Grant the tool, not the whole server.

Statio is an MCP gateway that controls access one tool at a time and gives every AI agent its own identity. The desktop app sets up Claude Code, Cursor and seven more clients, Stripe and GitHub keys stay encrypted in Statio instead of on laptops, and every call is logged by agent and tool, allowed or refused.

Start freeSee pricing

Free plan, no card · New to MCP? What is an MCP server? · Uses the Statio desktop app for macOS, Windows and Linux · Names are illustrative

Every road into Rome ended at a gate. At every gate stood a statio: a guard post where nobody passed without a name. Every traveller named, every cargo checked. Today the travellers are AI agents, making thousands of calls, most on a borrowed key. So we built the post again: Statio names every agent and checks every call. In the app, an admin denies db.deleteRows for ci-agent, and the agent's next call fails with a 403.

Your agent can read your data. It can also delete it.

One MCP server holds selectRows and deleteRows side by side, and per-server access gives an agent both or neither. In Statio you grant the server, then deny the tool that deletes your data.

Hubert Robert, Aqueduct in Ruins · The Met, CC0

Configures the AI clients your team already uses

  • Claude Code
  • Claude Desktop
  • Cursor
  • Windsurf
  • VS Code
  • Cline
  • Continue
  • Zed
  • Amazon Q

Say yes to a server. Say no to one of its tools.

Every MCP server bundles harmless tools with dangerous ones. Here is the difference per-tool access makes, using a Postgres server.

Most gateways: one switch per server

postgresAccess granted
  • db.selectRowsallowed
  • db.listTablesallowed
  • db.deleteRowsallowed
  • db.insertRowsallowed

One switch for the whole server. If the agent can read rows, it can delete and insert them too.

Statio: a decision per tool

postgresServer access granted
  • db.selectRowsallowed
  • db.listTablesallowed
  • db.deleteRowsdenied
  • db.insertRowsdenied

Grant the server, then deny the tools that change your data. The deny always wins.

Claude Lorrain, Pastoral Landscape: The Roman Campagna · The Met, CC0
  1. 1
    Pick the agent and the server

    ci-agent has been granted the postgres server. That one grant covers every tool on it.

  2. 2
    Read tools ride on that grant

    selectRows and listTables show “via server access”. Nothing else to set up.

  3. 3
    Deny the dangerous tool

    One click on Deny records a deny for deleteRows. It overrides the server grant for that tool only.

  4. 4
    What the agent sees

    If ci-agent calls deleteRows, the gateway refuses it before any credential is used, and Activity records it:

    failed db.deleteRows · 403 · You don't have permission to call tool 'db.deleteRows'

Every agent is running on somebody’s personal key.

Agents borrow a human’s token, so you can’t tell them apart and you can’t cut one off without breaking the person. In Statio every agent gets its own identity.

  • A token per agentEach agent authenticates as itself, never as the engineer who set it up.
  • Suspend or revoke oneStop nightly-sync without touching anyone else.
  • An end date per agentSet an expiry date and the agent’s token stops working on that date.
How agents work
Hubert Robert, Bridge over a Cascade · The Met, CC0

When something goes wrong, nobody can say which agent did it.

Statio records every tool call through the gateway: who called what, on which server, how long it took, and whether it was allowed.

  • The agent’s name on every lineEach call names the agent or the person behind it, the tool, the server and how long it took.
  • A 403 with the reasonA blocked call shows the 403 and the message the agent got back, so a refusal is never a mystery.
  • Stream it to your SIEMOn Business, tool calls and audit events go out by signed webhook.
Audit and activity
Claude Lorrain, Sunrise · The Met, CC0

Live API keys are sitting in config files on laptops.

Every developer’s AI client holds its own copy of your Stripe, GitHub and Slack keys. With Statio the laptop holds one Statio key, and the real credentials stay encrypted in Statio.

  • AES-256-GCM, added at call timeCredentials are stored encrypted and attached inside the gateway, after the access check.
  • A lost laptop leaks a Statio keyRevoke that one key in Statio. Your Stripe secret was never on the machine.
  • Claude Code, Cursor and seven moreThe desktop app writes each client’s MCP config, so nobody pastes a key into a JSON file.
How Statio handles credentials
Claude Lorrain, View of La Crescenza · The Met, CC0

You don’t know what your team has already installed.

Developers add MCP servers, plugins and skills on their own. Fleet, on the Team plan and up, finds them on every machine running the desktop app, without CrowdStrike, Intune or Jamf.

  • Managed or ExternalSee which servers route through Statio and which don’t.
  • Plugins and skills tooMCP servers in all nine clients, plus Claude Code plugins and skills.
  • Seen when it changesA newly added server shows up within minutes while the desktop app is running.
How shadow discovery works
Hubert Robert, The Portico of a Country Mansion · The Met, CC0

Flat monthly prices. Never per seat.

Inside a plan, adding a member never changes your bill. Free needs no card and has no path to a charge.

Free

$0

Evaluate Statio. No credit card required, hard limits, never a surprise bill.

  • Servers3 MCP servers
  • Hosted1 from your spec, sleeps when idle
  • API calls10,000 / month
  • Members1 member
  • PoliciesPer-tool allow and deny
  • Audit logs90 days
Start free

Developer

$19/mo

For a solo developer running agents in production.

  • Servers10 MCP servers
  • Hosted3 from your spec
  • API calls50,000 / month
  • Members1 member
  • PoliciesPer-tool allow and deny
  • Audit logs90 days
Start on Developer

Team

$149/mo

For teams sharing one governed endpoint.

  • Servers25 MCP servers
  • Hosted10 from your spec or image
  • API calls500,000 / month
  • MembersUp to 15 members
  • PoliciesFull RBAC: roles, teams, grants
  • Audit logs90 days
Start on Team

Business

$599/mo

For organizations that have to answer to a security review.

  • ServersUnlimited
  • Hosted50 from your spec or image
  • API calls2,000,000 / month
  • MembersUnlimited members
  • PoliciesFull RBAC + SSO/SAML
  • Audit logs90 days, export and SIEM
Start on Business

Enterprise

from $15K/yr

Self-hosted in your cloud.

  • Unlimited servers and members
  • Custom call volume, records kept up to two years
  • 99.9% SLA, named contact
  • Audit exports for your review
Talk to us

Annual billing. Pay for 10 months, get 12. Available on every paid tier.

Extra hosted servers. $9/month each, beyond the number your tier includes.

Overage is off. Go past your monthly API calls and the extra calls are refused, at no charge, until you turn overage on yourself. If you do, you set a monthly spend cap first, and the calls past your allowance bill at $30 per 100,000, the same rate Team and Business include.

Common questions

You can. Routing is the easy part. What takes the time is everything around it: per-tool permissions checked on every call, credentials encrypted at rest and never handed to the agent, an audit trail your security team accepts, and discovering the servers developers installed without telling anyone. Statio is that layer, and it works without an EDR or MDM, which is where most self-built setups stop.

Mostly that you can start right now. Ours is self-serve with published pricing: sign up, connect a server, set a policy, no demo call and no annual contract. The enterprise platforms in this space gate everything behind sales, which works if you are 500 people and does not if you are twelve.

On Free, calls beyond 10,000/month are refused and nothing is charged. There is no way to spend money on the Free plan. On a paid plan you can turn on overage billing at $30 per additional 100,000 calls. It is off until you enable it, and you set a monthly spend cap when you do.

One that runs on our infrastructure, and there are two ways to get one. Give us an OpenAPI spec and we generate the server, build it and run it, on every plan including Free. Or, from Team up, give us a Docker image of a server you already built and we run that image as it is. Hosted servers sleep when idle. Servers you install from the catalog run on shared Statio infrastructure and do not count, and external MCPs you host yourself and connect by URL do not count either. Extra hosted servers are $9/month each.

No. Every plan is a flat monthly price. Adding someone to your org never changes your bill. Developer is a single-member plan, Team covers up to 15 members, and Business and Enterprise are unlimited.

Yes. Upgrade, downgrade, or cancel from your dashboard. Cancelling drops you to Free at the end of the period rather than deleting anything. Your servers and audit history stay put.

Every plan keeps 90 days of audit log, 30 days of tool calls and 13 months of model calls, and you can shorten the first two in settings. Business adds file exports and SIEM streaming. Enterprise keeps records for up to two years.

Deny deleteRows for your first agent in a few minutes.

Free plan, three servers, no card. If you outgrow it the next plan is $19.

Start freeGiovanni Paolo Panini, Ancient Rome · The Met, CC0