AgentWorks
Try the demo Book a call

Solutions

GTM Ops Customer support Finance & billing Shopify Ops Marketing & growth Growth & Customer Analytics Engineering Ops All premade agents

Platform

Overview Goals Crews Studio Flows Brain Vault LLM Gateway AgentBridge How we work Blog Try the demo Book a call

Vault · Enterprise

Control which tools your company's AI can use. Every call checked and recorded.

People plug MCP servers into Claude, ChatGPT, Cursor and their own agents, each with its own tokens and no oversight. Vault gives your company one governed MCP endpoint: admins connect servers once, people sign in with the company account, and every tool call is checked against the groups and rules you set.

Book a call See use cases
  • 01
    MCP tokens live on every laptopEach person connects servers with their own keys, so access can't be reviewed or revoked in one place.
  • 02
    Anyone can call any toolThere is no way to say which team may use which server, let alone which individual tool or what it may be asked to do.
  • 03
    Shared secrets get pasted aroundAPI keys and passwords travel through chats and files, with no record of who can use them.

Example goal

Every MCP tool call governed

Primary metricTool calls with a grant and an audit record
100%

of calls through Vault, target 100%. Illustrative numbers.

Use cases

Every call goes through one door. Illustrative examples.

  • Allowed call

    Claude

    1. github · create_issue
    2. Engineering may use it

    Call made and recorded

  • Blocked tool

    Cursor

    1. database · run_query
    2. Not granted to Marketing

    Refused and recorded

  • Rule on inputs

    ChatGPT

    1. jira · create_ticket, project FIN
    2. Rule: project must be SUP
    3. Input not allowed

    Refused, with the reason

  • Shared secret

    Support Crew

    1. Needs the payments API key
    2. Support may use the secret
    3. Value never shown

    Refund looked up, key stayed hidden

  • New tool appears

    Server update

    1. Server adds delete_repo
    2. Held for admin review

    Nobody can call it until approved

  • Access removed

    Admin

    1. Removes a person from a group
    2. Next call checked again

    Their access ends

How it works

Connect once. Govern every call.

  1. Connect servers once

    An admin connects an MCP server with OAuth or a custom setup and approves its tool definitions. Connecting a server gives nobody access.

  2. Grant by group

    Access is deny by default. Give a group individual tools or whole servers, and add rules on a tool's inputs, with exact values or patterns.

  3. Share secrets without showing them

    Let a group use a shared secret without anyone seeing its value.

  4. Everything is recorded

    Each call is checked again against the current groups and rules, and logged with the person and the AI client that made it.

Deny by defaultRuns on your serverEvery call recorded

FAQ

Questions, answered.

Is Vault available?

Yes. It comes with Enterprise. Book a call and we will set it up with you.

Which MCP clients work with it?

Any client that can connect to a remote MCP server, such as Claude, ChatGPT, Cursor and AgentWorks agents. People sign in with the company account, and a client can be disconnected at any time.

Does connecting a server give people access?

No. Access is deny by default. A server's tools reach people only through the groups an admin grants them, and new or changed tool definitions wait for review.

Can a rule limit what a tool is asked to do?

Yes, for the values a tool exposes as inputs, using exact values or full-string patterns. For things like free-form queries or opaque IDs, also use a narrowly scoped credential upstream.

Where does it run?

On your AgentWorks server, in your own cloud or data center.

Also in AgentWorks

The rest of the platform.

GoalsGive an AI agent a goal and a metric. It works toward the target and measures every run.CrewsBuild an expert agent once. Your team asks it from Slack, Claude, ChatGPT or Cursor.FlowsA fixed chain of agents you run from anywhere.BrainShared company knowledge: write it once and every agent reads it.LLM GatewayComing soon: manage model access and see the cost per person.StudioThe online workspace where you build agents and Crews, with skills, tools and integrations ready on day one.

Govern MCP before it sprawls. Set it up with us.

Tell us which MCP servers and AI clients your teams use, and we will set up Vault with you.

Book a call Product overview