Your AI Agents Call Tools. Do You Know What They're Allowed to Do?

Every AI agent your engineering team runs is a collection of tools. Cursor calls a GitHub tool. Claude Code calls a file system tool. Your SDR agent calls a HubSpot CRM tool. These tool calls are how agents actually do work — and they are almost entirely ungoverned in most stacks today.

Today, Trimio shipped Phase 1 of its MCP gateway: a production-grade /mcp/v2/ aggregating server that puts Trimio's full governance stack in front of every tool call your agents make.

What the MCP gateway actually does

The MCP (Model Context Protocol) gateway is a spec-compliant server that aggregates MCP tools from multiple sources and routes every tools/call through Trimio's governance chain. Here's what that chain looks like in order:

1. Rate limit check — VK-global + per-tool RPM enforcement
2. Budget pre-check — Does this call's projected cost fit within the remaining budget?
3. Content policy (inbound) — Scan the incoming prompt or request payload before the tool is called
4. Timed dispatch — Execute the tool call with a timeout and fallback path
5. Content policy (outbound) — Scan the tool's response before it's returned to the agent
6. Cost metering — Record actual cost of the tool execution
7. Budget debit — Subtract the cost from the VK budget
8. Audit log — Write a structured log with org, VK, user, tool, cost, and policy decisions

Every existing Trimio primitive now gates MCP tool calls. If you've configured PII scrubbing, virtual key scopes, or budget caps in Trimio, those controls apply to the tool call — not just the inference call.

The permission model: five levels, deny by default

Phase 1b shipped a five-level permission filter that determines whether a tool call is allowed to proceed. The permission model works as an intersection: a call is permitted only when all five levels grant access simultaneously.

The five levels, in priority order:

• Org-level grants — What the organization has explicitly permitted
• Virtual key grants — What the VK the caller is using has been scoped to
• End-user grants — What the specific user or session is authorized for
• Tool-level permissions — Which tools the VK can actually invoke
• Per-tool RPM overrides — Different rate limits for different tools (GitHub: 60/min, HubSpot: 30/min)

Deny by default. Every dimension must pass. This means a VK scoped to read-only GitHub operations can't call the GitHub push API, even if the org-level grant would allow it. The VK scope is the enforceable constraint — not a policy document, not a Slack message to the security team.

Why this is an enterprise requirement, not a nice-to-have

Three converging forces make MCP governance a compliance question, not a preference:

AI agents are multiplying in enterprise environments. Cursor, Claude Code, Windsurf, Coasty.ai — every engineering team now has agents with broad tool access. GitHub, file system, CRM, email, Slack. The tool surface is wide and growing. Without governance at the tool-call level, each agent is a standing credential grant with no blast-radius limits.

Security disclosures are accelerating. This week alone: LiteLLM Mercor supply-chain attack (4TB stolen via LiteLLM), ChatGPT Google Sheets workbook exfiltration, and a VSCode 1-click GitHub token steal. Three independent attack paths into the tool layer — not the model layer. The model layer is getting attention. The tool layer is not.

Microsoft is building the same thing — and it's still in preview. Azure AI Foundry's MCP governance feature is in preview. Trimio shipped the same capability today. In enterprise software, "Microsoft is building it too" is the confirmation that the category is real. The question for buyers isn't whether to govern MCP tools — it's whether to wait for the preview or go production-grade now.

The operational loop: how it works in practice

Here's what changes when Trimio's MCP gateway is live in your stack:

Your SDR agent's Cursor instance calls HubSpot. Before the call, Trimio checks: does this VK have HubSpot read/write permission? Is the projected API cost within budget? Is the request rate within the HubSpot-specific RPM override? Is the request payload clean? The call executes. The response is scanned. The cost is metered. The audit log is written. Every step is automatic and logged.

Now the same agent calls GitHub to push a commit. Different RPM override (60/min). Different budget check. Different content policy. The permission model handles both tool types without a manual configuration change. The governance is consistent, enforced, and auditable — regardless of which tool the agent is calling.

This is the difference between "we have policies" and "our policies are actually enforced on every call."

What this unlocks for finance and compliance teams

Finance and compliance teams don't care about RPM overrides or permission filters. They care about three things:

Cost visibility across the full agent loop. Tool calls have costs. HubSpot API calls cost money. GitHub API calls cost money. Without metering at the tool-call level, your AI spend report understates the actual cost of running agents. The MCP gateway meters every call and logs it with org, VK, user, and cost — so your Finance Alpha API or observability export shows the real number.

Audit trails that satisfy compliance requirements. "What data did our CRM agent access, and when?" is a compliance question that requires structured logs. The MCP gateway writes a structured log for every tool call — who called it, which VK, what tool, what the response was, what it cost. That's the audit trail, not a Slack message from the engineering team.

Budget enforcement that actually stops runaway agents. If your SDR agent loops on a HubSpot API call and burns through your budget at 3am, the MCP gateway's budget pre-check stops the call before it executes — not after you've already paid for it. This is different from a cost report that tells you what happened. The gateway prevents the overage in real time.

What comes next

Phase 1 is production-live today: rate limiting, budget pre-check, content policy in/out, dispatch, cost metering, debit, and audit logging. The connection registry and permission filter are enforcing. The aggregating server advertises a governed tool catalog to Cursor, Claude Code, and any MCP-compatible agent.

The roadmap includes: native tool-level budget caps (separate budgets per tool), content policy templates for regulated industries (HIPAA, SOC 2), and observability dashboards for tool-call patterns alongside inference patterns. The foundation is laid. The enforcement is live.

Trimio's MCP gateway is live. If your agents are calling tools — and they are — that's your governance surface. See how it works.