Speakeasy vs TrueFoundry: Choosing a control plane for your company's AI

Many of the MCP servers your developers connect to their coding agents run on their own laptops. That traffic never crosses the network, so a gateway on its own can't tell you which servers exist or who uses them.

Speakeasy finds those servers in the agent session, sends each one to an access review, and lets you test guardrails on past sessions before they block anyone. TrueFoundry governs the traffic that reaches its AI gateway, and its hooks can check a local server's tool calls, but the servers themselves don't join an inventory. Below, we compare the two on each point, then feature by feature.

MoonPay runs Speakeasy in production across more than 200 MCP servers and 60,000 agent sessions. A 30-day proof of concept led to a company-wide rollout, with Okta-backed permissions by team, server, and tool, and unsanctioned MCP servers blocked by default. Read the MoonPay case study.

Speakeasy vs TrueFoundry comparison

Enterprise readiness and track record

Speakeasy's gateway runs in production at companies with large, security-sensitive MCP estates. MoonPay's security operations team describes the change directly:

"Employees were connecting MCP servers we had no inventory of. Now every server runs behind the gateway, scoped by team and role, and anything unsanctioned is blocked by default."

Thierry Dang, Security Operations, MoonPay

Google, Fivetran, PlanetScale, LaunchDarkly, and Polar run MCP servers built on Speakeasy:

• Google moved the Gemini API SDKs to Speakeasy after its previous generation vendor was acquired and shut down, then built the Gemini Docs MCP server with Speakeasy on the same foundation. Google chose Speakeasy for continuity, on the commitment that Speakeasy would open source its generators so the tooling behind Gemini's SDKs and MCP server could not disappear again. The Docs MCP server gives coding agents current Gemini API documentation instead of stale training data, and ships pre-bundled in Antigravity.
• Fivetran exposed its Connector SDK and platform APIs as a hosted MCP server without spending weeks on infrastructure, an OAuth server, and client compatibility testing. Fivetran's Eli Davis calls Speakeasy's AI control plane "indispensable in enabling Fivetran's AI transformation."
• PlanetScale grew usage of its MCP server 44 times over in five months.
• LaunchDarkly built an MCP server that lets agents create feature flags, configure targeting rules, and manage rollouts.
• Polar moved from a local MCP server to a hosted one that turns a plain-language pricing description into a working billing setup.

Support is measured against service-level commitments rather than best effort. Speakeasy has met every response-time commitment across its support tiers, and 90% of support requests are answered in under 24 minutes.

Why choose Speakeasy as your AI control plane over TrueFoundry?

Inventory local MCP servers

Many MCP servers run locally as child processes of the coding agent, so their traffic never crosses the network. Speakeasy reads each tool call's server from the agent session and adds unmanaged servers to the shadow MCP inventory, alongside remote servers. Tool Logs show who called each one and from which agent, so security has a starting point for every review.

For local servers, TrueFoundry offers managed client settings that allowlist them or switch them off, and hooks that check their tool calls.

Approve shadow servers by role

When employees find a useful MCP server on their own, Speakeasy lets security approve it for the people and roles who need it, while it stays blocked for everyone else. In TrueFoundry, the same outcome takes a gateway registration, an access grant, and an update to the connector list your MDM pushes to managed devices.

The decision rests on evidence Speakeasy gathers in the server's access review: who is calling it and from which agent, the OAuth scopes it asks for, and its declared tools are all flagged where they look destructive. Speakeasy enforces the decision across every blocking policy and keeps its rationale in the review's history for the next request. In TrueFoundry, a server enters governance once someone with permission to create MCP servers registers it at the gateway.

The review also holds domain and registry history and published advisories, with a frozen evidence snapshot for each decision. Approved servers are rechecked daily; new tools, broader scopes, or changed authentication trigger re-review. A blocked employee can request access through the tool's error message or a device-agent notification, and the request lands beside the existing evidence. Security can approve a narrow audience without silently approving the server for the whole company.

Once the marketplace and client setup are complete, Speakeasy's role-assigned plugins publish the approved servers to supported coding clients; the device agent applies assignments on enrolled machines. TrueFoundry also supports automated distribution: its MDM deployment scripts generate different client configurations from one shared connector list, rather than requiring an admin to maintain each list separately. Users then authenticate as themselves. Speakeasy's distinction is connecting server access and role-plugin contents to directory roles in the control plane, while TrueFoundry maintains the delivered connector set through deployment configuration.

Approved servers can sit together behind one Speakeasy gateway endpoint, which gives the agent tool schemas only when it needs them, so a growing catalog doesn't fill its context. For internal APIs, Speakeasy builds tools from your OpenAPI document or TypeScript functions. In TrueFoundry, custom logic runs as a separately deployed MCP server.

Test guardrails on past sessions

The risks that matter most are often specific to the business: a refund issued without prior authorization, or a delete against production. In Speakeasy, a security team writes that rule as a plain-language guardrail, and an LLM judge evaluates each message in scope against it. TrueFoundry supports provider integrations, such as Bedrock Guardrails and Gray Swan, and customer-built guardrail services. Its custom-service contract passes request context and, for MCP calls authenticated with a JWT, verified claims that the service can use for its own authorization logic.

Speakeasy removes the need to build and deploy that separate service for a contextual rule. The admin writes it, scopes it to the relevant traffic and people, and evaluates it in the same interface used to enforce it. TrueFoundry's extension model is useful when a team already operates a specialized classifier; Speakeasy gives security teams a policy-authoring and review workflow without making them service owners.

Before the guardrail goes live, Speakeasy replays it against recent agent sessions, showing each verdict with its confidence and rationale. Marking verdicts right or wrong builds a scorecard that persists with the policy, so every later edit is measured against the same review set. TrueFoundry tests a guardrail on prompts sent from its Playground, then rolls it out in Audit mode, which logs what it catches on live traffic.

When a guardrail fires, Speakeasy can quarantine the session. It denies the matching event and blocks every further prompt and tool call in the session until an admin releases it. TrueFoundry's guardrails check each model request and tool call as it passes through, and decide call by call.

Session enforcement and gateway enforcement have different boundaries. Speakeasy's MCP-scoped policies check requests before forwarding and results before release, but offer logging or denial, not session quarantine. They inspect the first 50 KiB and allow the call through on an oversized payload or scan timeout. Session prompt-based policies separately support a fail-open or fail-closed choice on judge errors. TrueFoundry also makes error handling configurable: a custom guardrail should return a successful HTTP response with a deny verdict for a policy rejection, so an ignore-on-error strategy does not mistake it for a failed service. Identity permissions remain the deterministic control for tools that a caller must never use.

Resolve access without broadening it

Both products restrict individual tools. Speakeasy's team access connects grants to people, roles, directory groups, and agents, with blocks overriding overlapping grants. An administrator can let support read invoices while withholding destructive actions on the same server.

Where Authorization Challenges are enabled, a denied request shows the identity, resource, and missing permission, then opens the grant flow for a member's role. That turns an access failure into a precise administrative action. TrueFoundry provides server and tool permissions at its gateway, including policy integrations with Cedar and OPA. Speakeasy's advantage is the path from a recorded denial to the narrow grant, alongside the review that brought the server into governance.

Beyond the gateway: enterprise AI governance

Investigate agent sessions

Speakeasy's Agent Sessions view answers the question "what happened around this tool call?" It joins the transcript, tool telemetry, and risk results by session, masks sensitive matches, and links the finding to the exact message. Watchdog groups related findings so security teams can investigate a short list of signals rather than a long list of repeated matches.

An investigator can follow a signal to the people and teams affected, then open the conversation around the tool call. Transcript access requires a separate permission and is audit-logged; sensitive matches stay redacted until revealed, and each reveal is also audited. A recurring false positive can become an exclusion, while a real risk can lead to a blocked server or a stronger policy. TrueFoundry's gateway traces provide request and user attribution; Speakeasy connects that call to the captured coding-agent session and the policy-response workflow.

Logging controls keep session capture and stored tool payloads off until an admin enables them. Stored sessions and tool logs have 90-day retention. OTLP exports separate product telemetry, risk findings, and gateway tool logs, with sensitive content excluded from new destinations by default.

Maintain instructions as well as connections

An approved server can still be used badly by an agent following outdated instructions. Speakeasy manages Skills as immutable, content-addressed versions distributed alongside servers in plugins. Teams can compare versions, pin a distribution, restore earlier content, and review which machines use each version. Activations, sampled efficacy, cost, and agent feedback show whether the instructions are helping.

That makes a rollout more than a connector-file update. A platform team can publish the approved billing tools with the instructions for handling refunds, investigate a behavior change against the instruction version, and roll back the content without rewriting history. TrueFoundry's managed connector lists and custom guardrail services govern connection and execution; Speakeasy additionally manages the instruction artifact that employees' coding agents load.

Extend evidence beyond routed requests

Speakeasy's AI integrations bring Anthropic and OpenAI compliance data and Cursor usage and spend into the platform. Compliance imports provide post-event evidence; Anthropic inference hooks and LiteLLM integrations are separate preventive policy points. The device agent also supports configured Claude Code web and Cursor Cloud environments, with capture attributed to dedicated enrollment identities in shared environments.

TrueFoundry's client settings and hooks extend governance beyond a remote MCP connection too. Speakeasy connects that activity to the full administrative workflow: discover the server in instrumented usage, review it, distribute the approved configuration, investigate the session, and maintain the instructions that led to the call.

Speakeasy vs TrueFoundry feature comparison

Connect and distribute

Access control

Guardrails

Observe

Enterprise deployment and assurance

Speakeasy's platform security documentation covers SOC 2 Type II, ISO 27001, encrypted credentials, customer-managed encryption keys, and configurable storage of transcripts and tool inputs and outputs.

For private systems, internal MCP tunnels create an outbound connection from your network, so the backend needs no public IP or inbound firewall rule. On the client side, Tailscale private access puts selected MCP endpoints on your tailnet. Setting an endpoint to Private only closes its public route, with no automatic public fallback.

TrueFoundry's SaaS security documentation lists SOC 2 Type II, GDPR, and HIPAA programs, and its deployment documentation also states ISO 27001 compliance.

When TrueFoundry may fit

TrueFoundry is a reasonable choice for a narrower set of needs:

• Model routing: TrueFoundry routes application requests across model providers with failover, caching, and budgets.
• Self-hosted ML infrastructure: TrueFoundry has a strong focus on self-hosting, with Kubernetes-native model serving and training, including air-gapped deployments.
• An existing guardrail stack: Its gateway attaches provider or customer-built guardrail services, alongside Cedar or OPA authorization policies, to centrally routed requests.

If the priority is finding local MCP servers, approving shadow MCP for selected people or roles, and testing policies against real sessions, the sections above show where Speakeasy is stronger.

Why Speakeasy is the better choice

• Local MCP servers join the inventory. Speakeasy finds the stdio servers employees run on their machines in the agent session, next to the remote servers they use.
• Unapproved servers go through a review. Reviewers see who calls each server and what it asks for, then approve it for selected people or roles.
• Approved servers arrive by role. Plugins assigned to roles or directory groups deliver them to Claude Code, Cursor, Codex, and GitHub Copilot.
• Guardrails are written in plain language and tested on past sessions. Check each verdict and the scorecard before you turn on enforcement.
• Risky sessions are contained. When a guardrail fires, the session freezes until an admin releases it.
• Usage follows the org chart. Each person's department and cost center come from directory sync, so reports group the way your company is organized.