Give every agent a chain of command.
A person approves what your agents can touch. Rules hold that line on every call. Every call leaves a receipt — if it cannot be recorded, it does not run.
https://agw.govna.io/mcp
one address, every client
- Claude
- ChatGPT
- Cursor
- Any MCP client
Four controls, and every one of them only takes access away
None of them can add access — not a permission set, not a rule, not an app update.
Permission sets
Give a team the access its job needs in one click — and nothing more. A permission set proposes; it never grants.
Rules
Stop the wrong call before it ever leaves. Checks run when the tool list is approved, before a call, and after it.
One-call approvals
Keep a person in the loop for the risky call only — bound to that one call, not a category of future ones.
No record, no call.
The record is written before the call goes out. If it cannot be written, the call never reaches the app.
Connected apps
An app update can never quietly widen access. New tools stay hidden, changed tools pause, removed tools stop.
One MCP connection is not one permission model
One credential shared by everyone cannot tell your people apart. Everything using it inherits the widest access anyone was ever given.
Keep the AI security tools you already bought
Govna is the enforcement point, not another scanner. Point it at the vendor your security team already chose — or your own endpoint — and its verdict decides whether the call goes out.
Tool definition
Checked when a tool list is approved — before anyone can select it.
Input
Checked before the call leaves. Deny, require a named approver, or trim what is sent.
Output
Checked on the way back. Oversized or sensitive results are withheld, not logged raw.
Written down before it happens. Receipted after.
If we cannot write down what is about to happen, the call never reaches the app. No record, no call.
We write down this search_records call before it goes out.
The call that went out links to its record written first and a final receipt.
Connect your tools once — not once per vendor
Claude, ChatGPT, Cursor, your own agents, a CLI, a desktop app — every client reaches the same address under the same sign-in and the same approval screen. There is no per-client or per-app variant to build, review or maintain.
{
"mcpServers": {
"govna": {
"url": "https://agw.govna.io/mcp"
}
}
}Runs like the rest of your infrastructure
The parts nobody demos, and every platform team asks about on the second call.
Cap what a session can spend
Set a token budget per permission set. The gateway stops the session when it is used up — before the bill arrives.
Send governance events where you watch
Signed CloudEvents to your SIEM or channel: approvals, denials, tool-list changes, revocations.
Try changes in a test environment first
Production plus named test environments, isolated from each other, so a rule change is never first tried in production.
Let your directory decide who is in
SAML single sign-on and SCIM provisioning. Someone leaves in your directory, their sessions end here.
Keep evidence you cannot quietly edit
Continuous export to write-once storage, alongside the online history your plan keeps searchable.
Pull one session, right now
Revoke a session, a login or a whole app in one action — every session that depended on it ends with it.
Asked in every security review
If the answer is not here, it is in the review view for security leaders.
Open the review viewDoes a permission set grant access?
No. A permission set proposes a login, a set of tools and a time limit. Someone still approves each session, and that approval can only ask for less than the permission set describes.
What happens when a connected app adds a tool?
New tools stay hidden until an admin approves the new list. Tools that changed materially pause, and tools that were removed stop. Nothing widens on its own.
What is kept for each call?
A record written before the call goes out, and a receipt after it, linked to each other. Your plan sets how long that history stays online — from 7 days on Free to 2555 days, a 7-year online history, on Enterprise.
Which clients work with this?
Any client that speaks MCP over Streamable HTTP: Claude, ChatGPT, Cursor, your own agents, CLI tools, desktop apps. They all reach https://agw.govna.io/mcp and pass through the same approval screen.
What if the app we need is not an MCP server?
Point Govna at its OpenAPI description instead. It compiles into a reviewed tool list you approve like any other app — so an internal REST service becomes a governed tool without anyone building an MCP server for it.
Can we start without talking to sales?
Yes. Free is open: 3 members, 2 connected apps, 7 days of history. Paid plans are documented on the pricing page.
Where to go next
Two readers, two different next steps.