCP server's tool definitions change after approval, MCP Authority flags the change and blocks the tool until an admin re-approves it. That protects you against "rug pull" attacks, where a trusted tool is changed after you approve it, and against silent schema drift from a vendor.

How does MCP Authority protect sensitive data?

Redaction policies filter responses from MCP servers before they reach the agent. Pattern filters catch known formats such as card numbers and dates of birth, an AI judge handles what a pattern can't describe, and you choose what happens if the judge fails. Redactions are logged as counts only, so the matched text is never stored.

Where can MCP Authority run?

MCP Authority runs in the SecureAuth-hosted cloud as SaaS, in a dedicated or private cloud, on-premises as a self-hosted deployment, or in an air-gapped environment. It is covered by SOC 2 Type II and ISO 27001.

Do agents need code changes to use MCP Authority?

No. There is no agent rewrite and no SDK: you point the AI tool at your gateway URL, which is one line in its MCP configuration. Each person then signs in with their own work login.

Give your agents the tools, keep the guardrails

14-day free trial. Your own Agent Authority tenant.

Start free trial