Assess your first MCP tool surface.

Managed gateway

Place reviewed remote reads behind the production boundary.

After the organization identity is bound, an authorized operator creates a named environment, selects its reviewed release, and can suspend or resume that environment independently. In Source review, the operator enters a public HTTPS MCP endpoint and stores its normalized catalog and deterministic assessment as an immutable revision. If that public source requires an HTTP bearer, the operator enters it through the environment's write-only credential path; the gateway encrypts it for that exact environment and source, returns metadata only, and applies rotation or removal on the next dispatch across replicas. For a source with standards-based OAuth metadata, an organization-wide operator configures its registered client and exact scopes. Each member then connects a personal upstream account for one environment and source through authorization code and PKCE S256. The encrypted grant is resolved only for that member's interactive MCP session, refresh is serialized across replicas, and disconnect denies the next call. Automation credentials never inherit or borrow personal upstream authority. An immediate or fixed-interval catalog check stores changed material in an immutable review queue with a semantic diff for server identity, assessment fields, tools, schemas, annotations, and findings. Checks never call tools, and observation alone never changes a reviewed revision, release candidate, credential, or runtime. An organization-wide operator accepts or dismisses each change with a recorded reason; only acceptance creates the next reviewed revision. The operator curates one to 25 tools across one to five current source revisions. Each member explicitly declares read-only and non-destructive behavior, preserves its exact source and upstream identity, and receives a unique reviewed public contract. Publication runs nine required input, authorization, output, destination, and evidence gates for each selected tool. Passed and failed attempts retain safe case outcomes, digests, and bounded dispatch facts without payloads. The complete candidate is published atomically as a signed inactive release only when every exact retained attempt passes, then activated in a separate confirmed action. Activating an earlier signed release performs an explicit rollback and adds another activation-history record. In the Controls workspace, the operator compares retained releases against immutable versioned profiles and binds one exact profile to the environment with a reason, confirmation, and current revision. The reviewed profile preserves the complete read-only boundary; the public-anonymous profile accepts only public tools with no upstream authority; the authenticated business profile accepts public, internal, or confidential tools with a reviewed shared bearer or member OAuth grant. The same evaluator blocks incompatible binding and activation and runs again before dispatch. Controls can also stop or resume the whole organization, one reviewed source across its active environments, one environment, release member, principal, or credential. Source stops remove only that source's members. The organization stop blocks managed discovery and execution while sign-in, administration, evidence reads, and resume remain available.

After activation, use Access to connect an interactive client through browser consent or issue a named, expiring automation credential. OAuth sessions bind the signed-in member, client, environment, and exact approved tools; their short-lived access tokens rotate within a bounded session that can be revoked on the next request. Automation credentials retain a separate lifecycle and explicit tool subset. Request managed access for the initial organization binding, or read the complete enforced workflow.