Know what you’re
putting in reach.
Discover MCP servers, assess their tools, and approve the versions your teams can use. Reopen review when the tool surface changes.
“Is this still the tool we approved?”
Use cases / MCP
Give agents tools.
Not unchecked
authority.
Approve the servers. Authorize the action. Govern MCP tool use with business-aware policies, human approvals, and evidence—across the AI stack you already run.
Keep your agents. Keep your gateway. Add authority.
One tool. Different decisions.Sample data
MCP SERVER / FINANCE OPERATIONS
payments-mcp.internal
✓ Approved servertools/callrefund_customer{ amount_usd: 8200, destination: "original" }
PAUSENOT DISPATCHED
The tool is trusted. The refund needs approval.
$8,200 exceeds the $5,000 automatic-refund limit. The call is held for Finance.
MEMO MASKED · BUSINESS ARGUMENTS UNCHANGED
Held for Finance
Upstream calls 0No money has moved
POLICY: PAYMENTS-REFUNDS · REV 14Inspect this decision
Demo policy: up to $5,000 allows; $5,001–$10,000 needs Finance. Revision 15 lowers the hard limit to $7,500. External destinations, invalid amounts and untrusted tools deny. Only [DEMO_CARD_1111] in the memo is masked; money and destination are never rewritten.
Show the illustrative request path
The outbound request is a candidate until separate simulated dispatch. PAUSE and DENY are local decisions, not a universal MCP approval protocol.
INCOMING · TOOLS/CALL
{
"jsonrpc": "2.0",
"id": "demo-call-1",
"method": "tools/call",
"params": {
"name": "refund_customer",
"arguments": {
"account": "demo-customer-104",
"amount_usd": 8200,
"destination": "original",
"memo": "Duplicate charge · ticket 4471"
}
}
}OUTBOUND CANDIDATE / STOP
{
"upstream_request": null,
"local_decision": "pause",
"reason": "FINANCE_APPROVAL_REQUIRED",
"approval_required": true
}ILLUSTRATIVE RECORD · DECISION ≠ DISPATCH ≠ RESULT
{
"record_type": "illustrative_browser_demo",
"decision_id": "mcp-demo-001",
"request": {
"tenant": "demo-enterprise",
"agent": "support-agent-07",
"initiating_user": "demo.support@example.test",
"server": "payments-mcp.internal",
"catalog_state": "approved",
"tool": "refund_customer",
"tool_definition": "pinned",
"approved_tool_version": "v3",
"policy": "PAYMENTS-REFUNDS",
"arguments": {
"account": "demo-customer-104",
"amount_usd": 8200,
"destination": "original",
"memo": "Duplicate charge · ticket 4471"
}
},
"request_fingerprint_sha256": "e2d47349a7376e36aa75ce83214d1b1365f1a3dfbc91acdc6cb61990ceb0bfd7",
"effective_request": {
"tenant": "demo-enterprise",
"agent": "support-agent-07",
"initiating_user": "demo.support@example.test",
"server": "payments-mcp.internal",
"catalog_state": "approved",
"tool": "refund_customer",
"tool_definition": "pinned",
"approved_tool_version": "v3",
"policy": "PAYMENTS-REFUNDS",
"arguments": {
"account": "demo-customer-104",
"amount_usd": 8200,
"destination": "original",
"memo": "Duplicate charge · ticket 4471"
}
},
"effective_request_sha256": "e2d47349a7376e36aa75ce83214d1b1365f1a3dfbc91acdc6cb61990ceb0bfd7",
"verdict": "pause",
"display_outcome": "pause",
"reason_code": "FINANCE_APPROVAL_REQUIRED",
"transformation": {
"applied": false,
"rule": "fixed_demo_marker_only",
"fields": [],
"business_arguments_unchanged": true,
"rechecked": true
},
"approval": null,
"dispatch": {
"status": "not_dispatched",
"upstream_calls": 0,
"local_replay_key": "demo-1"
},
"tool_result": null,
"events": [
{
"event": "action.evaluated",
"at": "2026-10-05T09:00:00.000Z",
"verdict": "pause",
"reason": "FINANCE_APPROVAL_REQUIRED"
}
],
"signing": "not_performed_in_browser_demo",
"chain_verification": "not_performed_in_browser_demo"
}Browser simulation only. SHA-256 identifies the demo request; it is not a signature. No MCP server, real approval or payment is connected. The memo transformation is a fixed-marker demonstration, not a sensitive-data detector.
TRUST IS NOT BLANKET PERMISSION
An approved server
isn’t a blank check.
A legitimate tool can still make the wrong change. GovernorAI connects server trust to the live decision—then to the evidence of what happened next.
Know what you’re
Make permission
specific.
Evaluate who is asking, what the tool will do, and the exact arguments. Allow routine work. Safely shape permitted inputs. Pause exceptions. Deny prohibited actions.
“May this agent do this, now?”
Keep the decision
and its consequence.
Connect the policy, approval, dispatch, and tool result in one reviewable trail. Know the difference between permission and execution.
“Who authorized it—and did it run?”
Routine work proceeds with its authorized arguments.
Mask approved fields, then recheck the exact outbound request.
A named human authorizes the specific exception.
The prohibited action does not reach dispatch.
Not just a safer connection. A controlled business action.
See where GovernorAI fitsIn the product
See a tool call decided before it runs, in the console.
Recorded on a demo tenant: governed tool calls decided at the action boundary, a held call with its reason, what each enforcement point (MCP among them) can execute, and the record every decision leaves.
Enforcement, step by step
Real product screens from a demo tenant with seeded activity: the outcome, the rule and the reason for each governed action.
Recorded against a demo tenant with seeded activity. Real product screens, not a mock-up.
DEEP MCP INTEGRATION / INDEPENDENT GOVERNANCE
Your clients. Your gateways.
One policy authority.
Bring governed tool use to developer assistants, enterprise agents, and business workflows. Enforce close to execution without replacing the way your tools connect.
YOUR AGENTSEnterprise agentsCustom workflows & AI applications
YOUR CONNECTIONMCP endpointStandard client-to-server transport
GOVERNORAIAuthorize the actionIdentity + tool + arguments
Allow · Shape · Pause · Deny
Allow · Shape · Pause · Deny
AUTHORIZED DISPATCHYour MCP serverCRM · finance · infrastructure
Keep the MCP server. Add a policy decision before consequential tools execute.
DEVELOPER ASSISTANTSENTERPRISE AGENTSINTERNAL MCP SERVERSSAAS & CLOUD TOOLS
FROM SERVER TRUST TO BUSINESS CONTROL
Control what changes.
Not just what connects.
Make MCP production-ready with controls that follow the tool, the user, and the action—not just an endpoint allowlist.
Trust that survives
a tool change.
Pin the approved tool definition and permissions. Detect drift, quarantine the changed tool, and bring it back for review before it is used again.
Approval holds for
consequential actions.
Hold the call for a named approver and record the decision. An approval does not release the call, and a changed request is a new request. A deny cannot become an approval.
Protection in
both directions.
Inspect tool descriptions, call arguments, and returned content. Mask policy-approved fields and re-evaluate the outbound request. Keep amount and destination authority explicit.
Least privilege
follows the user.
Carry the initiating user and delegated agent identity into the decision. Bound access to the task, tenant, and resource—not a shared credential’s full reach.
Stop one agent.
Keep the rest moving.
Deny the next governed call for an agent, a tool or a namespace, cap a run’s steps, and stop an unsafe sequence without stopping unrelated work.
Evidence you can
hand to a reviewer.
Trace the request, policy, human approval, and execution outcome. Export the evidence, and signed bundles where the deployment enables signing, for independent review.
One policy, from review to execution.
Connect the trusted tool surface to the rule, its rollout and the resulting evidence.
01 · TRUSTDiscover and assess02 · TESTDraft and replay03 · RELEASEVersion and approve04 · PROVEEnforce and review
ONE WORKFLOW. AN EXPLAINABLE RECORD.
“Who approved
that refund?”
Have the answer.
The server was approved. The $8,200 refund was not automatically authorized: it was held for Finance, and Finance’s decision is recorded. An approval does not release the held call.
GovernorAI connects these decisions so security, platform, and audit teams can examine the same story—not reconstruct it from disconnected logs.
Walk through the approvalREFUND WORKFLOW / SAMPLE TRAILRUN MCP-042
- 1Approved tool version identifiedpayments-mcp.internal · refund_customer@v3 · requester and tenant attached
- 2$8,200 request held before dispatchPAYMENTS-REFUNDS
Automatic authority ends at $5,000 - 3Finance decidesNamed approver · the decision is recorded · an approval does not release the call
- 4Nothing dispatched after approvalThe held call is not released · re-running it is a new request the approval does not cover
A permission decision is not proof of execution.
Keep both. Link them.
Keep both. Link them.
BUILT TO WORK WITH YOUR STACK
Already have
a gateway?
Keep it.
Keep the routing, identity, policy and threat controls you already trust. Add independently managed business authority, approval holds and a connected review trail.
Explore the integration pathsCONNECT
Your gateway & IAMRoute traffic, authenticate clients, and manage access to the tools your enterprise exposes.
INSPECT
Your AI security stackAssess suspicious content and behavior. Feed security signals into the action decision.
AUTHORIZE & PROVE
GovernorAIApply the business rule to the exact action. Route exceptions to human authority. Keep the policy, approval, and outcome connected.
ONE GATEWAY
Centralized traffic.
Independent authority.
Let platform teams operate the gateway while Finance, Security and other owners approve consequential business actions. Keep the approval and outcome together.
MANY EXECUTION PATHS
Distributed tools.
One business policy.
Carry the same business rule and review trail across MCP, API and cloud workflows. Govern the action without rebuilding how every team connects.
Keep enterprise GRC as your system of record. Connect action decisions and reviewable evidence to your established control and assurance workflows.
DESIGN-PARTNER EVALUATION
Start with one workflow.
Expand with evidence.
Bring one consequential MCP workflow to a scoped, six-week evaluation. Agree on the controls and measure the result together.
Find the real action path.
Identify the server, tools, owners, permissions, and systems of record. Choose the actions that need a business control.
Test the rule before it blocks.
Replay representative scenarios and compare proposed decisions. Review exceptions and operating overhead with your team.
Release controlled autonomy.
Turn on the agreed controls, exercise approvals and containment, and inspect the evidence before expanding the scope.
Leave with a rollout decision—not another slide deck.Control-outcome matrix · Measured operating profile · Evidence sample · Expansion plan
A FEW PRACTICAL QUESTIONS
Fit into your stack.
Stand up to review.
Does GovernorAI replace my MCP gateway?
No. Add GovernorAI to the governed action path while your gateway keeps discovery, routing, and connectivity. You can also place governance directly in front of an MCP server.
Is approving a server the same as approving an action?
No. Server approval establishes which tool surface may be used. Runtime authorization decides whether a particular user’s agent may invoke a specific tool with the proposed arguments. A human approval records a decision on one held call; it does not release it.
Can we govern both local and remote MCP tools?
The integration experience brings local developer tools and remote enterprise servers under the same policy authority, with mediation at the relevant tool-execution boundary.
What happens when a tool call needs approval?
The call is held before dispatch and routed to the authorized reviewer, whose decision is recorded. An approval does not release the held call: re-running it is a new request, evaluated against the current policy, that the approval does not cover.
How does this work with AI security controls?
Use both. Threat inspection helps identify malicious content and behavior. Action governance determines whether the proposed business operation is permitted. GovernorAI brings the policy, security signals, human authority, and evidence into one decision workflow.
Can GovernorAI change a tool call’s arguments?
Use policy-controlled transformations for approved fields, such as masking sensitive memo content. Re-evaluate the transformed request before dispatch; a required approval holds it. A prohibited payment destination or amount must not be silently changed into an allowed transaction.
More useful agents. Clearer boundaries.
Let the tools do more.
Keep authority with you.
Bring one MCP workflow that can change something important.
Request a briefing One workflow · Agreed success criteria · Direct founder access · Design partner program →
Continue
Runtime EnforcementDecide at the action boundary Inference & Model GovernanceGovern the model call itself Discovery & Shadow AIInventory the AI activity nobody registered Kubernetes & sidecarIn your cluster, on the agent host Shadow AIUnmanaged agents and connections Platform & AI EngineeringGovern without touching the agent