One URL for every model.

Point Cursor, Claude Code or any SDK at it. Three things happen to every call before it reaches the model, and on the way back.

Start for free Read the docs

Redact.

What we detect is swapped out before the model sees it, and put back on the way home.

Card and account numbers, emails, phones and live API keys, in the stream itself. Names and addresses with the sidecar you host.

How it is measured →

Budget.

Every agent has a dollar limit. It stops at the number, or hands the call to a cheaper agent you named.

Spend is attributed to a person from your directory, and every call writes a row with what priced it.

Block.

Every prompt is screened at the door. Set the policy to block, and the model never sees it.

A canary in the system prompt catches a model that leaks it. The reply is cleaned and the event is on the record.

Keys.

A key for one agent, in one environment.

Your workload holds a KnoxCall key. The provider key is added at the wire and never leaves.

Bound to its holderBind a key to a keypair only you hold. A copied token without it is inert.
Test stays testA test key reaches only test routes, on every path. Live is a different key.
Federated for CIYour pipeline swaps its own identity for a short-lived key. No AI credential in a secret store.

Tools.

Your agent's tools are a credential surface.

Anyone with a server's URL usually gets every tool on it. KnoxCall makes that a policy decision.

The MCP Gateway in detail →
One token, one serverA token minted for one server is refused at any other. A stolen one is worth exactly one server.
Empty means nothingThe model sees only the tools the allowlist names. An empty list advertises nothing, not everything.
Arguments inspected tooTool arguments and results pass the same detectors as a prompt. Every call writes a row.

What is actually enforced.

Every control on this page, graded in three states.

Enforced means a request is refused or rewritten. Detect-only means recorded and alertable, nothing refused. Not shipped means exactly that.

  • Provider key never leaves KnoxCallEnforcedThe real credential is added at the egress hop. Your workload only ever holds a KnoxCall key.
  • Scope verificationEnforcedA key's scope is signed under your tenant key and re-checked on every call. A tampered key is refused.
  • Scope authoringNot shippedEvery key mints with an empty scope today, so you cannot yet narrow one to a provider, model, tool, cost, network or time window. What bounds a key is its agent, its environment and its binding.
  • Sender-bound keysEnforcedWhen you bind a key to a keypair at mint, a copied token without the private half is inert. A machine holding both is not protected by this.
  • Test and live kept apartEnforcedA test key reaches only test routes, on the primary and every fallback. MCP servers are partitioned the same way.
  • Model allow, deny, rewriteEnforcedA denied model is refused, wildcards work, and a rule that cannot be read fails closed.
  • Tool allowlistEnforcedTool definitions outside the allowlist are stripped or the call is refused, in both SDK shapes.
  • Per-agent budgetsEnforcedDay and month counters shared across workers; over the cap the call is refused. A named cheaper agent can take it instead, with the policies of the agent you addressed still in force.
  • Mid-stream redactionEnforcedEntities split across frames included, with the latency guarantee asserted in CI on every commit.
  • Buffered-response redactionEnforcedNon-streaming replies run the same detectors plus the optional sidecar. Compressed upstream replies are a known gap we are fixing.
  • Canary leak detectionEnforcedA per-tenant canary in the system prompt. An echo is cleaned out of the reply, raises a critical event and is never cached; a buffered echo under a blocking policy is refused outright.
  • Workload federationEnforcedYour pipeline exchanges its own identity for a short-lived, single-use token, verified against the issuer and confined to one resource.
  • Per-call audit and usageEnforcedEvery call writes an attributed row with what priced it. Request and response bodies are not stored unless an operator turns body logging on.
  • Prompt-injection screeningEnforcedHeuristics run on every request; a policy set to block refuses it. New gateways start at warn, so blocking is a choice you make.
  • Compliance packsDetect-onlyPack recognizers and alert rules install with evidence, and they detect. We do not yet put a pack behind a blocking policy, because measured on clean documents it fires too often.
  • Telemetry spansOpt-inEmitted on the global tracer; they go nowhere until you configure an endpoint.
  • MCP tool governanceEnforcedAllowlists, audience-bound tokens and a prompt-injection policy all enforce on tool calls, with the same detectors on arguments and results, spend caps, and the test and live partition.
  • IDE config generatorsEnforcedThe agent's Connect tab renders the exact files, variables and a verify command for your tool. Installing them is still yours to do.
  • Response cacheOpt-inOff unless an agent turns it on. Exact matching replays an identical request; approximate matching is confined to one caller's conversation on one agent.
  • Refresh-token rotationNot shippedDecided against, and the code deleted rather than left dormant. Short-lived keys, the mint API and the identity exchange already answer an expired token.

Head to head, with dated sources: KnoxCall against Cloudflare AI Gateway →

Store. Proxy. Revoke.

Free for seven days. No card. Your first call in minutes.

Start for free Talk to us
All systems operational