MCP governance for Microsoft-based companies
Every AI tool call, checked against the person who made it.
AI assistants such as Claude Code, Codex, VS Code and GitHub Copilot now reach company systems through MCP. Piquant sits in between: it applies each person's policy, asks a colleague when a rule says so, adds credentials the AI tool never sees, and keeps a record of what happened.
Piquant policy denied "delete_repository" (rule finance-read-only).
merge_pull_request on github needs approval. A team lead approves this exact call, once, within 10 minutes.
search_code on github ran with the person's own key. Recorded: who, which tool, the decision.
The problem
AI assistants now call real tools. Most companies cannot say who called what.
MCP servers connect AI tools to GitHub, Jira, databases and internal APIs. Their keys often sit in plain settings files, every person gets the same reach, and nothing records what happened.
Rules per person
Policy follows the person, from their Entra roles, not the machine. It is signed offline, so a compromised server cannot change it.
Approvals that bind
A rule can ask a colleague, on their own machine. The approval covers one exact call, once, and expires.
Keys the AI tool never sees
Credentials are kept sealed and are added when a tool starts, never written into the AI tool's settings, logs or prompts.
A record and a stop button
Every decision is recorded in a tamper-evident chain that can flow to your SIEM. A kill switch stops a person, tool or device within seconds.
How a call is checked
One gate, in one order, for every tool call
A Piquant agent runs once on each machine. The AI tool talks to it instead of to the MCP server directly. No call reaches a company tool until every check has passed and the decision is on the record.
- 1Identifywho is asking, from their sign-in
- 2Call ratea budget per person and tool
- 3Kill switchis anything suspended?
- 4Policythis person, this exact call
- 5Approvalwhen a rule asks for one
- 6Recordthe decision, before the call
- 7The call runsonce, with the key added
Keys
The AI tool never sees the key
Today, an MCP server's token usually sits in the AI tool's settings file, readable by anything running as that person. With Piquant, the settings name only the governed connection. Each person's keys, and the company's shared keys, stay sealed and are added only when an allowed call runs.
Personal keys
People set their own tokens once, in the Piquant app. They are sealed to their account on that machine.
Company keys
Shared keys stay on a company server, the Piquant gateway, and never reach a laptop.
Approvals
One exact call. Approved once.
A rule can require a colleague's approval for a risky call, such as merging to production or deleting data. The approver sees exactly what will run and decides on their own machine. The approval covers that call only, once, for a few minutes: change an argument and it needs a new one. Every request and decision is recorded.
- From
- a developer, on their PC
- Tool
- merge_pull_request
- Server
- github
- Preview
- repo: payments-api, pull: 482
AI tools
People keep the assistants they use
Piquant adds its governed connections to the AI tools people already use, or, for sensitive roles, locks those tools to company-approved connections. It also shows IT which AI tools on a machine are configured to use which MCP servers.
For IT and security
Built on what you already run
Microsoft Entra ID
App roles decide who may use what. On Entra-joined Windows, people are signed in through their Windows account without a prompt.
Intune and Linux packages
A Win32 app for Windows 10 and 11, Windows Server and multi-session hosts; packages for Linux and WSL.
Your servers, your data
The control plane runs on your own Linux or Windows server. No mandatory telemetry. Records go to your SIEM through OpenTelemetry.
Standards, not plugins
MCP, OAuth and OpenID Connect, Entra and OpenTelemetry. No proprietary plugin format and no agent framework to adopt.
Start with one team.
A pilot begins in provide mode: people keep their AI tools, and Piquant adds the governed connections. Locking, approvals and shared company tools follow when the team is ready.