Smartplane Start free

One door,
not a ring of keys.

Smartplane sits between your AI agents and your company's tools. Everyone adds one MCP URL to Claude Code, Cursor or ChatGPT. You decide what each person's agent can reach, write the rules it must follow, and keep a record of every call.

Start free Talk to us about enterprise

Free for up to 10 people. Works with any client that speaks MCP.

14 servers, 11 secrets in one file, 1 leaver still connected 1 URL, 0 secrets on this laptop

~/grace/project/.mcp.json

{
  "mcpServers": {
    "github":      { "command": "npx", "args": ["@mcp/github"], "env": { "GITHUB_TOKEN": "ghp_r8Kq2vT…" } },Grace's personal token, scopes repo and admin:org
    "linear":      { "url": "https://mcp.linear.app/sse" },
    "postgres":    { "command": "npx", "args": ["@mcp/postgres", "postgres://admin:pw@prod-db:5432/app"] },Production database, read and write
    "stripe":      { "command": "npx", "args": ["@stripe/mcp"], "env": { "STRIPE_KEY": "sk_live_51Hx…" } },Live key. It can issue refunds of any size
    "slack":       { "command": "npx", "args": ["@mcp/slack"], "env": { "SLACK_BOT_TOKEN": "xoxb-2291…" } },
    "gdrive":      { "command": "npx", "args": ["@mcp/gdrive"], "env": { "CREDS": "~/Downloads/creds (2).json" } },
    "notion":      { "url": "https://mcp.notion.com/mcp" },
    "sentry":      { "command": "npx", "args": ["@sentry/mcp"], "env": { "SENTRY_TOKEN": "sntrys_eyJ…" } },
    "datadog":     { "command": "npx", "args": ["dd-mcp"], "env": { "DD_API_KEY": "4f1c9e…" } },
    "jira":        { "command": "uvx", "args": ["mcp-atlassian"], "env": { "JIRA_TOKEN": "ATATT3x…" } },
    "snowflake":   { "command": "uvx", "args": ["snowflake-mcp"], "env": { "SF_PASSWORD": "Winter2025!" } },A shared password, in plain text, on a laptop
    "aws":         { "command": "uvx", "args": ["aws-mcp"], "env": { "AWS_SECRET_ACCESS_KEY": "wJalr…" } },
    "billing-api": { "url": "https://billing.internal/mcp", "headers": { "Authorization": "Bearer eds_7Qm…" } },Edsger's token. He left in September
    "figma":       { "url": "http://127.0.0.1:3845/mcp" }
    "smartplane":  { "url": "https://app.smartplane.dev/mcp" }
  }
}

Grace signs in once with her work account. Her agent now sees GitHub, Linear and Google Drive, because her team does. Nobody's laptop holds a key, and this is the admin view of who can reach what:

Smartplane Access page: the Platform team can use GitHub search_code and get_issue; Admin role can read the Warehouse until Dec 31, 2026; Grace Hopper can write to Google Drive; the CI agent service account has admin on GitHub until Oct 1, 2026; Platform can write to Linear.
A heavy iron ring holding dozens of mismatched keys, some with handwritten tags and red tape, on a sunlit table.

Every agent got its own keys.

When a team adopts agents, each engineer wires up their own: an MCP server per tool, a personal token per server, a database URL copied from the wiki. It works on Monday. By the end of the quarter nobody can say who can reach payroll, the support bot holds a live Stripe key, and the person who left in September is still connected through a token in someone's dotfile.

Security can't see it. Platform can't fix it without breaking everyone's setup. And nothing stops an agent from running DELETE on the wrong table, because nobody ever wrote down that it shouldn't.

Decide who reaches what.

Grant tools to a person, team, role or service account. Their agents see those and nothing else.

The Access page listing grants by subject, resource, action level, tools and expiry date.
MCP servers and tools
Register GitHub, Linear or your own server once. Grant the whole server or two tools from it, like search_code and get_issue.
Databases
Read-only unless you say otherwise. Writes need a grant at the write level, and a rule can still hold them for approval.
Internal APIs
Point at a base URL and tick the methods agents may call. GET is on by default; POST, PUT, PATCH and DELETE count as writes.
Secrets
Envelope-encrypted and injected on the server when the call is made. The agent never sees the value, and neither does the person.
Variables and skills
Shared settings and instructions, scoped to a team or a project, so everyone's agent starts from the same place.
Expiry
Give the CI agent admin on GitHub until the migration ships on October 1, and it ends on October 1.
The Add resource dialog for an HTTP API: base URL, authentication secret, auth header, and allowed methods with only GET ticked.
Adding an internal API. The secret is picked from the vault, not pasted into anyone's config.

Write the rules in plain English.

Type the rule the way you'd say it in a meeting. Smartplane compiles it into a classifier and checks every agent action against it before the action runs.

Guard detail for 'Protect Q3 reports': the rule 'Nobody deletes reports from the Q3 folder', the compiled classifier instructions, a violating and an allowed example, enforcement set to Enforce at a 70% threshold, and a dry-run test form.
The rule, the instructions it compiled to, examples, and a dry run before you turn it on.

Each rule chooses what happens on a match: block the action, flag it in the log and let it through, or hold it until someone approves. Approvers are people with the right role, and nobody can approve their own request.

If the classifier can't be reached and an enforcing rule applies, the action is denied. Rules fail closed.

Five agent actions, checked against three rules
The agent triesOn behalf ofRuleResult
read_file /reports/Q3/summary.pdfGrace, Claude CodeNobody deletes reports from the Q3 folderAllowed
delete_file /reports/Q3/summary.pdfGrace, Claude CodeNobody deletes reports from the Q3 folderBlocked before it ran
refunds.create amount=1200 USDSupport agentOnly the finance team can issue refunds over $500Held for finance
UPDATE invoices SET status='void'Ada, CursorNo writes to productionHeld; Ada can't approve it
delete_file /reports/Q3/draft.pdfCI agentClassifier unreachableDenied, fails closed
Approvals page: Grace Hopper's request to delete_file /reports/Q3/draft.pdf on Google Drive, held by 'Protect Q3 reports', with Reject and Approve buttons.
Held actions wait in Approvals with the exact arguments, and expire if nobody decides.

Leavers lose access in one step.

When someone is removed in your directory, Smartplane hears it over SCIM and runs one offboarding path. Their agents fail on the next call.

Edsger's membership 3 access tokens 2 direct grants the Platform team

Members page: six people with role, status, source and last seen. Edsger Dijkstra is marked Offboarded, synced from the directory.
Confirmation dialog: 'Offboard this member? katherine@acme.dev is offboarded immediately: the membership ends, their access tokens and direct grants are revoked, and they leave every team.'
The same path runs from an access review, with the decision written to the log.

Every call, on the record.

Tool calls, denials, approvals, grant changes and sign-ins go into an append-only log. Each event carries the hash of the one before it, so a deleted or edited row breaks the chain and shows.

Audit log with 'Chain intact, 42 events': grant created, policy denied for the CI agent on Google Drive, MCP tool called, policy pending approval, guard compiled, member invited, token created, member deprovisioned by SCIM.

What your SOC 2 auditor asks for, already kept

CriterionEvidence Smartplane produces
CC6.1 Logical accessGrants by person, team, role and project. Secrets envelope-encrypted, never returned by the API or shown to agents.
CC6.2 Granting accessMembers come from your directory through WorkOS SSO and SCIM. Access tokens are stored as hashes and expire within 90 days.
CC6.3 Removing accessOne offboarding path for leavers, plus quarterly access reviews where every keep or revoke is recorded with who decided.
CC7.2 MonitoringA hash-chained event log per organisation with a one-click integrity check and CSV or JSON export for the audit window.
Q4 2026 access review: 4 of 10 decided, memberships listed with Keep and Revoke buttons, and a note that you cannot decide on access you hold yourself.
An access review in progress. You can't sign off on your own access; someone else decides.

Works with the agents you use.

Claude Code, Cursor, ChatGPT, VS Code and your own agents all speak MCP. Clients that support MCP sign-in only need the URL; they open a browser, you log in with your work account, and access ends when your membership does. For CI and older clients, mint a token: it's shown once, stored as a hash, and expires.

claude mcp add --transport http smartplane https://app.smartplane.dev/mcp

Runs on Cloudflare's network, close to wherever your agents run.

Access tokens list: a CI agent service-account token and a personal Claude Code token are active, an old desktop token has expired, and a Cursor token is revoked.
Tokens show only a prefix after creation, expire within 90 days, and die with the membership.

Start with your own team.

Plan FreeTeamup to 10 people $15Businessper person, per month Let's talkEnterpriseannual agreement
One MCP URL, OAuth sign-inYesYesYes
Resources and grants5 resourcesUnlimitedUnlimited
Plain-English rulesFlag onlyBlock, flag, holdBlock, flag, hold
ApprovalsYesYes
Audit log history30 days1 year7 years, with export
Access reviewsYesYes
SSO and SCIMYes, via WorkOS
Security review, DPA, SLAYes
Start free Start a 30-day trial Email us
A single green wooden door in a sunlit plaster wall.

Hand out one URL.
Keep the keys.

Set up your first resource and rule in about ten minutes. Your team adds one line to their agent.

Start free