AI agent governance tools

Aembit

Controls when AI agents can reach MCP servers and the systems behind them, using a combined identity of the agent and the person it acts for. Agents never hold the downstream credentials: Aembit exchanges tokens per request, logs every access attempt and can revoke access at once.

aembit.io #

AWS on the vendor map

Identity and credential service for AI agents built on AgentCore. Agent identities are workload identities that let agents reach AWS resources and third-party services for a user or on their own, with authentication, authorization and audit trails.

docs.aws.amazon.com #

Astrix Security

Keeps an inventory of AI agents, MCP servers and non-human identities and flags excess privilege, risky configuration and abnormal activity. Its Agent Control Plane provisions new agents with short-lived, just-in-time, scoped credentials, and threat detection covers compromised credentials and out-of-scope agent actions.

astrix.security #

Okta on the vendor map

Developer identity service for agents that act for users: it authenticates the user, stores the tokens agents use to call services such as Google Drive, Jira and Slack, asks the user to confirm critical actions, and limits which documents an agent can retrieve in RAG.

auth0.com #

Cyera on the vendor map

Inventories service accounts, API keys, tokens and AI agents across cloud, SaaS, on-premises and AI platforms, including unapproved MCP servers, and ties each to an owner and the data it can reach. Agent requests are checked against access policy in real time and granted short-lived, task-scoped identities, with each session recorded and stoppable.

cyera.com #

Keycard

Gives each agent its own identity and issues short-lived, task-scoped credentials only after confirming the workload and the person it acts for and evaluating policy written in Cedar. Denied requests get no credential, every decision is logged for export to a SIEM, and a revoked credential stops working wherever it applies.

keycard.ai #

Microsoft on the vendor map

Gives AI agents their own identities in Microsoft Entra ID, with identity, lifecycle and access controls applied as they are for employees, and monitoring of agent activity. Agent identities are available to all Entra customers; applying Entra security controls to agents requires Microsoft Agent 365, which is included in Microsoft 365 E7.

microsoft.com #

Okta on the vendor map

Registers AI agents as identities with named human owners, enforces least-privilege policy on each agent connection, and runs access certification campaigns on agent permissions. Agent SSO gives agents that support Cross App Access short-lived tokens in place of stored credentials, and deactivating an agent blocks its new sessions.

okta.com Recent launch, August 24, 2026 #

Permiso on the vendor map

Discovers AI agents in cloud functions, containers, VMs and code repositories, keeps a registry of them, and attributes agent runs, events and tool calls to the human, machine or AI identity behind them across cloud, SaaS and on-premises systems. It detects threats in that activity and can stop an agent with a kill switch.

permiso.io #

Rig Security on the vendor map

Resolves accounts, tokens and AI agents to the person behind each one and maps which grants chain into paths to production data. It removes access nobody needs, joins identity alerts into a single attack timeline, and on laptops, servers and clusters can block a risky agent action without blocking the person whose session the agent uses.

rig.security #

Rippling on the vendor map

Keeps AI agents as records in Rippling alongside employees and service accounts, as one of the products in Rippling AI Governance. Admins give each agent an owner and permissions and provision it into third-party apps with the access controls they already use in Rippling. An agent works either on permissions an employee delegates or under its own managed identity; in both cases admins can see its access, spend and activity, and can revoke it from the same system.

rippling.com Recent launch, August 20, 2026 #

SailPoint on the vendor map

Discovers AI agents and machine identities along with the credentials, APIs and tokens they use, and maps each agent to its human owner, permissions, sessions and data. Governance teams review and revoke agent access, and behavior is monitored for threats.

sailpoint.com Recent launch, August 4, 2026 #

Token Security

Discovers AI agents and MCP servers across cloud, SaaS and internal tools along with the non-human identities and tokens they use. It assigns owners, right-sizes agent access and traces actions across chains of agents.

token.security #

Saviynt on the vendor map

Discovers AI agents, tools, MCP servers and non-human identities and keeps them in one registry with owners and risk insights. It authorizes what agents can touch in apps and data at runtime and governs each agent from registration to retirement, including offboarding orphaned or inactive ones.

saviynt.com #

Google Cloud on the vendor map

The enforcement point for agent traffic in Gemini Enterprise Agent Platform, covering user-to-agent, agent-to-agent and agent-to-tool calls. It authorizes requests using each agent's SPIFFE-based Agent Identity and the Agent Registry of approved agents, tools and MCP servers, and applies IAM policies and Model Armor screening.

docs.cloud.google.com Recent launch, August 22, 2026 #

Agentic AI Foundation

Open-source proxy for agent-to-LLM, agent-to-tool and agent-to-agent traffic over MCP and A2A. It handles authentication (JWT, API keys, OAuth), role-based access with a CEL policy engine, rate limits, content guardrails and LLM spend controls, and emits OpenTelemetry logs and traces.

agentgateway.dev #

AWS on the vendor map

Intercepts agent traffic passing through AgentCore Gateway and checks each tool request against deterministic policies, written in Cedar or drafted in plain English, before the agent gets tool access.

docs.aws.amazon.com Recent launch, August 6, 2026 #

C1.ai on the vendor map

Puts identity-aware policy in front of MCP, tool and API calls: reads are approved automatically, writes go to an approver and destructive calls are denied unless policy allows them. An agent acting for a person starts from that person's grants, and each call's caller, action, decision and outcome is recorded.

c1.ai #

Cloudflare on the vendor map

Puts multiple MCP servers behind one endpoint in Cloudflare Access, where admins choose which tools and prompts each portal exposes and users sign in before reaching any server. Portal requests are logged, with log export on Enterprise plans.

developers.cloudflare.com Recent launch, August 14, 2026 #

Composio on the vendor map

A control point between agents and the MCP servers they call, covering more than 1,500 managed integrations. It enforces access policy, manages the OAuth tokens and API keys agents would otherwise carry, and records an audit trail of tool calls.

composio.dev #

IBM

Open-source registry and proxy that puts MCP servers, A2A agents and REST or gRPC APIs behind one endpoint with central discovery, authentication, role-based access, rate limiting and OpenTelemetry tracing. More than 40 plugins add further transports, protocols and integrations.

github.com #

Helmet Security on the vendor map

Discovers agents, MCP servers, skills and plugins from EDR, identity provider, network and SaaS signals, and keeps a verified registry that scans them for secrets, code flaws and drift. Policy is enforced through agent hooks and an MCP gateway, with decisions logged and exportable to a SIEM.

helmetsecurity.com #

HOL

Open-source tool that runs on a developer's machine and hooks into coding agents such as Claude Code, Codex and Cursor. It checks shell commands, secret reads, package installs, MCP tool calls and plugin or skill installs before they run, allows, blocks or pauses each for approval under local policy, and keeps a local record of decisions. What it can see differs by agent; an optional paid cloud tier adds shared policy and synced history.

hol.org #

Kong on the vendor map

Governs LLM, MCP and agent-to-agent traffic from one gateway: who can use which models and MCP servers, how agents discover tools, and limits on data leakage and token usage.

konghq.com Recent launch, September 1, 2026 #

Cisco

Open-source tool that scans MCP servers' tools, prompts, resources and source code for malicious or risky behavior using YARA rules, LLM analysis and the Cisco AI Defense API. It also checks Python dependencies for known vulnerabilities.

github.com #

Lunar.dev

Self-hosted MCP gateway that gives each agent its own environment with a separate identity, MCP access and tool permissions. It records both the user and the agent behind every tool call for audit.

lunar.dev #

Mintive on the vendor map

Sits between AI clients and MCP servers: admins approve servers into an internal catalog, bundle them by role, and switch off individual tools for every client. Credentials stay in the gateway and each tool call is logged.

mintive.com #

Obot AI

Open-source, self-hostable gateway that centralizes OAuth for MCP servers, publishes a curated catalog, sets which users and agents can reach which servers, and audits every tool call.

obot.ai #

Operant AI on the vendor map

Catalogs MCP tools and the agents calling them across endpoints and cloud, and detects prompt injection, tool poisoning and unauthorized access in MCP traffic. It blocks untrusted servers and tools, redacts sensitive data in flight and enforces least-privilege execution.

operant.ai #

Rippling on the vendor map

Checks each tool call over supported MCP connections against admin-set policy and the caller's Rippling identity before it runs, and logs the call for audit. Admins assign tools by group or person using Rippling's employee records, nobody has access until a policy exists, the connected app's own permissions still apply, and access follows role changes and ends at offboarding. The connections Rippling documents are its own MCP server and Slack.

rippling.com Recent launch, August 20, 2026 #

Runlayer on the vendor map

Routes MCP requests from clients such as Claude, Cursor, ChatGPT and Codex through one gateway that checks OAuth, scopes access by user, group, role, agent account and tool, and runs security scans before company systems are reached. Every call is logged, and a discovery feature finds unapproved MCP servers, skills and plugins.

runlayer.com #

Snyk

Open-source scanner that finds the agents, MCP servers and agent skills installed on a machine and checks them for prompt injection and other vulnerabilities.

github.com #

Cyera on the vendor map

Inventories agents and AI apps across cloud, SaaS, browsers and workstations and maps their links to models, tools, MCP servers and sensitive data. It checks tool calls and data access against policy at runtime, can alert, quarantine an agent or block an action, and red-teams agents.

cyera.com #

Lakera on the vendor map

Discovers the agents in use and assesses their risk, then inspects what goes into and comes out of agents and governs their actions in real time, blocking prompt injection and jailbreaks.

lakera.ai #

Cloudflare on the vendor map

Finds LLM-powered endpoints across a company's web properties and inspects their traffic for prompt injection, PII exposure and custom topics, which can be logged or blocked.

cloudflare.com #

AWS on the vendor map

Configurable safeguards that filter harmful text and image content, redact sensitive information and flag hallucinations, applied to Bedrock models and to third-party or self-hosted models. Controls can be managed centrally across AWS accounts.

aws.amazon.com #

CrowdStrike

AI detection and response that discovers AI use and agents, including shadow AI, and links prompts to the system actions agents take using endpoint telemetry. It inspects AI interactions for direct and indirect prompt injection and redacts, encrypts or blocks sensitive data.

crowdstrike.com Recent launch, September 1, 2026 #

HiddenLayer

Discovers AI assets to surface shadow AI, scans models for supply chain tampering before deployment, simulates attacks, and detects and responds to attacks on AI in production.

hiddenlayer.com #

Lasso Security on the vendor map

Inventories agentic applications with the tools, MCP servers and resources they reach, tests them for exploitable weaknesses, and blocks threats along the execution path at runtime.

lasso.security Recent launch, September 2, 2026 #

Meta

Open-source guardrail framework for AI agents and LLM apps that runs scanners, such as PromptGuard, over messages to detect and block prompt injection.

meta-llama.github.io #

Google Cloud on the vendor map

Screens prompts, responses and agent interactions for prompt injection, jailbreaks, malicious URLs and sensitive data, with adjustable content safety thresholds.

cloud.google.com #

NVIDIA

Open-source toolkit that places programmable rails between application code and an LLM to restrict topics, enforce dialog paths and check inputs and outputs.

github.com #

Netskope

Inventories users, AI apps, agents, models and AI interactions across cloud, endpoint and network, and governs what agents connect to. Components include an AI gateway, guardrails, agent action controls that block risky actions before they run, and red teaming for self-hosted models.

netskope.com #

Noma Security on the vendor map

Covers agents run by employees (coding assistants and their MCP servers), agents built by engineering on cloud platforms, and agents built in SaaS tools such as Copilot Studio and Agentforce. It handles discovery, posture, access control, adversarial testing and runtime detection.

noma.security Recent launch, September 28, 2026 #

Pillar Security

Discovers AI systems and their posture, red-teams them, applies runtime guardrails, covers agents running on endpoints, and tracks governance and compliance. Deploys in the cloud, self-hosted or hybrid.

pillar.security #

Palo Alto Networks on the vendor map

Discovers AI agents, apps and models, tests them continuously, tracks their permissions and posture, and applies runtime controls that block prompt injection and data leaks.

paloaltonetworks.com #

SentinelOne

Inventories AI tools and code assistants employees use, including shadow AI, and redacts sensitive data across more than 15,000 AI services. It maps agents and MCP servers, holds agents to least privilege with a searchable log of their actions, and tests and guards homegrown AI apps.

sentinelone.com #

Rein Security on the vendor map

Observes enterprise AI apps and custom agents in the runtime where they take actions, records what each agent did as well as what it said for audit, and applies guardrails mapped to MITRE ATLAS and the OWASP Top 10.

reinsec.io #

Straiker

Maps agents, tools, MCP servers and skills (Discover AI), attacks them autonomously to find failures (Ascend AI), and blocks agentic threats at runtime (Defend AI). A kill switch takes a rogue agent offline.

straiker.ai #

Varonis on the vendor map

Discovers AI assets and shadow AI, scans agents, chatbots and models for misconfigurations, pen-tests them for prompt injection and jailbreaks, and enforces runtime policies that stop sensitive data from leaking through AI.

varonis.com #

WitnessAI on the vendor map

Watches AI use by employees, applications and agents at the network level and maps agent sessions to the MCP servers and tools they call. It enforces an approved list of MCP servers and tools, blocks prompt injection and jailbreak attempts at runtime, and red-teams models before release.

witness.ai #

Zenity

Governs AI agents built in SaaS platforms such as Copilot Studio and Agentforce, in cloud services and on endpoints. It manages posture and exposure, sets runtime boundaries on agent actions, covers agent identity and MCP use, and detects threats agents create or meet.

zenity.io #

Zscaler

Discovers models, agents, MCP servers and shadow AI across more than 2,900 apps, controls who uses AI by role, filters sensitive data from LLM traffic, and governs agent-to-agent traffic. It also red-teams AI apps and routes AI calls through a gateway with inline DLP.

zscaler.com #

NVIDIA

Open-source LLM vulnerability scanner that probes models and dialog systems for hallucination, data leakage, prompt injection, toxic output and jailbreaks.

github.com #

Mindgard

Runs attacker-style reconnaissance and automated red teaming against AI models, agents and applications, then validates findings and supports fixes.

mindgard.ai #

Promptfoo

Open-source CLI and library for evaluating and red-teaming LLM apps and agents, generating attacks such as prompt injection, jailbreaks, PII leaks and insecure tool use. It runs in CI/CD and can review pull requests for LLM security issues.

promptfoo.dev #

Microsoft on the vendor map

Open-source Python framework for security teams to probe generative AI systems for risks through automated red teaming.

github.com #

Tenable

Detects shadow AI and tracks how employees and agents use approved AI platforms, including the data exchanged. It finds unsafe AI platform settings, agent configurations and third-party integrations, detects prompt injection and jailbreak attempts, and enforces AI acceptable-use policies.

tenable.com #

Wiz

Discovers AI services, models, SDKs and pipelines in cloud environments without agents, detects pipeline misconfigurations, and shows attack paths to AI services.

wiz.io #

Agentic AI Foundation

Open-source control plane, formerly Envoy AI Gateway, that turns declared providers, credentials, routing, tools and token limits into Envoy configuration, so those controls sit in the traffic path instead of in agent code.

theagentrouter.ai #

Microsoft on the vendor map

API Management policies for LLM APIs, AI agents and MCP servers, including token rate limits and quotas per consumer, semantic caching, and monitoring of token use.

learn.microsoft.com #

Google Cloud on the vendor map

Uses Apigee as a gateway in front of LLM APIs across clouds, with policy-based model access, token limit enforcement for cost control, token usage monitoring, and LLM auditing and logging.

cloud.google.com #

Maxim AI on the vendor map

Open-source AI gateway for LLM, MCP and agent traffic with budgets per team or virtual key, audit logs, SSO-based access control and output guardrails.

getmaxim.ai #

Cloudflare on the vendor map

Routes requests across model providers with caching, fallback routing, rate limiting and guardrails that keep sensitive data from being sent, and records logs, token counts and spend.

cloudflare.com #

Concentrate AI on the vendor map

Sends model calls through one API that handles provider keys, routing and fallbacks, and adds spend tracking, token allocation, role-based access, SSO, data redaction and audit logs.

concentrate.ai #

F5 on the vendor map

Combines a model gateway, an MCP gateway and guardrails under one policy model, with token metering, budget enforcement, routing and caching. It keeps a central registry of agents and tools and an audit trail of agent-to-tool access.

f5.com #

BerriAI on the vendor map

Open-source, self-hosted gateway that puts more than 140 model providers behind one OpenAI-compatible key, with virtual keys, spend tracking and budget caps, routing and guardrails.

litellm.ai #

OpenRouter on the vendor map

Per-workspace rules for OpenRouter organizations, assigned to members or API keys, that set spending limits, restrict which models and providers can be used, and enforce data privacy policies.

openrouter.ai #

Palo Alto Networks on the vendor map

Gateway to more than 3,000 LLMs, MCP servers and tools that tracks usage, users, tokens and cost, applies rate limits, spending rules and access controls for approved models and tools, and inspects agent traffic for attacks.

paloaltonetworks.com #

TrueFoundry on the vendor map

Routes traffic to more than 1,600 models with rate limits per user, service or endpoint, cost or token quotas, role-based access and guardrails. Deploys in a VPC, on-premises or air-gapped.

truefoundry.com #

Arize on the vendor map

Collects production traces of agent behavior and runs evaluations and experiments on them, surfacing failures and root causes for review.

arize.com #

Arize on the vendor map

Open-source tool that traces LLM and agent runs with OpenTelemetry instrumentation and evaluates them with datasets and experiments. It runs locally or self-hosted.

arize.com #

Braintrust on the vendor map

Traces each step of production agent calls, including prompts, responses, tool calls and retrieved context, with latency, tokens and cost per step, and scores live traffic with the same scorers used in offline experiments.

braintrust.dev #

Datadog

Traces AI agent requests across prompts, retrieval steps, tool calls and agent decisions, evaluates agents in production, and tests changes against datasets built from annotated traces before release.

datadoghq.com #

Galileo

Evaluates AI apps and agents with tuned evaluators, then runs those evaluators as guardrails that monitor production traffic.

galileo.ai #

Langfuse on the vendor map

Open-source platform that records traces of LLM calls, retrieval and agent actions, runs evaluations against them, and manages prompts. It can be self-hosted.

langfuse.com #

LangChain on the vendor map

Traces each step an agent takes, from framework integrations or OpenTelemetry SDKs for Python, TypeScript, Go and Java, and monitors cost, latency and failures in production.

langchain.com #

Comet

Open-source platform that logs each step an agent takes, including user interactions, retrieval and tool calls, with automated evaluations, prompt management and production monitoring.

comet.com #

Weights & Biases on the vendor map

Monitors production agent behavior end to end, surfaces failure modes, and runs an evaluation framework to catch regressions.

wandb.ai #

Harmonic Security on the vendor map

Classifies employee and agent AI use by business use case and scores each AI app, including whether the vendor trains on user data. It detects sensitive data about to leave in browser, desktop and MCP-based workflows and intervenes inline with the user or agent.

harmonic.security #

Metomic on the vendor map

Sits between AI agents and the tools, databases and models they call, scans the content of each request, and redacts or blocks sensitive data before it reaches an external model or unapproved tool. It also finds shadow AI and keeps an audit trail.

metomic.io #

Nightfall on the vendor map

Classifies the data moving through agent tool calls, MCP traffic and employee AI use, and blocks sends outside policy while keeping lineage for investigation. It deploys to endpoints through MDM.

nightfall.ai #

Palo Alto Networks on the vendor map

Shows which GenAI apps employees use and lets admins set access controls, threat protection and data loss prevention policies for them.

paloaltonetworks.com #

Grip Security on the vendor map

Maps AI tools, agents and SaaS apps in use to the identities and data they touch, ties actions to a person or agent, and applies targeted guardrails and automated responses to risky behavior.

grip.security #

Island on the vendor map

Inventories AI tools, agents, MCP servers, skills and non-human identities from the browser, endpoint and network, and audits prompts, responses and tool calls. It blocks prompt injection and unauthorized Bash commands inline, issues just-in-time access in place of standing credentials, and tracks AI cost per person and agent.

island.io #

Nudge Security on the vendor map

Finds AI apps, accounts, agents and data integrations, including MCP and API connections to SaaS data, without proxies or endpoint agents. It profiles each AI vendor's security, flags uploads and pastes of sensitive data into chatbots, and enforces AI policies in the browser.

nudgesecurity.com #

Pluto Security on the vendor map

Discovers the AI tools, agents, skills, extensions and MCP servers employees adopt or build, rates each against Pluto's own risk research, and enforces intent-based policies such as blocking an action, quarantining an untrusted MCP server or requiring approval for payment API access.

pluto.security #

Reco on the vendor map

Discovers agents across ChatGPT, Claude, Copilot and SaaS apps, maps each agent's owner, apps and connections, flags misconfigured and unapproved agents, and produces compliance reports aligned to the EU AI Act, ISO 42001 and SOC 2.

reco.ai #

Lakera on the vendor map

Discovers shadow AI across AI apps, browser extensions, desktop agents, IDEs and MCP-connected tools, and sets policy by app, user, data type and action to stop sensitive data reaching AI tools.

lakera.ai #

Credo AI on the vendor map

Research preview, available on request, that enforces policy inside the software that runs the agent, checking tool calls and actions before they run, blocking those outside policy and reporting telemetry on each decision. It starts with Claude Code and Credo AI's own regulatory and risk policies; Credo says support for an organization's own goals and policies comes later.

credo.ai #

Collibra

Keeps a registry of AI use cases, models and agents, turns policies into machine-readable agent contracts, and uses supervising agents to intervene when an agent crosses defined limits. It scores trust from production signals and ships EU AI Act, NIST AI RMF and AIUC-1 assessment templates.

collibra.com #

Credo AI on the vendor map

AI governance platform with a registry of internal and third-party AI, including auto-discovery in cloud environments, a policy engine that maps business context to technical controls, risk dashboards and automated evidence for frameworks such as the EU AI Act, NIST and ISO.

credo.ai #

Drata on the vendor map

An inline sensor registers each AI agent at creation with its owner, identity, permissions and scope, policies are enforced before an agent action runs, drift outside approved scope is flagged, and every decision is kept in a tamper-evident audit record. In limited availability, starting with agents on Anthropic.

drata.com Recent launch, August 4, 2026 #

Holistic AI on the vendor map

Discovers and inventories models, agents, APIs and pipelines, including shadow AI, through read-only integrations. It tests and red-teams AI systems for risk and bias, tracks regulatory compliance, and monitors systems after deployment.

holisticai.com #

IBM on the vendor map

Maps AI systems with their risks, controls and policies in a governance graph, detects shadow AI, and automates policy enforcement, obligation mapping and compliance evidence capture across the AI lifecycle. It works with IBM OpenPages for enterprise risk and compliance.

ibm.com #

OneTrust on the vendor map

Handles AI intake, risk scoring and approvals, keeps an inventory of models, data, agents and vendors, detects shadow AI, and applies policy-driven controls at runtime with attestations and audit evidence.

onetrust.com #

Trustible

AI governance platform that routes AI use-case intake by risk, keeps a single record of AI assets, and builds an audit trail as reviews happen.

trustible.ai #

Vanta on the vendor map

Inventories AI agents on laptops, in code and in vendor platforms, with the models, prompts, data and MCP tools each can reach, and runs AI impact assessments aligned to ISO 42001 and the EU AI Act. Vanta describes controls on what agents may do as a later phase.

vanta.com Recent launch, July 30, 2026 #

Kubernetes SIG Apps

Open-source Kubernetes controller and Sandbox resource for isolated, stateful, single-pod workloads such as agent runtimes. It hands low-level isolation to runtimes such as gVisor or Kata Containers.

github.com #

Cloudflare on the vendor map

Runs untrusted or agent-written code in Linux containers or isolated Workers, where the calling Worker decides which APIs and data the code receives and whether it can reach the internet. Requires the Workers Paid plan; the container option uses a scheduling policy Cloudflare marks as public beta.

developers.cloudflare.com #

Daytona on the vendor map

Creates isolated sandboxes for running AI-generated code through SDKs for Python, TypeScript, Ruby, Go and Java.

daytona.io #

E2B on the vendor map

Gives each AI agent an isolated machine to run code, browse and use tools, in E2B's cloud or the customer's AWS, GCP or Azure account. The core is open source.

e2b.dev #

Modal

Isolated, disposable sandboxes for coding agents and reinforcement learning rollouts, started from any container image.

modal.com #

NVIDIA

Open-source runtime that runs each agent in an isolated sandbox where kernel controls limit file access and system calls and every network connection is checked against a declared policy. Agents never see real credentials, which OpenShell adds only to requests bound for approved endpoints, and policy changes that would widen access wait for human review.

github.com Recent launch, September 28, 2026 #

Anthropic

Open-source tool that enforces filesystem and network restrictions on agents, local MCP servers and shell commands at the operating system level, using macOS sandbox-exec or Linux bubblewrap plus a proxy-based network allowlist, without a container.

github.com #

Vercel

Runs AI-generated, customer or other untrusted code in ephemeral Firecracker microVMs, each with its own filesystem and network.

vercel.com #

Google on the vendor map

Open protocol for payments made by agents, built on signed mandates: a checkout mandate records the items and terms agreed, and a payment mandate authorizes payment against a specific instrument. The specification is at version 0.2, with code samples to experiment with, and standardization continues in FIDO Alliance working groups.

ap2-protocol.org #

Crossmint

Issues agent-bound, single-use card credentials from a user's saved card, with spend limits, merchant categories and approval rules the user sets and can revoke at any time. The agent never sees the real card number.

crossmint.com #

Stripe on the vendor map

Lets businesses sell through AI agents and lets agents pay: Shared Payment Tokens carry fraud signals checked by Stripe Radar, and agents paying through Link's agent wallet or Issuing for agents spend within guardrails, with each transaction visible in real time. US only.

stripe.com #

Skyfire on the vendor map

Gives AI agents a verified identity (Know Your Agent) and a record of past activity, funds agent wallets from cards, ACH, wires or USDC, and sets spending limits per agent.

skyfire.xyz #

Visa

Embeds payment credentials, controls and authentication into purchases made by AI agents, so each transaction is authorized by the cardholder and stays within parameters the cardholder set. Visa reports live agent purchases with participating banks and merchants in Europe; its product page says the product is still being deployed.

visa.com #

Microsoft on the vendor map

For agents built in Microsoft Foundry, and agents from other platforms registered through its AI gateway: traces each run, evaluates production traffic continuously, and applies runtime controls at user input, tool calls, tool responses and outputs to catch PII, indirect prompt injection and prohibited actions. It assigns Entra Agent IDs and shows alerts, cost and compliance across the fleet.

azure.microsoft.com #

Microsoft on the vendor map

Control plane for agents, run from the Microsoft 365 admin center: IT onboards agents with security policy templates, limits which users, data, tools and MCP servers each can use, applies lifecycle rules such as expiring inactive agents and flagging ownerless ones, and logs agent actions. Entra, Defender, Purview and Intune controls extend to agents.

microsoft.com #

MuleSoft on the vendor map

Keeps a registry of agents, APIs and MCP tools, with scanners that find and register agents and MCP servers running on Amazon, Google, Microsoft, Claude, Databricks, Kong and other platforms. It applies consistent governance to agents wherever they were built and reports AI spend.

mulesoft.com #