Statio is a control plane in front of MCP servers. Your agent talks to the gateway; the gateway decides what happens next.
Every one of those steps happens before your agent's request reaches the MCP server, and the agent is not involved in any of them.
Gateway — the only address your agent knows. It authenticates the caller (session token or API key), resolves which server the path refers to, checks the per-tool permission, injects the upstream credential, proxies the call, and records it. A failure at any step is a refusal, not a pass-through.
Registry — what servers exist, who owns them, which tools each exposes, and which version is live. It also owns deployment: building an MCP server from an OpenAPI spec and rolling it out.
Vault — encrypted credential storage. Values go in through the dashboard or API and come out only inside the gateway at proxy time. There is no read path that returns a secret to a caller.
Platform — identity, organizations, teams and roles. Statio does not have its own idea of who you are; it asks the platform, which is why your existing org structure applies on day one.
Audit — an append-only record of calls and administrative changes.
The alternative is giving each agent the credentials and trusting it. That fails in a specific way: you cannot revoke what you have already handed out, and you cannot see what was done with it.
Putting a proxy in the path means the credential never leaves your side of the boundary, permission is evaluated per request against current state, and the record is a by-product of the call rather than something the agent volunteers.
Note
The gateway is the enforcement point, so it is also the thing that must be reachable. A managed MCP server is deployed with no direct route to the internet — see Egress.