One path to every system your agents touch.
Connect a system once and every agent can use it, scoped to the tools it needs, with credentials it never holds and a policy that runs on the reply before the model ever sees it.
21 hosted connectors · 300+ Connect sources · Runs in your VPC
21 hosted MCP servers. 300+ sources behind the same plane.
Hosted connectors expose named tools with auth handled. Everything else in your estate arrives over Kafka, SQL or Iceberg, or as an OpenAPI spec, through Redpanda Connect.
A connector is a set of named tools with auth already handled. ServiceNow, for example, exposes three.
An agent only sees the tools it needs.
A connector can expose dozens of tools, and every schema an agent holds is re-sent on every turn. Two mechanisms keep that list short: scope it yourself, or let the agent find tools at call time with Code Mode.
Every schema is re-sent on every turn, so this is a cost the agent pays continuously, not once.
Tool counts are real. Token figures assume ~170 tokens per tool schema and Code Mode's two tools per connected server: an estimate of the shape, not a measurement.
You are a helpful assistant. Your tools are: list_customers(limit, starting_after) get_customer(id) create_customer(body) update_invoice(id, body) list_payments(limit, status) delete_webhook(id) // + 88 more Internal REST API tools slack_post_message(channel, text, thread_ts) slack_list_channels(types, limit) search_incidents(query, state, limit) get_incident(number) query(sql, params, max_rows) …
// the only tools on this endpoint: search, execute const { tools } = await mcp.search({ query: "open incidents" }) // → servicenow.search_incidents return await mcp.execute(` const open = await tools.servicenow.search_incidents({ query: "active=true", state: "in_progress", limit: 25 }) const tiers = await Promise.all(open.incidents.map(i => tools.postgres.query({ sql: "select tier from accounts where id = $1", params: [i.account_id] }))) return open.incidents.map((i, n) => ({ number: i.number, priority: i.priority, tier: tiers[n].rows[0].tier })) `)
Twenty-six calls become one.
That script fetches 25 incidents and joins each one to its account tier. One at a time that is 26 round trips through the gateway. In the sandbox it is one, which is usually a bigger win than the tokens.
Same gateway, same policy.
The sandbox calls tools through the MCP gateway like anything else, so scoping, redaction and the audit log still apply. Or keep one call at a time and simply scope the list: one OpenAPI spec produced 94 tools, this agent sees 6.
Policy runs before egress, not in a nightly report.
Every tool call is brokered. Fields are masked on the way back and disallowed calls are refused at the gateway, including ones the model was talked into trying.
caller_id.ssn and work_notes are never in the prompt, and never in any log downstream of it.
The model was talked into trying. The gateway did not care; the policy is not in the prompt.
The agent never holds a credential.
Secrets stay in the vault. An agent presents a short-lived, scoped identity and the gateway attaches the real credential at call time, which is why a leaked agent config leaks nothing.
Per-user OAuth
user delegatedEach person signs in with their own account. Tool calls run with that person's identity and permissions, and the audit trail names them.
Good for Slack, Jira, Google Drive. Anywhere the answer depends on who is asking.
Ben Weber · €76,000
Mira Okonkwo · €88,500
Tom Vega · €71,200
Shared credential
service accountAll agents share one stored credential. No individual sign-in; every call uses the same identity, and the secret is a subresource of this server alone.
Good for databases, bot tokens, internal APIs. Where there is one right answer.
One connection, every server that uses it.
A person links their Slack account once. Every per-user MCP server that uses Slack reuses it: no per-server setup, no second consent screen. Revoke it in one place and every server stops acting as them.
Anything that speaks MCP points at one URL.
Sign-in happens in the browser. The client identifies itself by a URL it publishes, so there is no OAuth client to pre-register and nothing left behind to expire.
- Tool calls land in this server's activity tab either way
- Code Mode lets an agent compose tools in a sandbox instead of one call at a time
- Re-run discovery and the tool list updates without touching the agent
$ claude mcp add --transport http --scope user \
redpanda https://mcp.acme-prod.cloud.redpanda.com/v1$ codex mcp add redpanda \
--url https://mcp.acme-prod.cloud.redpanda.com/v1{ "mcpServers": { "redpanda": {
"url": "https://mcp.acme-prod.cloud.redpanda.com/v1"
} } }Build one, or bring your own
Assemble a declarative agent from a model, ready-made tools and a prompt, or register the agent you already wrote and have it inherit the same governance.
How it works →AI GatewayOne endpoint, every model
Your keys and your models behind one OpenAI-compatible endpoint, with routing, failover, per-agent cost attribution and budgets that refuse at the cap.
How it works →Point one agent at it and watch the log.
You will see what it reaches, what got masked, and what it tried that it should not have.