Product
Agents use your tools. Without holding your keys.
The agent sends a placeholder. The gateway swaps in the real token on the way out, logs the request, and blocks anything you have not allowed. Credentials never enter the model context or the trajectory you might later share.
What happens on an outbound call
The agent calls out with a placeholder
Its code references a binding name, not a secret. Nothing sensitive is ever in the prompt, the context window, or the saved trajectory.
The gateway checks the request against policy
Host, path, and method are matched against your rules. An LLM judge can evaluate outgoing request intent when static allow and deny lists are not enough. Anything denied never leaves the machine.
The real credential is injected at egress
The token is attached on the way out, so the API sees a properly authenticated request and the agent never sees the key.
The call is logged, per request
Who, what, where, and when, on every outbound call. Export it to your SIEM so an audit question becomes a query instead of a meeting.
What you get
Credentials
Tokens the agent cannot read
Secrets live in the gateway and are injected at the boundary. A leaked transcript does not leak your GitHub token.
Egress policy
Host, path, and LLM judge
Allow and deny by host and path, plus an LLM judge on outgoing requests that can block calls static rules miss. Scope each computer to the APIs it needs without maintaining an endless blocklist.
Audit
A trail per request
Every call an agent made is recorded and exportable, which is usually the first thing security asks for and the hardest thing to add later.
Integrations
GitHub, Linear, Jira, Slack, databases
Connect a provider once and scope it per team or per run, rather than minting long-lived tokens for each new workflow.
Where teams use it
Common questions
Why not just give the agent an API key?
Anything in the agent context can end up in a log, a saved trajectory, or a bug report you paste into a ticket. Injecting at egress means the credential is never somewhere it can leak from.
Can we block the open internet entirely?
Yes. Deny by default and allow only the hosts a workflow needs. Calls to anything else fail inside the machine and show up in the log as denied.
Does the gateway see our secrets?
It holds the credentials it injects, which is the point of the boundary. Run it in your own VPC under BYOC if those secrets cannot leave your account.
Can policies differ per team?
Yes. Gateway profiles let you scope access per team, per workflow, or per run, which is how most teams roll agents out gradually instead of all at once.
Where does the audit trail go?
Export it to your existing SIEM or log sink. Teams generally want agent activity in the same place as everything else they already review.