One control plane for every agent, analyst and key.
Give your whole security team AI agents that can use your tools, without handing out a single integration key. Decide what's switched on, see every call, and remove access in one place.
One place to manage what your agents can reach.
Every integration, every MCP server and every tool sits in one console. Switch an integration off and it disappears from every connected agent straight away. No configs to edit, no keys to rotate.
- Switch integrations on and off for every agent at once Now
- Restrict risky tools, such as submissions, by plan In development
- Team workspace with invites and a shared integration list With Teams · soon
- Shared skills: switch a skill on once and every analyst's agent follows the same method, with nothing installed on their machines With Teams · soon
Decide who can use which tools.
Role-based access for your team. Admins choose which integrations each role can reach and which tools are allowed, so a junior analyst's agent can look things up but can't submit files to a public sandbox.
- Admin, analyst and read-only roles
- Per-role tool policies, for example lookups yes, submissions no
- Remove a person once and every agent they connected loses access
One integration key for the team, seen by no one.
Add your organisation's VirusTotal, Censys or SIEM credentials once. Every analyst's agent can use them, nobody has to copy them, and rotating a key happens in one place.
- Encrypted at rest and added only at call time Now
- Never shown to agents or returned to the browser Now
- One key shared across the team, rotated in one place With Teams · soon
••••••••4f2a••••••••91cd••••••••0b7eEvery call on record, for a year.
Each tool call is logged with who made it, the tool, its arguments, the outcome and the time. Teams plans keep a full year, so you can answer "what did the agent look up?" for any investigation.
- 365-day audit log on Teams and Enterprise With Teams · soon
- Per-analyst attribution across the team With Teams · soon
- Export to your SIEM on Enterprise Planned
virustotal · get_ip_report185.220.101.450.8sabuseipdb · check_ip185.220.101.450.4sscout · get_ip_details185.220.101.451.1svirustotal · submit_fileblocked by policy—Predictable usage, whoever is asking.
One credit is one call to an integration. Searching for the right tool is free. Limits apply per plan and per minute, so a runaway agent can't burn through your API quotas.
- Monthly credits and per-minute limits Now
- Usage dashboard with warnings at 80% and 100% Now
- Pooled credits across the team With Teams · soon
Sign in the way your company already does.
Agents connect with OAuth, so nobody pastes tokens into config files. Enterprise plans add single sign-on and user provisioning from your identity provider.
- OAuth 2.1 sign-in for agents, with PKCE and revocable tokens Now
- See and disconnect every connected app Now
- SSO with Entra ID, Okta or Google, and SCIM provisioning Planned · Enterprise
How every call is handled.
The same five steps for every tool call, from every agent.
Identify
The agent's OAuth token is checked and tied to an account.
Check policy
Plan, credits, rate limits and tool rules are applied.
Add credentials
The integration key is decrypted inside Cyproxy for that call only.
Call the tool
The request goes to the provider's service. The agent never sees the key.
Log
Tool, outcome and time go to the audit trail, and on Teams and Enterprise its arguments too.
Governance and compliance.
What your security review will ask, answered up front. More detail on the security page.
Results not kept
Tool results pass through Cyproxy to your agent and are never stored.
Encryption
Integration keys and tokens encrypted at rest and in transit, scoped per account.
Least privilege
Agents get results, never credentials. Integrations and single tools can be switched off.
Retention by plan
Audit kept 7 to 365 days by plan, then deleted automatically.
Instant revocation
Disconnect an app or switch off an integration and access stops at once.
Data protection
We collect only what we need. A DPA is available on Enterprise.
SOC 2
On the roadmap. Ask us for our current security documentation.
Self-hosting
For teams that need the gateway inside their own network.
Team plans.
Both include every integration, every agent and admin control over what's switched on. Compare all plans.
- 50 Cyproxy Agent credits per user a month, pooled
- 1,000,000 credits a month
- 365-day audit log
- Admin controls, shared keys and roles
- Minimum 3 users
- Everything in Teams
- Agent credits sized to your team
- SSO and provisioning (planned)
- Audit export (planned)
- DPA, security review and SLA
Questions from security teams.
01Can our analysts start before team features launch?+
02Does Cyproxy see our investigation data?+
03Who hosts the tools?+
04Can we connect our own OpenCTI or MISP?+
05Can we try it first?+
Bring AI agents to your team, safely.
// one control plane · every integration · every call on record