Teams / Security
See every agent.Enforce every action.
Agents are reading customer data, writing to production, and connecting MCP servers nobody reviewed. Speakeasy puts one control plane in that path, so every action carries a name, meets policy, and lands in your SIEM.
01 / The problem
Your security stack sits outside the agent loop
SWG, DLP, EDR, and the SIEM watch the perimeter. The agent loop runs inside it, over TLS, where none of them can read it.
Shadow AI
Unmonitored agents are connecting
Any employee can wire an agent to an MCP server in minutes. There is no inventory, no version pin, and no record of which systems it reaches.
Data exfiltration
Sensitive data leaves inside agents
Credentials, PII, and financial records leave in tool payloads and model context that DLP never parses. Nothing in the path inspects them.
Chain of record
No reliable chain of events
Agents act under shared service accounts and long-lived keys. When a refund is issued or a bucket is deleted, nothing links the person, the agent, and the action, making reconstruction impossible.
The browser-based approach we relied on just doesn't work for AI-based workflows.
Thierry Dang
Security Operations
02 / Shadow AI
Every MCP server & Skill, discovered and reviewed
Speakeasy discovers MCP servers & skills as agents try to reach them, gathers the evidence, and puts each one through an approve-or-deny review. Unsanctioned servers are blocked by default, across every agent and every device.
Every MCP server, Skill, and agent this project knows about, observed in agent traffic or raised in an access request, with its review state. Click a row for its evidence, requesters, and decision history.
Blocking
Block policy is enabled. Anything without an allow rule is not allowed.
- Evidence
- First seen Sep 7, 10:42 AM
Last seen Sep 7, 10:42 AM
3 calls from 1 user - Runs as
- Terminal agent · 1 device
- Requesters
- j.chen · Finance
- Decision
- Awaiting review. Blocked by default until a reviewer decides.
01 / Discovered
An inventory you did not have to build
Every MCP server, Skill, and agent shows up the moment an agent reaches for it. Nothing is registered by hand, and nothing is missed because someone forgot to.
Shadow MCP docs02 / Evidence
Every decision backed by evidence
Who used it, from which agents and devices, first and last seen, and any member requests, gathered before anyone has to decide.
Agent sessions03 / Review
Blocked by default
Unsanctioned servers get an evidence-backed access review. Until someone approves, every agent that tries to reach one is stopped at the plane.
MCP gateway04 / Maintained
Enforced and kept current
Decisions apply across every agent and device. Approved traffic stays under watch, and findings rank into signals with the session transcript attached.
Watchdog docs03 / Data exfiltration
Guardrails on every payload, in flight
Secrets, PII, government identifiers, and financial records are detected inside prompts, tool inputs, and model responses, then flagged or blocked by policy before they leave. Every session runs under a real identity, so there is no shared key to leak.
Guardrail findings on prompts, tool inputs, and model responses, each one click from its session.
sarah@acme.org · Claude Code11:18:04
m.ortiz@acme.org · ChatGPT11:17:51
j.chen@acme.org · Cursor11:17:12
d.park@acme.org · Claude11:16:40- Policy
- secrets.aws_access_key → block
- Match
- AKIA••••••••••••F7Q2
- Session
- sarah@acme.org · Claude Code · View transcript
Policies that flag or block in flight
Built-in detectors for secrets, financial data, PII, government identifiers, healthcare data, prompt injection, and destructive tool use. Custom rules in CEL, tested against real sessions before they go live.
Guardrails docsTask-scoped credentials, no raw secrets
Agents run on short-lived credentials bound to the person and the task. Revocable in one call, expired when the task completes.
Agent identityEvery session under a real identity
Sessions sign in through Okta, Entra, or any SAML or OIDC provider. Each action is tied to the person driving the agent, with no shared service accounts.
Agent security04 / Record & export
One record of every action, in your SIEM
Allow and deny both land in one stream with the actor, the grant, and the rule that decided it. Risk events, session transcripts, and tool logs export as OTLP to Datadog, Grafana Cloud, or any OpenTelemetry collector as they happen.
Every tool call, with who made it and the grant or rule that decided it, streamed to your SIEM as it lands.
sarah@acme.org · Claude Code14:32:04m.ortiz@acme.org · ChatGPT14:32:05d.park@acme.org · Claude14:32:07j.chen@acme.org · Cursor14:32:09- Actor
- sarah@acme.org · Claude Code
- Grant
- grant · eng-default
- Exported
- ✓Datadog · 14:32:04✓Grafana · 14:32:04✓OTel · 14:32:04
Every decision with its actor and grant
Tool logs carry the person, the agent workload, the client, the task, and the grant or rule that decided the call. Filter by server, user, status, or any attribute.
Tool logs docsEvidence in your SIEM
Normalized OTLP logs, metrics, and traces to Datadog, Grafana Cloud, Langfuse, or any OpenTelemetry collector. Alerts route to the tools your analysts already watch.
Data export docsThe transcript one click from a finding
Every agent session is searchable, with prompts, tool calls, results, and who was driving. Each finding carries a share link for handing to a reviewer.
Agent sessions docsBecoming AI-native meant that we needed an entirely new governance & security stack. You can't use old tools to cover your team's new way of working.
Shreyas Kumar
Co-founder, Fermat
05 / How it works
From rollout to enforcement in four steps
Speakeasy deploys through the MDM you already run and sits on the path between agents and systems. Nothing changes for the employee, except that their agent now works.
01
Deploy through your MDM
Jamf, Intune, or the MDM you already run installs the device agent fleet-wide. Claude Code, Cursor, and Codex pick up the org's MCP configuration and hooks centrally.
02
Resolve identity
Each session signs in through your IdP. The person, the agent workload, the client, and the task form one composite identity.
03
Evaluate policy and guardrails
Every tool call is checked against rules scoped by team, role, and resource, and every payload is scanned by the guardrail policies you set. A matching deny always wins.
04
Record and export
Allow and deny both land in one stream with the actor, the grant, and the rule. Risk events stream to your SIEM as they happen.
Case study
Company-wide in 30 days
MoonPay ran a 30-day proof of concept with written success criteria, then took the control plane live across the whole company in a single rollout. Security operations now sees every agent session, scoped by team and role through Okta, with unsanctioned MCP servers blocked by default and risk events landing in the SIEM.
“Speakeasy went live in production across the entire MoonPay org, and it landed without a hitch.”
Thierry DangSecurity Operations, MoonPay60K
Agent sessions governed per week
200+
MCP servers brought behind one gateway
30 days
From proof of concept to company-wide rollout
Questions
How is this different from our CASB or DLP?
Does it work with the identity provider we already run?
What is the platform's own security posture?
Go deeper