Skip to main content
Powered bySpeakeasy+Okta

Okta to governed AIin minutes.

Roll out AI the way you roll out apps: through Okta. Connect Okta to the Speakeasy MCP Gateway and every employee's AI agents get the access they already have in Okta, in every AI client they use. Okta decides who can do what. Speakeasy enforces it on every tool call.

Set up a live demoSee the MCP Gateway
Trusted byGoogleMoonPayLaunchDarklyPlanetScaleCentsPolar

Assign it in Okta.
Speakeasy does the rest.

Three steps from an Okta tenant to governed AI. Okta stays the source of truth, so there is no second permission system to build or maintain.

MCP servers for the apps Okta already assigns

Speakeasy deploys MCP servers for the applications in your Okta tenant from a catalog of reviewed servers. Each one inherits the gateway's authentication, access, and audit logs. Bring your own servers for internal systems and they get the same controls.

Salesforce PlatformOfficialAccess Salesforce CRM data and invoke platform actions via hosted endpoints.Sales & CRMGitHubOfficialConnect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.Developer toolsSlackOfficialSearch messages and files, send messages, manage canvases, and access user profiles.Communication13 toolsNotionOfficialOfficial Notion MCP serverProductivity14 toolsLinearOfficialMCP server for Linear project management and issue trackingProject management31 toolsSnowflakeProvides Snowflake database access through a hosted MCP server built by Speakeasy and delivered via the Speakeasy AI control plane.Data & analytics3 toolsHubSpotOfficialAccess and interact with HubSpot CRM data including contacts, companies, deals, and tickets.Sales & CRM13 toolsAtlassian RovoOfficialEnables secure, permission-aware access to Atlassian Cloud products.Project management31 toolsAsanaOfficialAccess Asana tasks, projects, goals, and team data from AI assistants.Project management44 toolsFigmaOfficialThe Figma MCP server brings Figma design context directly into your AI workflow.Design17 toolsBigQueryOfficialGoogle-managed MCP server for BigQuery with SQL execution and dataset/table discovery.Data & analytics6 toolsAny serverAdd custom servers to your registry.Browse the full catalog

Everyone was selling me a future. I had a problem in production right now. I needed something that worked across all our AI clients today, not a roadmap.

Thierry Dang

Security Operations, MoonPay

MoonPay

Okta records your permissions. Speakeasy enforces it.

Okta stays the source of truth for who can use which AI tools. Speakeasy enforces it on every tool call, at the single point all AI traffic passes through, so there is no second permission system to build or maintain.

OktaDirectory · Groups

Groups · 4

Sales · Applications · 3

  • SalesforceAssigned
  • SlackAssigned
  • HubSpotAssigned
SpeakeasyMCP Gateway · Access

Grants from Okta

Synced
Oktagroup/Sales38 people
  • salesforce-mcpfrom Salesforce · via Okta groupGranted
  • slack-mcpfrom Slack · via Okta groupGranted
  • hubspot-mcpfrom HubSpot · via Okta groupGranted

Every tool call checked against this grant

SpeakeasyIdentity · Person
KNKavya Nairk.nair@acme.org · Sales

Agents · 4

Claude3 servers · same accesssalesforce-mcpslack-mcphubspot-mcp
ChatGPT3 servers · same accesssalesforce-mcpslack-mcphubspot-mcp
Cursor3 servers · same accesssalesforce-mcpslack-mcphubspot-mcp
Claude Code3 servers · same accesssalesforce-mcpslack-mcphubspot-mcp

Signed in through Okta. The same servers in every agent.

  1. Okta holds the groups and app assignments

    Okta already knows who is in which group and which applications each group is assigned. Speakeasy reads that map and nothing else has to be entered.

  2. Speakeasy turns each assignment into a server grant

    Each assigned application becomes an MCP server at the gateway, granted to the same Okta group. Every tool call is checked against that grant before it runs.

  3. Every agent gets the same servers

    An employee signs in through Okta from Claude, ChatGPT, Cursor, or any other agent, and every one of them sees the same servers. A server the person is not assigned is not there.

Start with MCP.
Extend to the entire loop.

The MCP Gateway is one component of the Speakeasy AI Control Plane. The Okta identity, the policies, and the record on this page extend to every agent your company runs, on every surface.

Agent identity

Every agent action runs as a named person or a named workload. Employee identity comes from Okta, backend agents get identities of their own, and every call is attributable to one of them.

Employee identity from Okta on every sessionWorkload identities for backend agentsEvery action attributable to a name
Explore agent identity

Agent security

Every prompt and tool call is inspected in flight. Prompt injection, personal information, and secrets are caught before they leave, and policy is written once at the gateway for every server.

Policy verdict on every tool callInjection, PII, and secrets caught in flightUnreviewed MCP servers blocked by default
Explore agent security

Agent observability

Every session lands in one record with the person, the agent, the tool, and the result. Risk events stream to your SIEM as OTLP, and usage and spend roll up by team and agent.

Every session in one audit trailRisk events streamed to your SIEMUsage and spend by team and agent
Explore agent observability

Speakeasy went live in production across the entire MoonPay org, and it landed without a hitch.

Thierry Dang

Security Operations, MoonPay

MoonPay
MoonPay

200+ MCP servers, company-wide in 30 days

MoonPay brokered every MCP connection through its existing Okta identity and went from proof of concept to a company-wide rollout of 200+ MCP servers in 30 days. As of October 2026, the security team sees 60K+ agent sessions, each tied to a named employee, without provisioning a server by hand.

Read the MoonPay story

30 days

From proof of concept to company-wide, brokered through Okta

200+

MCP servers under one gateway

60K+

Agent sessions visible to the security team

Questions

What does Speakeasy read from Okta?
Users, groups, and application assignments. Sign-in runs through Okta SSO, and Directory Sync keeps members and groups current as they change in Okta. Speakeasy deploys MCP servers for the applications in the tenant and assigns access to each from the app assignments Okta already holds.
Do we have to rebuild permissions in Speakeasy?
No. Okta is the source of truth for who can use which AI tools, and Speakeasy enforces it. To grant an employee's agents a new server, assign the app in Okta. Admins who want an agent to hold less access than the employee, such as read-only on a warehouse, can filter tools per server in Speakeasy, on top of the Okta assignment.
Which AI clients does this cover?
Any MCP client. Claude, Claude Code, ChatGPT, Cursor, Codex, Copilot, Gemini, and the agents your teams build connect to one gateway URL with OAuth 2.1 and sign in through Okta. The same access applies in every one of them, and backend agents get identities of their own.
Does Speakeasy replace Okta?
No. Okta owns identity, and Speakeasy extends it to AI. Okta decides who can do what, and Speakeasy enforces that decision where AI meets your systems, at the MCP layer, on every tool call.
How long does a rollout take?
Connecting Okta takes minutes, and servers, identities, and access come from what is already in the tenant. MoonPay went from proof of concept to a company-wide rollout of 200+ MCP servers in 30 days, brokered through Okta. Read the MoonPay story.
Where does the audit trail go, and where does data run?
Every tool call is logged with the employee, the server, the tool, and the result, and streams to your SIEM as OTLP. The data plane can run in your VPC. The platform is SOC 2 Type II and ISO 27001 certified, with audit reports in the trust center.
How do we get started?
Set up a live demo. We connect a sandbox Okta tenant and show governed AI across two clients in minutes. The Okta integration is in early access, and the demo is the fastest way to get onto it.

Go deeper

ConnectAgent identityDistributeMCP gatewaySecureAgent securityObserveAI usage telemetry

AI everywhere.

Control here.

Set up a live demoSee the MCP Gateway