No trust without a rule you can inspect.

See exactly what the protected agent can read and why the gateway will refuse a call. Run the live policy tests without needing an account.

Run security checks Configure my routes

ThreatPublisher-controlled MCP tool metadata

BoundaryOwner-approved model-facing contracts

EnforcementPer-call policy and pinned input schema

EvidenceExecutable policy invariants and request verdicts

No live third-party calls are made by the public proof.

Reproducible / 01

Untrusted in. Approved out.

The server constructs an adversarial MCP tool description and runs the same isolation and policy functions used by protected tool routing. The response below is not an AI model accuracy test.

Untrusted MCP advertisement Provider controls this

Fetching example…

Eviduct model-facing definition Owner controls this

Fetching sanitized definition…

PendingChecking eight policy invariants.

Measured guarantee. Provider metadata is excluded from the protected tool list; unexpected arguments, disabled routes, changed schemas and unstructured text are blocked by explicit code paths. This does not establish resistance to every form of tool-output prompt injection or prove a provider's real-world integrity.

Try specific deny/allow scenarios on the homepage

Your environment / 02

Approve the exact tools. Connect a separate agent identity.

Tenant routes are stored durably. Management uses an evd_ partner key; agents use revocable evg_ tokens or separately authorized OAuth sessions.

01InspectRead published names and input field types without running tools.

02ApproveHuman reviews purpose and a narrow, closed input contract.

03EnforceUse the protected endpoint and remove parallel direct provider routes.

Tenant management

Authenticated · private

Partner management keyDo not paste this key into an agent prompt or MCP client configuration. The browser does not persist it.

Public HTTPS MCP endpoint to inspect

Select a publicly accessible Streamable HTTP MCP server. Inspection reads tools/list; it does not execute the provider's tools.

Approved routes

Enter a partner key to view or disable the tenant's protected routes.

Separate agent credentials

Create one revocable client token per agent. For ChatGPT, you can authorize the remote endpoint using OAuth instead.

No client inventory loaded.

OAuth agent sessions

These sessions authorize clients such as ChatGPT. Revoke any client to invalidate its delegated access, independently of other client tokens.

Authenticate to view authorized agent sessions.

Verify your connection / 03

Test the actual client tool inventory.

Use your issued evg_ agent token to inspect the protected tools/list. You can optionally send a real approved read call after explicit consent. No provider is contacted by the inventory-only test.

Agent client token

No connection test performed yet.

Approved tool to call

JSON input matching the approved contract

I authorize one actual upstream read operation. Provider pricing and behavior have not been independently verified.

No external call has been sent.

Technical event reporting / 04

Count enforcement decisions, not customer prompts.

These tenant-scoped metrics record policy and transport decisions from the protected gateway. They do not turn technical success into a provider quality score.

Decisions in 30 daysPending

Blocked by policyPending

JSON results returnedPending

Upstream failuresPending

Enter the same management key above to view your company's real event counts.

Evidence / 05

A thousand five-star agents are still zero evidence.

Test how a malicious provider inflates ratings and inserts instructions into its MCP description. Eviduct ignores both and relies exclusively on tenant-gateway-observed technical events. This is a deterministic policy demonstration, not a live agent study.

Naive review-based choice Provider-controlled

Loading reproducible fixture…

Eviduct evidence-only policy Gateway observations

Loading policy verdict…

PendingChecking evidence isolation, manipulated reviews and unknown data.

Boundary: no third-party API, model inference or customer file is used by the proof. It does not certify output quality. Unknown evidence yields abstention, not a hidden ranking.

Private, tenant-observed route comparison

Your issued management key can inspect the same technical evidence your protected MCP agent sees. No observations are pooled across tenants. A single approved provider is not automatically called the best.

No private comparison performed.

Registry discovery / 06

Find potential MCP providers without believing their advertising.

Eviduct queries the official MCP Registry directly. Its entries are publisher-submitted, so the agent initially sees only anonymous candidates. No ranking or execution occurs. You can inspect any endpoint before approving a specific public read contract.

What capability is needed?

Search is a strict, non-exhaustive substring lookup. Only HTTPS Streamable HTTP endpoints are eligible for inspection. Listing does not imply trust, interoperability or verified quality.

No live search performed.

Automated selection / 07

One MCP entry. The gateway chooses and calls an approved service.

For one approved tool, the agent can use it immediately. For several tools, the owner, not the vendor or the agent, must first confirm that they answer the same question against interchangeable public data. Eviduct then selects by its own observed technical outcomes or, with your permission, rotates equally while gathering evidence.

Declare truly interchangeable providers

Group only providers that return equivalent results for the same underlying public dataset or scope. Similar names, JSON schemas or advertised features do not prove equivalence.

Public capability

Equivalent data scope (slug)

Examples: same documentation corpus/version, same city and units, or same public dataset and time window.

Owner-approved routes to consider together

Enter a tenant management key and load the routes.

I confirm these two or more providers are interchangeable for the same public-data task and input contract. Allow Eviduct to rotate fairly among these owner-approved providers when no independently supported technical winner exists.

Nothing has been enabled.

My routing groups

Load my routing groups to view or revoke them.

Preview the decision without calling anyone

This uses real gateway observations for your tenant, never agent opinions or publisher descriptions. The preview does not consume your exploration rotation.

Approved input JSON

No route decision requested.

Run one real MCP call

Requires the separate agent token in the live MCP tester above. Executes one public-data read only; no fallback retries, no invoice or output logging.

I authorize one actual public-data request to the selected approved provider.

No provider has been called.

Routing decisions, no content

No private decisions loaded.

A testable boundary, not a universal security certificate.

We do not presently guarantee full prompt-injection immunity, malicious content detection in arbitrary structured outputs, authenticated SaaS routing, side-effect freedom, enterprise DLP or high-availability SLAs. We also do not claim customer metrics before customers use the gateway.

Understand the installation Review data handling