statioStatio is the governance layer for AI agent API access. Named after the Roman military guard station — a fortified checkpoint where identity was verified before travelers continued — Statio sits between your AI agents and the APIs they call.
What Statio doesAPI keys encrypted at rest with AES-256. Agents never see raw credentials — Statio injects them at call time.
RBAC for AI agents. Define which agents can call which APIs, for which customers, at what rate.
Every API call logged with agent identity, customer context, timestamp, and response status.
Multi-tenant gateway with JWT authentication, rate limiting, and usage-based billing.
Generate MCP servers from any OpenAPI specification. Your API becomes AI-accessible in minutes.
Real-time detection of secret leakage, prompt injection, and data exfiltration in tool calls.
The mcphub CLI discovers unauthorized MCP servers configured on developer machines.
50+ MCP server templates for Stripe, GitHub, Slack, Google, and more.
The request flow is: Agent → Statio Gateway → Credential Vault → MCP Server → API.
1. Agent sends a tool call with its STATIO_TOKEN.
2. Gateway validates the JWT and checks access policies.
3. Threat scanner inspects the request for injection attempts.
4. Gateway fetches the real API credential from the vault.
5. Gateway forwards the call to the MCP server with the credential injected.
6. MCP server calls the target API and returns the response.
7. Output scanner checks the response for leaked secrets.
8. Gateway logs the call and returns the (optionally masked) response to the agent.
statio