For enterprise security teams
Decide what your AI agents may call. Access is granted one tool at a time, every call is recorded, and any agent can be cut off on its own.
50 agents calling APIs with zero governance.
Your company has dozens of AI agents calling APIs with no centralized control. No one knows which agents have which keys, there is no audit trail, and you cannot revoke access to a single agent without breaking everything. One compromised agent means rotating every key manually.
Statio is the checkpoint.
Statio is where your agents' API access is decided. You grant tools one at a time rather than whole servers, every call is recorded, and revoking one agent leaves the rest running.
Access decided per tool, not per server
Grant a member or an agent a server, then deny the tools it should not call. A tool-level deny overrides the server grant, and the gateway checks it on every call before a credential is used.Every agent has its own identity
Agents are principals with their own token, status and optional expiry, so the log names the agent, not the engineer who set it up.Per-customer credential isolation, with no cross-contamination
Each customer’s credentials are isolated, and tenant boundaries are enforced at the gateway layer.Short-lived tokens with automatic refresh
Access tokens and agent tokens last five minutes. People’s sessions refresh for up to seven days.A record of every tool call: identity, timestamp, latency, outcome
Activity shows each call as allowed or failed, with the caller, tool, server and status code. A refused call is a 403 with the reason.Revoke one agent without touching the rest
Suspend or revoke an agent from the dashboard and it is refused within seconds, with nothing to redeploy. Every other agent keeps running.Audit logs, exportable for compliance review
Admin actions are recorded as plain sentences: who granted what, to whom, on which server, and the result. Business and Enterprise can export them as CSV or NDJSON, along with every tool call and model call.
What a per-tool deny looks like
The Manage Access drawer for one agent on one server. The server grant covers every tool; the one denied tool is refused at the gateway. Illustrative data.
Where it runs and how it plugs in
Self-hosted on Enterprise
On Enterprise, Statio ships as licensed containers that run in your own cloud. Free through Business run on Statio’s managed cloud.SSO and SAML
From Business up, members sign in through your identity provider with SSO/SAML, and you can require it for everyone on your domain, alongside full role-based access control.Logs to your SIEM
Webhooks deliver tool calls, audit events or both to your security tooling, signed with HMAC in theX-Statio-Signatureheader so you can verify they came from Statio. SIEM export is on Business and up.
Compliance
Other use cases
Lock down your first tool in minutes.
Three MCP servers, one of them hosted, and 10,000 calls a month, free and without a card. If you outgrow it the next plan is $19.
Two steps: create your account, then install the desktop app on each machine that runs an AI client.
- Keys encrypted at rest, never handed to an agent
- Cancel anytime, nothing is deleted
- How Statio handles credentials