Statio

Statio is a security and governance layer for MCP servers. It sits between your AI agents and the APIs they call, so "which agent may call what, with whose credentials" is a policy you set rather than a fact you discover later.

The problem

An MCP server needs credentials for whatever it talks to — a Stripe key, a GitHub token, a database password. Give an agent an MCP server and you have given it those credentials. In practice that means:

• Keys spread out. They end up in config files, environment variables and developers' laptops, with no single place to rotate them.
• Nobody can answer "who called what". An agent hit your payments API at 3am. Which agent, on whose behalf, under what permission?
• Permission is all-or-nothing. An MCP server exposing twelve tools grants all twelve to anyone who can reach it.

What Statio does

• Credentials stay server-side. Secrets live in Statio's vault and are injected into the upstream request at proxy time. The agent never receives them, so a compromised agent cannot leak what it was never given.
• Permissions are per tool. Access is granted per server and per tool, to a person or a team, through the same roles that govern your organization.
• Every call is audited. Who, which tool, what came back — the record a compliance review asks for, produced as a side effect of normal use.
• Managed or bring-your-own. Install from the catalog and Statio runs it, or point Statio at your own OpenAPI spec and it generates, builds and deploys the MCP server for you.

How it fits together

Your agent connects to the Statio gateway instead of to an MCP server directly. The gateway authenticates the caller, checks whether they hold the permission for that specific tool, injects the upstream credential, forwards the request, and records what happened.

Claude / Cursor / your agent
        │  Authorization: Bearer <token>
        ▼
   Statio gateway ── permission check ──▶ platform RBAC
        │         ── credential fetch ──▶ vault
        ▼
   MCP server ──▶ the upstream API
        │
        └──▶ audit log

Nothing about your agent changes except the URL it points at.