Who can use what
Models, MCP tools and agents are granted per group, per tool, per environment. Models and tools nobody granted are hidden from the client, not just refused.
FifthAI Gateway
One gateway for every model call, tool call and agent.
FifthAI Gateway sits between your people, apps and agents and every AI model and MCP tool they use. Security and platform teams get one place to decide who can use what, what it may cost, what data may leave, and to see exactly what happened.
13checks on every request, in a fixed order
18MCP vendor presets in the catalog
8model provider types
~2 sto stop every agent in a company
0prompts stored by default
Why a gateway
Four questions every AI program has to answer.
Instead of every person and app holding its own provider keys, all AI traffic goes through one front door that answers them on every request.
How much they can spend
Monthly budgets on the company, a workspace, a project, a key or a person. Budgets stack, and each one can notify, throttle or block.
What data may leave
Personal data and secrets are redacted before a prompt reaches the provider and restored in the answer. Secrets in answers are masked, streams included.
What happened
Every call has a trace that says which check decided it and why. Changes to the setup go to an append-only audit log.
MCP governance
Approve MCP tools one at a time, for each group.
Every tool is graded read, write or destructive from what its server declares. Read tools start open, write tools start off, and destructive tools stay off until someone grants them. People only see the tools their groups may call.
- Per-person OAuth, enterprise-managed tokens or a shared service token, brokered by the gateway
- Drift detection: a changed tool definition never reaches clients unreviewed
- 18 vendor presets, plus your own APIs imported from OpenAPI or GraphQL
- Find unmanaged MCP servers in developer tools and adopt or block them
Investigate
Every blocked call says why.
Open any request and see each check it passed through, the one that decided it and the reason code your developers will see. Prompts are not recorded unless you choose to keep them.
- Timeline of every check, with the rule and the scope that matched
- Live traffic with filters for blocked calls, fallbacks and unmanaged tools
- Reading stored content is itself audited
Policy and data protection
Roll out policy the way you roll out code.
Simulate a rule on recent traffic before it enforces anything, turn it on for a share of requests or one team first, and require a second approver. Every version is kept and can be restored.
- Block, redact, strip or flag, with ready-made checks for personal data, secrets and prompt injection
- Conditions on group, department, time window, network range and tool risk
- Policies pause themselves if they start blocking too much
- Export and apply the whole setup as YAML from CI
Agents
Every agent carries a passport.
Register each agent with an owner, a purpose, the tools it may call, a budget and a maximum call depth. Stop one agent, or every agent in the company, in about two seconds.
- Workload identity for CI and clusters: GitHub Actions, Kubernetes and Google Cloud tokens instead of stored keys
- Run limits on budget, steps and call depth for each agent run
- Agent-to-agent calls checked against the calling agent's passport
Spend
Budgets that act before the invoice does.
Set monthly budgets where the money is actually spent and decide what happens at the limit. Alerts arrive with one-click actions to raise the limit, throttle or move a route to a cheaper model.
- Budgets on company, workspace, project, key and person, all enforced together
- Routes with fallbacks, canaries, region pinning and a cost advisor
- Chargeback by department and cost center, plus FOCUS exports
Audit and compliance
Evidence your auditor can read.
Every change to the setup is written to an append-only log with before and after. Evidence packs map what the gateway enforced and recorded in a period to SOC 2, ISO/IEC 27001 Annex A and EU AI Act controls.
- Metadata-only by default; content with PII masked, full content or zero retention when you choose
- Stream decisions to your SIEM over HTTPS or Syslog, and traces over OpenTelemetry
- Time-boxed support access that your admins grant and can see
On every request
Thirteen checks, in the same order, every time.
Policy and authorization fail closed. Telemetry fails open, so a decision log that cannot ship never blocks a request.
- 01Tenancy
- 02Kill switch
- 03Passport
- 04Budget
- 05Run limit
- 06Rate limit
- 07Policy
- 08Guardrails in
- 09Inspect
- 10Route
- 11Meter
- 12Guardrails out
- 13Decision log
Architecture
Your traffic stays on the data plane.
Two parts with one job each. The data plane makes every decision on the request path; the control plane holds your setup and never sees a prompt.
Data plane
in your network or oursA single static Go binary that serves the OpenAI- and Anthropic-compatible APIs, MCP and agent-to-agent traffic. No database and no call home on the request path. Redis shares limits and budgets across replicas.
Control plane and console
hosted, or run it yourselfPeople, keys, policies, MCP catalog and audit, on Go and Postgres. It signs each data plane's configuration; data planes verify it and apply changes without a restart.
Shared or dedicated
Every company starts on the shared data plane and can switch to its own, and back, from Settings.
Keeps running
If the control plane is unreachable, data planes keep serving from the last configuration they verified.
Hardened image
Distroless, non-root, read-only root filesystem. Release images are signed and ship with an SBOM.
Works with what you run
Change one line, the base URL.
Applications keep their SDKs. Coding agents connect with gw connect or sign in through your SSO, so nobody handles a provider key.
Coding agents
- Claude Code
- Codex
- Cursor
- VS Code Copilot
- Aider
- Cline
SDKs and frameworks
- OpenAI SDK
- Anthropic SDK
- LangChain
- LlamaIndex
Model providers
- OpenAI
- Anthropic
- Azure OpenAI
- AWS Bedrock
- Google Vertex
- Gemini API
- OpenRouter
- OpenAI-compatible
MCP servers
- GitHub
- Atlassian
- Linear
- Notion
- Slack
- Stripe
- Sentry
- Your own APIs via OpenAPI
Identity
- Okta
- Microsoft Entra ID
- Google Workspace
- Any OIDC or SAML IdP
- SCIM
Evidence and telemetry
- Syslog and HTTPS SIEM streaming
- OpenTelemetry
- Datadog
- Splunk
- Prometheus
Straight answers
What security teams ask first.
Do our prompts go through FifthAI's servers?
Prompts and answers pass only through the data plane. You can run your own data plane in your network; the control plane then receives metadata only, unless you turn payload logging on.
What happens if the control plane is unreachable?
Data planes keep serving from the last configuration they verified. Changes made in the console wait until the connection is back.
Does it replace our identity provider?
No. People sign in with your existing OIDC or SAML provider, SCIM keeps groups in sync, and the gateway applies those identities to model, tool and agent access.
Is FifthAI certified for SOC 2 or ISO 27001?
The gateway builds evidence packs mapped to SOC 2, ISO/IEC 27001 Annex A and the EU AI Act for your auditor. That is evidence for your program, not a certification of it.
Do we need a FifthAI SDK?
No. Applications keep the official OpenAI or Anthropic SDK and change one line, the base URL. Coding agents connect with one command or sign in through your SSO.
How do we deploy it?
Start on the shared data plane, then move to your own when you are ready. The data plane is a single container image; Docker Compose and Kubernetes manifests ship with each release.
Prove it on your own traffic.
We will connect a provider, an MCP server and your identity provider with your team, then walk through blocked calls, drift and evidence together.
Book a technical evaluation