The problem
Handing an autonomous agent a set of MCP tools means trusting it with everything those tools can reach. Most gateways see a chat completion and stop there. They never see the tool call, so they cannot stop a bad one.
How it works
aigw discovers the tools on each MCP server you connect and lets you write policy against them from the console: which tools are allowed, what argument values are permitted, which calls need a human to approve, and how often a tool can run. The agent reaches its tools through aigw, so every call is checked before it runs.
What you can enforce
- Allow-list the tools an agent may call, and block the rest.
- Argument-level guardrails: stop a tool call whose arguments match, or fail to match, a rule you set.
- Human approval in the loop for the calls you flag, resolved from the console while the agent waits.
- Per-tool rate limits.
- Response scanning that redacts secrets before they reach the agent.
- Every tool call in the same tamper-evident audit log as your model calls.
The same controls extend to agent-to-agent calls. See agentic governance for how the policies work.