Give your AI agents keys, not the keys to the kingdom.
Vantex is the access control plane for autonomous agents. Every tool call gets a scoped, short-lived credential, is checked against your policy, lands in a tamper-evident audit trail — and can be revoked in one click.
Drop-in for MCP, OpenAPI tools and cloud IAM. No agent rewrites.
Agents went from chatting to doing. Their permissions never caught up.
Agents now merge code, issue refunds, change infrastructure and email customers. Most of them do it with a long-lived API key a human pasted in months ago — with every scope that key will ever have.
An agent that needs to read one ticket holds a token that can delete the whole project. Forever.
You can't filter every poisoned web page or email. You can make sure a hijacked agent can't do much with it.
Logs show a service account. Not which agent, which run, which prompt — or which human it was acting for.
Least privilege, at the speed agents move.
Vantex sits between your agents and the tools they call. Nothing about your models or prompts changes.
Connect
Point agents at the Vantex gateway — an MCP proxy, an HTTP sidecar, or a two-line SDK wrapper. Your real secrets move into Vantex; agents never see them.
Declare intent
Write policy as code: which agent, on whose behalf, can do what, to which resources, under what limits. Version it in Git like everything else.
Mint, enforce, record
Each call gets a credential scoped to exactly that action and expiring in seconds. Risky actions pause for a human. Everything is signed into the audit trail.
# Support agent: can help customers, can't drain the bank agent "support-agent" { acts_for = session.user credential_ttl = 60s allow "zendesk:tickets.*" { where = ticket.requester == session.user } allow "stripe:refunds.create" { limit = "$200 per refund, $2k per day" approve_if = amount > 100 # ping #support-leads } deny "stripe:payouts.*" deny "*:*.delete" on_anomaly = suspend_and_page }
Everything security asks for before an agent goes to prod.
One control plane for every agent you build or buy — across teams, frameworks and clouds.
Just-in-time credentials
Per-action tokens that expire in seconds and are scoped to one resource. Nothing worth stealing sits in an agent's context.
Human-in-the-loop approvals
High-stakes actions pause and ask the right person in Slack, Teams or mobile — with full context — then resume automatically.
Spend & blast-radius limits
Cap dollars, rows, emails or API calls per run, per day, per user. Runaway loops hit a wall instead of your invoice.
Tamper-evident audit trail
Every decision, linked to agent, run, prompt and the human it acted for. Hash-chained and exportable to your SIEM.
One-click kill switch
Suspend one agent, one tenant or everything — in-flight credentials are revoked instantly, not at the next rotation.
Behavioral anomaly detection
Vantex learns each agent's normal shape and flags the moment it starts reaching for tools it has never touched.
Built like the thing it protects.
A control plane for credentials has to be the most boring, most locked-down system you run. Ours is.
- Self-hosted data plane. The gateway runs in your VPC. Secrets and payloads never leave your network.
- Fails closed. If Vantex can't reach a decision, the action doesn't happen.
- Your identity provider. Agents inherit and never exceed the permissions of the human they act for.
- Sub-5ms policy decisions at the edge, so least privilege never becomes the bottleneck.
- SOC 2 Type II in progress. Pen-test reports available to design partners under NDA.
Questions we hear a lot.
Isn't this just an API gateway or a secrets manager?
Those answer "is this caller allowed to use this key?" Vantex answers "should this agent, acting for this person, in this run, take this specific action right now?" — and mints a credential that can only do that one thing.
Do we have to change our agents?
No. If your agents speak MCP, you change one URL. For plain HTTP tools, the sidecar intercepts outbound calls. Our SDK wrappers for Python and TypeScript are two lines if you want richer context in the audit trail.
What about agents we buy rather than build?
Third-party agents connect to your systems through credentials you issue. Issue them through Vantex instead, and they get the same scoping, limits and audit as your own.
Does Vantex see our prompts and data?
Only the metadata you choose to send for policy decisions. With the self-hosted data plane, payloads and secrets stay in your network and our cloud only holds policy and aggregated telemetry.
How do I become a design partner?
Email us with a sentence about the agents you're running or planning. We're working closely with a small group of teams putting agents into production in 2027, and we'll set you up personally.
Ship agents your security team will sign off on.
Join the design partner program and help shape how autonomous software gets access to the real world.