Praesidia is the AI control plane for apps, agents, and MCP (Model Context Protocol) servers. Platform, security, and compliance teams use it to give every server its own identity, authorize each connection at the tool level, apply guardrails and budgets, and keep tamper-evident evidence of every call — without changing the server's code.
MCP made connecting an agent to a tool a one-line change. Nothing about that speed forces a registration step, a tool-level review, or a logging plan.
Server credentials get copied into every agent configuration that needs them. A compromised credential means hunting down every copy, and nothing can be rotated in one operation.
Any team can stand up a new MCP server in minutes. Without a central inventory there is no way to answer “which agents can reach production data” without asking every team individually.
When something goes wrong — a data leak, an unexpected bill, a destructive write — the investigation starts with “we don't know which agent did this.” Without a durable record per call, there is nothing to hand an auditor.
Controls apply at the connection between an agent and a server, so teams keep their existing MCP server code and servers deployed before governance existed can be brought under the same controls retroactively.
Register your apps, agents, and MCP servers. Each receives its own credentials for authentication and attribution — a non-human identity independent of the humans who deployed it, individually revocable.
Every agent-to-server hop is a separate connection with its own policies and guardrails. The agent authenticates to each server independently, so misconfiguring one hop never silently widens another.
Discover the servers your agents can reach, then scope which tools each client may invoke. The same server can expose read tools to one agent and nothing destructive to another; reviewed permission sets can be exported and imported.
Inspect tool arguments before they reach the server and results before they return to the agent: block prompt injection, stop credentials and personal data from crossing the boundary, and restrict write or delete tools.
Attach budgets, rate limits, and hard spend caps to each connection, with cost and rate visibility per server and per agent, so a looping agent cannot exhaust a budget unnoticed.
Every tool call is recorded in an append-only log and correlated back to the requesting agent, team, and workflow. With cryptographic signing enabled, exported evidence is independently verifiable offline.
Read the underlying documentation: Connections · Guardrails · Platform overview.
Each client below has a setup guide describing the exact version, transport, and tool path that were validated. Coverage labels come from the runtime catalog, last reviewed 2026-09-07.
OpenCode 1.18.29 authenticates and discovers the runnable managed MCP companion. Explicit prepare, owned checkpoint and approved resume pass transport and durable-restart acceptance.
Setup & validation guide →Claude Code 2.1.202 authenticates and discovers the runnable managed MCP companion. Explicit prepare, owned checkpoint and approved resume pass transport and durable-restart acceptance.
Setup & validation guide →Installable n8n node 0.1.0 executes authenticated managed MCP prepare, checkpoint and explicit approved resume against an independently signed inert target.
Setup & validation guide →The installable tool plugin passes actual Dify Plugin SDK 0.10.2 loading and authenticated managed MCP prepare, checkpoint and approved resume. Official CLI 0.6.10 produces its local package.
Setup & validation guide →The runnable component passes actual lfx 1.12.0 invocation over authenticated managed MCP, including prepare, owned checkpoint and explicit approved resume with independent target-receipt verification.
Setup & validation guide →The credential-free source package that makes OpenCode, Claude Code, n8n, Dify, and Langflow runnable clients of one approval-bound Praesidia target, with example client configurations.
Read the README → Full runtime catalogCoverage labels: Limited coverage — validated on the specific version, transport, and tool path named in its setup guide; anything outside that scope needs your own acceptance test.
The end-to-end reference: security model, authentication patterns, tool-level authorization, rate limiting, forensic logging, and a hardening checklist. →
How platform engineering teams bring MCP servers under identity, authorization, and audit controls before they sprawl. →
A survey of MCP gateway options — open-source gateways, API-gateway extensions, and governance control planes — and how to choose between them. →
OAuth 2.1 vs API keys for MCP servers after the November 2025 authorization spec: PKCE, resource indicators, token lifetimes, revocation, and when each fits. →
Get started for free. No credit card required.
