Syntak Security suite

Syntak Connect · Features

Everything Syntak Connect does.

Syntak Connect puts one controlled gateway between your AI agents and the tools they use. Every call is checked against who is asking, scanned for secrets and personal data, held for approval when it is risky, and logged. Here is everything it does today.

Request access to Syntak Connect Back to Syntak Connect 50 features in 9 areas
default rate limit per agent
120/min
single-use approval validity
1 hour
secret types in the vault
7
MCP protocol versions supported
3
starter policy packs
4
01

One gateway for many tools

Agents connect to a single endpoint. Syntak sits in front of every system behind it.

  • One endpoint, one token

    A single URL and token give a client everything that user may use across all connected systems.

  • Works with the clients you use

    Connect Cursor, Claude Desktop and Claude Code, VS Code with Copilot, Windsurf, and other MCP clients.

  • Several agents per token

    One token can span several agent profiles, and the strictest rate limit applies.

  • MCP servers and plain APIs

    Register MCP servers and ordinary HTTP APIs, including AWS APIs signed with SigV4.

  • Automatic failover

    If one identity or connection fails, equivalent tools on a sibling connection, such as the same system over MCP and then REST, are tried.

02

Tool discovery at scale

Thousands of tools stay usable without drowning the agent.

  • Search, describe, and call

    Tools that are not listed up front can still be found, inspected, and called on demand.

  • Lean tool lists

    Only a capped, relevance-ordered set is advertised, so clients that limit tool lists keep working.

  • OpenAPI import

    Turn an API spec into catalog tools, named from each operation, with read or write set from the HTTP method.

  • Read or write, decided per call

    Each call is classified from its content, including GraphQL mutations and action verbs, so one multi-purpose tool is not treated as read-only.

  • Dry run

    Add a dry-run flag to see whether a call would be allowed or denied without touching the upstream system.

03

Access control and grants

Nothing is allowed unless someone granted it.

  • Per-tool read and write grants

    Grant tools to a user or a group, and explicit denies override allows.

  • Access matrix and effective-tools view

    See what any user can actually do, and why a call was denied.

  • Role matrix

    Apply a role's access in bulk, with a preview first.

  • Grant reviews

    Grants record who reviewed them and when, to support periodic access reviews.

  • Agent profiles

    Give each agent its own connected systems, instructions, enabled flag, and rate limit.

  • Users, groups, and invites

    Manage a directory of users and groups, with invites and a SCIM-style endpoint for agents.

04

Guardrails and redaction

Every call is scanned on the way in and on the way out.

  • Deny, redact, or require approval

    Rules match keywords or patterns in arguments and results, and deny rules always run before redaction.

  • Built-in packs

    Block secrets in arguments, redact personal data in output, and block data-dump and exfiltration phrases.

  • Credit card detection that avoids false alarms

    Card numbers are checked with the Luhn checksum and card-network prefixes.

  • Extra checks on risky tools

    High-risk tools get a high-entropy secret check on arguments and schema checks on writes.

  • Policy engine that fails closed

    An OPA policy blocks secret-shaped fields such as passwords and API keys and enforces argument limits. If the engine is unreachable, calls are denied.

  • Starter policy packs

    Start from an enterprise baseline, customer support, developer and DevOps, or read-only analyst pack.

  • Matches are masked in logs

    The text that triggered a rule is not stored in the audit log.

05

Approvals and change control

A person decides when a call is risky, and standing rules cover planned work.

  • Approval for high-risk calls

    Tools you list, and tools rated high or critical, wait in a queue for a human to approve or deny.

  • Single-use, expiring approvals

    An approval can be used once and expires after one hour.

  • Production write approval

    Writes in a production environment need approval unless the caller's standing grant covers them.

  • Standing rules for change windows

    Admins turn on allow or deny rules for a user, tool, and agent for the length of planned work, then turn them off. An allow skips approval only, and a deny blocks the call.

  • Jira change-ticket check

    A call can pass automatically if it cites a Jira ticket in an allowed project, issue type, and status, and otherwise falls back to a person or a denial.

  • Guardrail-triggered approval

    A guardrail can route a matching call to approval instead of blocking it.

06

Upstream connections and credentials

Agents never see credentials. Syntak adds them at call time.

  • Vaulted secrets

    Secrets are stored in AWS Secrets Manager, with a memory-only mode for local development.

  • Seven secret types

    Tokens, API key pairs, usernames and passwords, SSH keys, AWS credentials, OAuth clients, and OAuth refresh tokens.

  • Credentials never reach the agent

    Secrets are injected into upstream calls, and OAuth tokens refresh automatically.

  • Calls run as the person

    Users link their own accounts with OAuth, for systems such as Atlassian, GitLab, Slack, and Microsoft, so actions are taken as them.

  • Who may use which secret

    Control who can use a secret and which server may receive it.

  • Connection safeguards

    Health checks, locked server addresses, and blocking of cloud metadata addresses.

07

Audit and visibility

Every decision is recorded, and you can stop everything with one switch.

  • Decision log

    Each call is recorded as allowed, denied with a reason, pending, dry run, or error, with a severity.

  • Searchable and exportable

    Filter the audit trail by time and export it from the console.

  • SIEM-friendly files

    Hourly NDJSON files, written to encrypted S3 storage in cloud deployments.

  • Kill switch

    One switch blocks every tool call, and flipping it is itself audited. A risk signal at severity 80 or above can trigger it automatically.

  • Denial message for your organization

    Add your own support message to every denial.

  • Activity dashboard and scorecard

    See activity and a posture scorecard in the console.

08

Admin console and API

Everything is managed in the browser or through an API.

  • Web console

    Manage agents, servers, secrets, access, safeguards, approvals, activity, and the kill switch.

  • Guided client setup

    Generate the connection configuration for the client you use.

  • Sign-in security

    Invite-only accounts, authenticator-app MFA required by default, lockout after five failed attempts for 15 minutes, and a 12-character minimum password.

  • Administer from an agent

    Admins can run grants, OpenAPI imports, and server setup through MCP tools.

  • REST API

    Everything the console does is available under a versioned API.

09

Deployment and hosting

Runs on AWS with the protections you would expect, or locally for development.

  • AWS stack in Terraform

    A VPC, load balancer, ECS services, encrypted Postgres, S3 buckets, IAM, and a web application firewall, with separate stage, production, and sandbox environments.

  • Firewall in front

    Per-IP rate limiting, IP-reputation and known-bad-input rule sets, and WAF logging.

  • Local mode

    Run the whole gateway with Docker Compose for development.

  • Safe startup

    Cloud environments refuse to start with the default signing key.

Syntak Connect

See Syntak Connect with your own data.

Broker AI agent tool access through security guardrails, policy checks, and approval gates for risky actions.

Request access to Syntak Connect