Statio is open: MCP access decided one tool at a time

I recently integrated into the PostHog MCP and loved that I could now have my AI just track all of my analytics, create reports for me as well as build all the dashboards I needed as well. Aside from PostHog doing a great job with their MCP I was super proud of Statio being able to handle their complex permissions as well.

Every MCP server has a similar shape: a handful of tools you want an agent to use and a few you would never hand to one unsupervised. The client config has one entry per server, and that entry carries one credential, so there is no way to say "these tools, not those." Connect a server and the agent gets all of it.

Statio is what I built to fix that. Today it is open to everyone, with a free plan that needs no card.

What Statio does

Statio is a gateway. Your AI clients talk to Statio, and Statio talks to the MCP servers. That puts one place in the path where every call can be checked, which is where the rest of this list comes from.

Each agent gets its own identity. An agent connects as itself, never with a borrowed developer token, so a call in the log belongs to one named agent and you can switch that agent off without touching anyone else.

Access is decided per tool, at the gateway, on every call. Grant an agent a server, then deny the tools on it that change your data. The deny always wins. If your CI agent should read a Postgres database but never call deleteRows, that is one click, and the gateway refuses the call before any credential is used.

Credentials stay out of the model. Keys are stored encrypted and added at call time. Agents never see them, and in a generated server a header the model passes can never override the authentication header.

What goes in and what comes back are both checked. When a server's tools are discovered, their names and descriptions are scanned for prompt injection, and anything suspicious is flagged for an admin.

The gateway decides where traffic may go. Servers Statio hosts are private, and their outbound traffic goes through an egress proxy and that server's allowlist.

Every call is recorded. Every plan keeps 90 days of audit log and 30 days of call activity. Business adds SIEM export.

How you get started

Install the desktop app on each machine that runs an AI client. It detects the MCP clients you already have, writes their configuration, and finds servers already set up on that machine that nobody governs.

Then add servers. There are three ways:

• From the catalog. 308 MCP servers you can install today, running on shared Statio infrastructure, and the list keeps growing.
• From an OpenAPI spec. Paste the URL of an OpenAPI 3 spec and Statio generates the MCP server, builds it, hosts it privately and puts every tool behind per-tool access. This works on every plan, including Free.
• From a server you already run. Connect it by URL as an external server at no cost, or from Team up, give Statio a Docker image and it runs that image as it is.

The getting started guide walks through it in the order a new team does it.

Pricing

Every plan is a flat monthly price. Adding someone to your org never changes your bill.

• Free: three MCP servers, one of them hosted from your spec, and 10,000 calls a month. No card, and no way to spend money.
• Developer, $19/month: for one person running agents in production.
• Team, $149/month: up to 15 members, with roles, teams and grants.
• Business, $599/month: unlimited members, SSO/SAML and SIEM export, for organizations that have to answer to a security review.
• Enterprise: Statio as licensed containers you run in your own cloud.

Annual plans save 17%. The full table is on the pricing page.

What you will find here

This blog is for what is new in Statio and what I think about MCP security. The first real post, on why a triage agent can also merge pull requests, is the long version of the problem above.

The tutorials are for tasks, and most of them work with or without Statio: adding MCP servers to Claude Code, setting them up in Cursor, building a server in Python or TypeScript, turning an OpenAPI spec into a server and giving an agent read-only GitHub access. Every one is tested, and more are coming.

The reference for Statio itself lives at docs.statio.dev.

I use the product every day and find more and more MCP integrations I keep wanting to try, some to watch the metrics of my websites. I want to build a guide on building a cloud billing agent to help people reduce costs for their cloud infrastructure. This is a product I use and am excited for.

If you run agents against MCP servers today, pick the one tool you would least like an agent to call, and deny it for your first agent. It takes a few minutes on the free plan.