The control plane for your AI agents.

Your people add one MCP URL to Claude Code, Cursor or ChatGPT. Smartplane checks every call against who may use what and your rules in plain English, then writes it to a tamper-evident log.

Start free Read the security model

Your agents

Claude CodePriya Raman, Platform

CursorMarco Bianchi, Payments

ChatGPTDana Okafor, Finance

Release botService account

Smartplane mcp.smartplane.dev/acme

Grants: 42 active
Rules: 9 enforcing
Log: chained

Waiting for the next call

Every call is checked before it runs.

What they can touch

GitHubMCP server

Postgres, ordersDatabase, read-only

StripeAPI, POST /v1/refunds

Google DriveMCP server

LinearMCP server

Audit log, Acme Inc. Append-only, each entry hashed with the one before it

Today, agent access is wired by hand.

Five servers, five keys, one laptop. Multiply by every person on the team, and nobody can answer the two questions an auditor asks first: who can reach what, and what did the agent actually do?

Personal tokens with production scope. A GitHub token that reaches every repo, pasted into a dotfile.
Nothing between the agent and the delete. If the model decides to clean up a folder, the folder is gone.
Leavers keep their keys. Offboarding removes the laptop login, not the Stripe key in its config.

~/.cursor/mcp.json on one engineer's laptop

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "ghp_8fK2vQ…" }
    },
    "postgres": {
      "args": ["postgresql://admin:hunter2@prod-db/orders"]
    },
    "stripe": {
      "env": { "STRIPE_SECRET_KEY": "sk_live_51Hx…" }
    },
    "drive":  { "env": { "GOOGLE_REFRESH_TOKEN": "1//0gL…" } },
    "linear": { "env": { "LINEAR_API_KEY": "lin_api_Q2…" } }
  }
}

Connect, grant, rule, record.

Setup takes an afternoon. Your identity provider stays the source of truth for who people are; Smartplane decides what their agents may do.

Connect once

Everyone adds the same URL and signs in with your SSO. Their agent lists only the tools their role, team and project allow. No keys on laptops, nothing to rotate by hand.

Works with Claude Code, Cursor, ChatGPT, VS Code and any client that speaks MCP.
```
{
  "mcpServers": {
    "smartplane": {
      "url": "https://mcp.smartplane.dev/acme"
    }
  }
}
```

Grant access

Give a person, team, role or service account a tool, MCP server, database, API, secret or variable. Databases start read-only. APIs are limited to the methods and paths you list. Secrets are injected server-side and never shown to the agent. Grants can expire.

Who	Gets	Scope	Expires
Platform team	GitHub MCP	Read, open pull requests	Never
Payments team	Postgres, orders	Read-only	Never
Finance team	Stripe API	POST /v1/refunds	30 Jun 2027
Finance team	STRIPE_SECRET_KEY	Injected, never shown	90 days
Release bot	Linear MCP	Update issues	90 days

Write the rules

Type a rule the way you would say it in a meeting. A classifier reads every action against it before it runs, then blocks it, flags it or holds it for a person to approve. If the classifier can't be reached, enforcing rules deny.

“Flag any query that reads customer email addresses.”

Block Flag Hold for approval

Applies to the orders and customers databases. The call runs; security gets the flag.
Keep the record

Every call, decision and approval lands in an append-only log, each entry hashed with the one before it, so a missing or edited line is detectable. Export the evidence your auditor asks for by date range.
1. 9c41e0Ruth Adeyemi, finance lead, approved Dana's $1,240 refundprev 7b2a19
2. 7b2a19Rule held stripe.refunds.create for approvalprev e05fd2
3. e05fd2Marco Bianchi via Cursor, SELECT on ordersprev 31aa8c

Write rules the way you'd say them.

No policy language to learn. Pick a rule to see the calls it decided this week, and why.

On the record, from the first call.

Built for SOC 2 from day one, because the people who buy this have to defend it in an audit.

When someone leaves: Dana Okafor, Thursday

09:14:00Okta removes dana@acme.com from the directory
09:14:01SCIM event received, membership switched off
09:14:013 access tokens revoked, 4 direct grants revoked
09:14:01Removed from Finance and Month-end close teams
09:14:02Her ChatGPT connection gets 401 on the next call

Tamper-evident log: Append-only and hash-chained per organisation, with one writer per org so entries can't interleave.
Secrets stay secret: Envelope-encrypted with AES-GCM. Never stored in plaintext, logged, returned by the API or shown to an agent.
Short-lived tokens: Stored as SHA-256 hashes, expire within 90 days, and die with the membership.
Fails closed: If the classifier is down and an enforcing rule applies, the call is denied.
Approvals with two people: Nobody approves their own request. Access reviews show every grant and who approved it.
On Cloudflare's edge: Decisions run close to your agents, in Workers, with data in the region you choose.

Start free. Add SSO later.

Sign up, connect your first MCP server and give your team one URL in under ten minutes. Talk to us when security wants SCIM, evidence exports and a contract.

Start free Talk to us about enterprise

	Team	Enterprise
Price	Free for 5 people, then $15 per person a month	Annual contract
Connections	MCP servers, APIs, databases, secrets	Same, plus private network connectors
Rules	Unlimited, block and flag	Plus hold for approval with routing
Identity	Google and GitHub sign-in	SAML SSO, SCIM, directory sync
Audit log	90 days	Custom retention, evidence export, access reviews