Your agents already reach their tools through a gateway. MeetLoyd plugs into it as its authorizer. Every call is checked against the agent's identity, its stop switch, the tools it was granted and its budget, and the decision is signed into the audit trail. You keep the gateway you run today.
Each gateway asks in its own way. MeetLoyd answers all of them with the same decision. Where the gateway passes the request body on, the tool named in the MCP request itself is what gets checked, not only the headers.
Authorization extension, request and content profiles.
Checks the MCP bodyRequest interceptor, ready to deploy.
Checks the MCP bodyLambda authorizer, ready to deploy.
Headers onlyAn inbound policy you paste in.
Checks the MCP bodyA Worker in front of your MCP server.
Checks the MCP bodyNative external authorization.
Checks the MCP bodyCustom authorization provider; the mesh identity of the calling agent is recognised.
Checks the MCP bodyExternal authorization, gRPC or HTTP.
Checks the MCP bodyExternal authorization through its gateway extension.
Checks the MCP bodyThrough its policy-agent plugin.
Checks the MCP bodyForward authentication middleware.
Checks the MCP bodySubrequest authorization.
Headers onlyUsing a gateway that isn't listed? If it can call an external authorizer, it can call MeetLoyd. Tell us which one.
Its own key, a federated token, or the identity your gateway or mesh already established. Agents nobody registered don't get through.
Stop an agent, a team or a whole organisation, and every gateway refuses it within about a second. No redeploy.
Tools are denied unless granted, and a grant can be limited by time, network or declared purpose. Delegated calls carry who delegated them.
A budget that is exhausted blocks the next call, at the gateway, before the cost is incurred.
Every decision, allowed or refused, lands in a signed audit trail you can export to your SIEM.
A decision is only as good as the gateway that asked for it. Each gateway is registered, bound to one organisation and revocable on its own: with a certificate we issue for it, or with a token when the gateway can't present one. A gateway that can't prove itself is not listened to, and it can't vouch for an agent.
The decision is made in your region, from a continuously updated copy of your policy, so the gateway isn't waiting on a round trip across the world.
If the decision can't be made in time, or the policy copy falls behind, the call is refused rather than waved through.
Tell us which gateway sits in front of your agents. We'll connect it in a working session in your environment and show you the first refused call in the audit trail.
Book a call →Product names are trademarks of their respective owners. Listing a product means MeetLoyd works with it; it does not imply endorsement or partnership.