Skip to content

Vekri Gateway

Every agent tool call, authorized at runtime.

Agents reach your systems through one MCP gateway. Each call is checked against a verified identity, a server-issued scope and Cedar policy, privileged writes wait for a person's approval, a broker executes with credentials the agent never sees, and each result is inspected for prompt injection before the agent reads it.

Contact SalesRequest a Demo

  • One enforcement point

    Every agent tool call to a protected system passes the same checks, whichever agent or person made it.

  • Least privilege that holds

    Agents get only the operations, resources and time window you grant, and privileged changes need a second person.

  • Evidence, not guesses

    Each decision records who, what, which policy and why, ready for investigation and audit.

See it work

Vekri Gateway, step by step.

Vekri Gateway: runtime authorization
Illustrative data

Claude Code

Erin's agent

get_repository · payments-apilist_pull_requests · secrets-vault

Identity

SSO session verified

Assignment scope

Out of scope: denied

Cedar policy

permit

Broker

GitHub App credential

Stays here. The agent's token is never forwarded.

GitHub

acme/payments-api

Executed · 200

Audit evidence

  • Allowedgithub.get_repositoryacme/payments-api · user:erin · assignment GitHub for Engineering · outcome succeeded
  • Deniedgithub.list_pull_requestsacme/secrets-vault · user:erin · ASSIGNMENT_SCOPE_DENIED · not executed

What happens

Capabilities

What Vekri Gateway does.

Each item is in the current release and verified by tests in the product repository, with its limits beside it.

  • Verified workload identity

    Agents running as workloads prove who they are with Kubernetes service-account tokens, checked with TokenReview, or SPIFFE X.509 certificates from a configured trust bundle.

    Vekri Gateway (remote MCP) · Kubernetes

    Limit: SPIFFE uses X.509-SVIDs from a trust bundle; the Workload API is not integrated.

  • OAuth-protected MCP gateway

    Agents reach systems through one MCP gateway. Every request carries a token for exactly one connector, verified on each call; incoming tokens are never forwarded.

    Vekri Gateway (remote MCP) · Kubernetes

    Limit: Vekri is a boundary only when the gateway is the only path to the protected system.

  • Server-issued scope

    A run scope for workloads, or a protected access assignment for employees, bounds which operations and resources a call may touch. The effective permission is always an intersection.

    Vekri Gateway (remote MCP) · Kubernetes

  • Cedar policy, deny by default

    Typed operations are evaluated with Cedar. Unknown operations and policy errors are denied, and a policy revision can be simulated before it is published.

    Vekri Gateway (remote MCP) · local MCP gateway · Kubernetes

  • Exact-operation approvals

    A privileged write waits for another person to approve that exact operation. The approval is bound to the request's digest, short-lived and single use.

    Vekri Gateway (remote MCP) · local MCP gateway · Kubernetes

  • Credential broker

    The broker executes each allowed operation with its own narrowly scoped Kubernetes or GitHub App credential. The agent never receives it.

    Vekri Gateway (remote MCP) · Kubernetes

  • Durable audit evidence

    Intent is recorded before a write executes and the outcome after; an uncertain outcome is flagged, never retried blindly.

    Vekri Gateway (remote MCP) · Kubernetes

  • Prompt-injection detection on Vekri Gateway

    Each tool result is inspected for instructions aimed at the agent after the operation runs and before the agent reads it. Policy can deliver it, replace the matching text, withhold it, or hold it for a person to release once.

    Vekri Gateway (remote MCP) · Kubernetes

    Limit: Detection misses some paraphrased injections: on a held-out test set the default configuration found 59% at an 8% false-positive rate.

  • Embedded prompt-injection classifier

    Rules on normalized and decoded text, and a classifier model embedded in the Vekri binaries. It runs without a network call or a separate service.

    Vekri Gateway (remote MCP) · local MCP gateway · Kubernetes, macOS, Linux

Connectors

The systems agents reach through Vekri Gateway.

Each connector is a finite set of typed operations, with no generic HTTP, SQL or shell tool. An API without one can be reached through the operations you enable from its OpenAPI description.

Available

  • KubernetesAvailableInfrastructureTyped Kubernetes operations (list pods, read logs and deployments, restart a deployment) limited to allowed namespaces.
  • GitHubAvailableSource controlTyped GitHub operations on allowed repositories, executed with a GitHub App installation token limited to those repositories and permissions.

Preview

In preview now. Talk to us about trying them.

Source control

  • GitLabPreviewTyped operations on approved GitLab projects: issues, merge requests, pipelines and text files, with read and write tokens checked with GitLab.

Databases

  • MongoDBPreviewApproved find, aggregate and count templates whose typed parameters can never become query operators, through a read-only user.
  • MySQLPreviewApproved, read-only query templates with typed parameters, through a login whose grants are checked to allow reading only.
  • PostgreSQLPreviewApproved, read-only query templates with typed parameters, through a dedicated read-only login; agents never send SQL.

Collaboration

  • SlackPreviewReads approved channels and posts to them as one Slack app's bot, never in direct messages and without mass mentions.

Task management

  • AsanaPreviewReads, creates, comments on and completes tasks in approved projects, each task checked against its project.
  • ClickUpPreviewReads, creates, comments on and changes the status of tasks in approved lists, each task checked against its list.
  • Jira CloudPreviewSearches, reads, comments on, edits and transitions issues in approved projects; Vekri writes the search query from typed filters.
  • LinearPreviewReads, creates, comments on and moves issues in approved teams, through fixed GraphQL documents only.
  • monday.comPreviewReads, creates, posts updates on and changes the status of items on approved boards, through fixed GraphQL documents only.

CRM

  • HubSpotPreviewSearches and reads contacts, companies and deals, returning only the properties you configure, and creates, updates and adds notes to records.
  • PipedrivePreviewSearches and reads persons, organizations and deals, returning only the fields you configure, and creates, updates and adds notes to records.

Customer support

  • FreshdeskPreviewSearches, reads and updates tickets in approved groups and adds private notes; a reply to the customer always needs a person's approval.
  • ZendeskPreviewSearches, reads and updates tickets in approved groups and adds internal notes; a public reply to the customer always needs a person's approval.

Custom

  • Custom (OpenAPI)PreviewReaches an HTTP API no connector covers through the operations you enable from its OpenAPI description, each classified read, write or privileged; arguments are checked against the description.

Product names are trademarks of their owners and are used only to identify the systems Vekri connects to.

Scope

What it does not claim.

Security tools earn trust by being exact about their limits.
  • Vekri is a boundary only when the gateway is the only path to the protected system: network policy and credentials must leave no direct route.
  • Prompt-injection detection is a signal, not a guarantee; it misses some paraphrased injections.

The platform

Works with the rest of Vekri.

Capabilities that use Vekri Gateway

How Vekri Gateway compares with other tools

Contact Sales

See Vekri with your own AI applications, agents and systems.

Talk to us about the AI your organization uses, the systems agents reach and how you deploy: in Vekri's cloud, or inside your own Kubernetes cluster.

Contact SalesRequest a Demo