# Every tool call runs through policy.

> The Lutril MCP server sits between your agents and your SaaS. Each call is matched against a policy, approved or denied, and written to an immutable audit log.

Source: https://www.lutril.com/ai-governance/mcp-proxy

---

The Lutril MCP server sits between your agents and your SaaS. Every tool call is matched against a policy, approved or denied, and written to an immutable audit log, across every SaaS tool.

- One MCP endpoint
- Role-based policy
- Immutable audit

- **One MCP endpoint** Any SaaS. No wait for native support.
- **Role-based policy** The same roles you use for humans.
- **Immutable audit** Every prompt, tool call, and response.
- **Global kill switch** Pause an agent across every tool, instantly.

## Raw API keys can't enforce this.

Hand an agent a raw API key and nothing enforces what it reaches. The proxy makes every call inspectable, governable, and reversible.

- **Policy on every call** Match agent role, tool scope, parameters, and rate limits before a single request leaves your perimeter.
- **Any tool, one endpoint** Expose SaaS actions as MCP tools without waiting for each vendor to ship native support.
- **Immutable audit** Prompts, calls, and responses land in a WORM log: the evidence trail auditors ask for.
- **Kill switch** Pause one agent, or all of them, across every connected tool the moment something looks wrong.

## Frequently asked questions

### How do I control what AI agents can access through MCP?

Put a gateway between the agent and the tool servers. The agent authenticates as its own registered identity, the gateway checks each tool call against a policy (which agent, which tool, which parameters), logs the call and can pause the agent. The Lutril MCP proxy is that gateway for every SaaS tool you connect.

### What is an MCP gateway, and why not just hand the agent an API key?

An MCP gateway is a proxy that speaks the Model Context Protocol to the agent and enforces policy on every tool call before forwarding it. An API key grants whatever the key allows, for as long as it exists, with no per-call decision and no log you control. A credential is not a control.

### Can policy be enforced per tool call, not just per connection?

Yes. Lutril matches each call on the agent's role, the tool, the parameters and rate limits before it leaves your perimeter. Read calls can be allowed while writes require a human approval in Slack, Teams or the app UI, and the decision is logged with the call.

### Does the MCP proxy work with SaaS tools that have no MCP server?

Yes. Lutril exposes the actions of its connected SaaS integrations as MCP tools through one endpoint, so an agent gets governed access to a tool the vendor never shipped an MCP server for.

### What does the audit log contain?

Every prompt, tool call and response, with the agent identity, the policy decision and the timestamp, written to a WORM store. It is the evidence trail auditors ask for, and the same log is used for access reviews of agents.