Your agent's tools are a credential surface.

A tool server holds real credentials for whatever it reaches. Anyone with its URL usually gets every tool on it. KnoxCall makes that a policy decision.

Start for free Read the docs

Three controls.

Each one a refusal you can reproduce, not a capability we assert.

Which tools exist for this caller, which token may reach this server at all, and what is allowed to travel in the arguments.

One token, one serverMinted for one server, refused at any other. Unbound is refused too, never treated as unrestricted.
Empty means nothingThe model sees only the tools the allowlist names. A caller's own token can narrow the set, never widen it.
Arguments inspected tooTool arguments and results pass the same detectors as a prompt; a policy set to block refuses the call.

The limits, before you find them.

This is a security product, so the gaps are on the page rather than in a footnote.

Enforced means a request is refused or rewritten. Not shipped means exactly that.

  • Audience-bound tokensEnforcedWrong server refused, unbound refused, a token that is not tool-bound refused. All three asserted in the test suite.
  • Tool allowlistEnforcedFilters what is listed and refuses what is not. Empty denies. The token intersects, never unions.
  • Prompt-injection policy on tool callsEnforcedA server can carry a firewall policy; a policy set to block refuses the call.
  • Detectors on arguments and resultsEnforcedThe shipped set, plus your own recognizers when a policy is attached to the server.
  • Per-call attributionEnforcedEvery tool call writes a row naming the token, the tool and the outcome.
  • Upstream pinning and secret referencesEnforcedThe upstream address is resolved and pinned on every hop; credentials are references, never plain text in the row.
  • Per-user credential passthroughEnforcedA server in passthrough mode forwards each caller's own credential, stores none, and refuses a call it cannot attribute.
  • Delegated OAuthNot shippedDesigned, not built, waiting on an identity-binding decision. Today: one credential for the server, or passthrough.
  • Test and live kept apartEnforcedA server belongs to one mode; a test token reaches only test servers.
  • Spend caps and the guardrail hookEnforcedA tool call is checked against the gateway's daily and monthly caps and debits them; the same external scanner hook a model agent has runs here.

The same gateway, for model traffic: the AI Gateway →

Store. Proxy. Revoke.

Free for seven days. No card. Your first call in minutes.

Start for free Talk to us
All systems operational