GA waitlist now open • Enterprise MCP governance

Give AI agents production tools. Without giving up production data.

Avalon is an enterprise-grade Model Context Protocol (MCP) security gateway that intercepts, inspects, and enforces policy-as-code over AI agent tool execution — preventing accidental data deletion, prompt injection exploits, and rogue schema calls before they hit production databases.

The gateway

The data plane. Runs next to your MCP servers and checks every tool call against policy before it executes.

Avalon Control Hub

The web console. Where you set policy, approve held calls, and review the audit log.

Join GA waitlist Contact sales for private sandbox

Live gateway log ● blocked

[MCP Tool Execution] postgres.query → DROP TABLE production.users

[OPA Policy Check] role=agent:support-bot risk_tier=production decision=HOLD

[HITL Approval] sent to Slack #db-approvals → awaiting human decision

[HITL Approval] denied by dba@example.com → call blocked

[Audit Log] tool call and approval decision recorded

The AI agent security gap

One prompt injection away from DELETE FROM production.

Giving an LLM access to MCP servers like PostgreSQL, GitHub, or cloud APIs gives it direct access to your infrastructure. Prompt injection or agent hallucination can convert a simple query into an unrecoverable destructive execution in milliseconds.

Un-governed

Un-governed AI agent ▾ Raw MCP server ▾ Destructive DB drop / data leak ❌

Governed by Avalon

Governed AI agent ▾ Avalon gateway ▾ OPA policy check ▾ Clean execution ✅

How it works

Follow one risky tool call through Avalon.

From the agent's request to the audit log, in five steps.

Step 1 · Agent

An AI agent calls a tool

A support agent calls the postgres.query MCP tool with DELETE FROM customers. The payload also carries a customer email and an API key.
Step 2 · Gateway

The gateway intercepts it and DLP redacts the payload

The Avalon gateway catches the call before it reaches the MCP server. Data loss prevention masks the email and the secret key in the payload.
Step 3 · Policy

A Rego policy holds it

The policy check sees a destructive statement aimed at production. Instead of letting it run, the gateway holds the call for a human.
Step 4 · Approver

A person approves or denies it

An approval request posts to Slack (or Microsoft Teams, or email). Here, the on-call DBA denies it. No answer before the timeout also means deny.
Step 5 · Audit

The call is blocked and recorded in Control Hub

The call never reaches the database. The decision lands in the Avalon Control Hub audit log: tool, outcome, matching policy, approver, and latency — never the payload.

Agent

Gateway

Policy

Approver

Audit

Step 1 · Agent

agent support-bot · env production

→ postgres.query

{
  "sql": "DELETE FROM customers WHERE email = 'jane@acme.com'",
  "api_key": "sk_live_51Hx9QeTq2"
}

Step 2 · Gateway

gateway intercepted · DLP 2 findings masked

→ postgres.query

{
  "sql": "DELETE FROM customers WHERE email = '[REDACTED:EMAIL]'",
  "api_key": "[REDACTED:SECRET]"
}

Step 3 · Policy

package avalon.policy

hold contains msg if {
  input.tool == "postgres.query"
  regex.match(`(?i)^\s*(delete|drop)`, input.args.sql)
  input.env == "production"
  msg := "destructive statement in production"
}

decision = HOLD · awaiting approval

Step 4 · Approver

# db-approvals · Slack

Avalon app

support-bot wants to run postgres.query on production.

DELETE FROM customers WHERE email = '[REDACTED:EMAIL]'

Policy: destructive statement in production · denies in 15 min

Approve Deny

✕ Denied by dba@example.com

Step 5 · Audit

Avalon Control Hub Audit log

10:42:07 postgres.query DENIED

agent support-bot policy destructive_prod by dba@example.com 4.2 s

10:41:52 github.list_issues ALLOWED

10:41:30 postgres.query ALLOWED

Metadata only — payloads are never stored.

Enterprise capabilities

Governance built for agentic infrastructure

Policy-as-code (Rego / OPA engine)

Define exactly which tool calls an AI agent can invoke, based on parameters, user roles, or environment risk tiers. Each call is allowed, held for a human, or denied.

Automated data loss prevention

Real-time masking and redaction of PII, secrets, and sensitive tokens in MCP tool request payloads before they reach the upstream server.

Human-in-the-loop approvals

Hold critical, destructive tool calls — DROP, DELETE, PURGE — and ask an approver by email, Slack, or Microsoft Teams, or in the Control Hub inbox. No answer before the timeout means deny.

Searchable audit log

Every tool call and approval decision is recorded in an audit log you can filter and search in Control Hub. Entries hold metadata — tool, outcome, matching policies, latency — never payloads.

SSO and MFA

Sign in to Control Hub through your identity provider with OIDC or SAML 2.0, with just-in-time provisioning. Require authenticator-app MFA across your organization.

Alerts and weekly digest

Get alerted when a gateway goes offline, denials spike, approvals are missed, or usage nears its limit — plus a weekly digest of activity across your fleet.

Signed gateway releases

Gateway releases are signed, and Control Hub verifies the signature before it hands out install checksums, so a tampered binary never installs.

Hybrid data plane

Run the gateway as a managed service, or self-host it in your own VPC next to your MCP servers. Either way, policy is set centrally in Control Hub.

Architecture & deployment

Not a firewall. Not a gateway. A governance layer for tool execution.

Avalon targets autonomous tool calls and agentic infrastructure execution — the layer that un-governed native MCP, traditional API gateways, and LLM proxy layers all miss.

Security & governance feature	Native open-source MCP	Traditional API gateways	Avalon
MCP tool call authorization	None	Endpoint only	Schema & argument aware
Destructive action blocking	No	No	Automatic / HITL gating
Human approval of held calls	No	No	Email, Slack, Microsoft Teams
Hybrid VPC edge deployment	Self-managed	Complex setup	Single-binary gateway
Audit logs	Local only	Generic HTTP logs	Every tool call and approval decision, searchable
Console sign-in	N/A	Varies	SSO (OIDC, SAML) and MFA
Alerting	None	Generic metrics	Gateway, denial, approval & usage alerts

Secure your agentic infrastructure

Don't let a rogue prompt wipe out your production database.

Join CTOs, CISOs, and VPs of Engineering building safe, enterprise-ready AI workflows.