The control plane for enterprise AI egress

Govern what your agents do.Not just what they click.

One accountable path for every outbound call your applications, AI agents, MCP servers and your own people make. Deny by default, tokenize what leaves, and put the real end user in the loop on anything that matters.

Book a demoSee how it works

Your egress model was built for people, not agents.

Egress control assumed a human clicking a browser. Software now initiates outbound traffic across three fronts at once, each owned by a different team, or by no one. An agent acts with real credentials, at machine speed, with no one watching.

Web
A traditional proxy sees a hostname at best, never the full URL, the payload, or the intent behind the call.
LLM
Every model call can carry PII, secrets, or your crown-jewel prompts to a third party.
Agent · MCP / A2A
Tool calls execute real actions: move money, change records, send messages.

Three fronts. One thing in common: nothing is watching what your software sends out.

How it works

One governed doorwayfor everything that leaves.

How a call flows through SquidderYour applications, AI agents, MCP servers and your own users all send outbound calls into a single Squidder doorway. The doorway attributes the caller, classifies the call against policy, and inspects and tokenizes it. Allowed calls then run one of two ways: automated, or routed to the real end user for approval on their own phone. Anything not allowed is denied. Every decision is metered and written to a hash-chained audit ledger.Your appsAI agentsMCP serversYour usersONE GOVERNED DOORWAYAttributetied to a user, app or group from your IdPClassifylayered app, group, tenant policyInspectPII and secrets tokenized before dispatchAutomatedUser in the loopDeniedMETERED + WRITTEN TO A HASH-CHAINED LEDGER
Nothing leaves until you allow it. Every call is attributed, classified and inspected on the same path, whichever way it ends up running.
9:41Squidder

Approval required

An agent wants to move money

Requested by
invoice-agent
Action
Refund a payment
Destination
api.stripe.com
Amount
$2,480.00
Customer
j••••@northwind.cotokenized
Card
4000 00•• •••• 1782tokenized

ed25519:9f3a…c71d · bound to this action

Example approval

User in the loop

The person who owns the data is the person who approves.

Push-MFA proves who you are, then asks one of a few operators to approve a login. Squidder asks the actual data subject to approve the actual action, reconstructed from what the agent really tried to do.

  • What you see is what you execute

    The card is built from the intercepted action and cryptographically bound to it, so an untrusted agent cannot show a human one thing and run another.

  • The credential never touches your infrastructure

    Their own phone makes the outbound call from a hardware-backed vault. The gateway only ever sees the signed result.

The whole control plane, in one console.

One policy language across web, LLM and agent traffic, with the audit and the cost model built from the same records.

Deny-by-default egress

Nothing leaves until you allow it. A layered app, group and tenant policy resolves every destination to automated, user-approved, or denied.

User-in-the-loop approval

When a call needs its owner, the gateway asks the real end user. A push shows a plain-language summary of the actual data flow.

Delegated execution

Invoke third-party APIs on a user's behalf without the gateway ever holding their credential. An on-device vault runs the call.

Reversible tokenization

Format-preserving synthetic values leave the boundary; real values are restored on the way back, even across streamed replies.

Usage + cost observability

Per-app, per-group, per-model dashboards over tokens, latency and spend, built from the same records that drive policy.

Hash-chained audit

A tamper-evident record of every decision and outbound call, never the secret, with chain-integrity verification on export.

AI FinOps + observability

The chokepoint that governs your AI also shows you what it costs.

Because every model call already flows through one identity-attributed doorway, usage and cost are not a bolt-on tool with its own SDK and its own blind spots. The same plane that decides what is allowed also measures every token and caps it before it runs away.

Spend this month

$10,700

68% of a $15,000 cap

Attributed to a team

100%

no unallocated spend

Cheapest passing model

−31%

graded on live traffic

Spend by team, this month

Rolled up from the same records that enforce policy. Total $10,700.

  • Support automation$4,8201.2M
  • Sales research$3,140840K
  • Doc pipeline$1,960410K
  • Internal copilot$780190K

Illustrative figures

The landscape

Every other tool solves a slice.We govern the whole doorway.

LLM gateways

LiteLLM, Portkey, Kong AI, OSS Bifrost

Where it stops

Route model calls, manage keys and budgets, add basic guardrails. One surface.

What Squidder adds

Agent-action governance, user-in-the-loop approval, and delegated execution, plus usage and cost attribution, across web, LLM, and MCP as one plane.

AI firewalls

Lakera, Cloudflare AI Gateway

Where it stops

Filter content by shipping your raw text to a hosted classifier to read.

What Squidder adds

Tokenize-before-dispatch, so raw values never leave the boundary, and a full egress control plane, not just a filter.

Cloud AI guardrails

Bedrock Guardrails, Azure Content Safety, Model Armor

Where it stops

Provider-native safety, locked to one vendor. No egress, approval, or audit layer.

What Squidder adds

Provider-agnostic across 20+ providers, plus the egress, approval, and audit layers. It can even use these as building blocks.

LLM observability

Langfuse, Helicone, Datadog LLM Observability

Where it stops

Watch and chart what already happened, over the LLM surface only. Read-only, and blind to any call that skipped the SDK.

What Squidder adds

The plane that measures is the plane that enforces, so a budget is a ceiling and not a chart. Web, LLM, and MCP in one ledger.

Push-MFA / HITL

Duo, Okta Verify

Where it stops

Prove who you are, or put a human in the loop by asking one of a few operators to approve a login. Identity, not action.

What Squidder adds

User in the loop, not just human in the loop: the actual data subject sees and approves the real reconstructed action, executed from their own device.

Build it yourself

Open-source base + plugins

Where it stops

SSO, guardrails, immutable audit, RBAC, and MCP governance are a multi-quarter internal build.

What Squidder adds

The whole superset, already built, integrated, and shipping, from day one.

Don't trust the agent. Verify everything.

Secretless by design

The user's credential and the outbound call stay on their device.

Nothing raw leaves

Tokenization runs before dispatch, as a hard gate, so no raw PII crosses the inspection boundary.

Fail closed, always

A stale identity mirror returns 503, distinct from a 403 deny, and a classifier failure stops.

Built on standardsOIDCOAuth 2 + PKCERFC 7591 DCREd25519RFC 8785 JCSRFC 5424 Syslog

Put every outbound call on one accountable path.Start with a demo.

See Squidder govern a live agent end to end: capture a token, tokenize sensitive data, and route a real action to a phone for approval, in minutes.

We reply within one business day.