Approve what your agents do with tools.
Route your agents' MCP tool calls through SAVI. Restrict tools, decide what happens with unknown ones, and hold sensitive calls until a person approves.
Early access: we set it up with you.
Tool call from an agent
Rule
issue_refund is restricted for Support and needs approval.
Approval queue
Expires in 58 min
The agent is told the call is pending and checks back. Nothing reaches the payments server yet.
Illustrative example. The decision is recorded with who made it.
Agents can act. A person can still decide.
A log tells you what an agent did with a tool. SAVI can stop the call, or hold it until someone says yes.
01
One gate for every tool server
Agent tool calls go through SAVI to the server address you registered, and nowhere else.
MCP gateway
02
Unknown tools handled
Decide per server whether a tool SAVI has not seen is allowed, warned about or blocked.
Unknown-tool setting
03
A person approves the risky calls
Sensitive tool calls wait in a queue until someone approves or declines them, and expire if nobody does.
Approval queue
04
Tied back to the run
Each tool call carries the agent's run ID, so it sits with the run's cost and calls.
SDK run correlation
Register the server. Decide the rules.
Four steps, with us during early access.
Register
Add each MCP server with its address, environment and risk tier.
Discover
List the server's tools, with the hints it publishes, and set a risk tier for each.
Set rules
Restrict tools, mark the ones that need approval, and choose what unknown tools get.
Point agents
Send your agents' tool calls to SAVI's address for the server.
How tool approvals work.
Routing, unknown tools, approvals and what early access covers.
What does early access mean here?
The gateway runs in SAVI today, under its early-access address. It accepts SAVI API keys, not OAuth sign-in yet, and you run tool discovery by hand when a server changes. We set it up with you.
How do agent tool calls reach SAVI?
You register each MCP server with SAVI and point your agents at SAVI's address for it. SAVI forwards each request only to the server address you registered, never to one the request supplies. An unknown server, another workspace's server and an inactive one all get the same not-found answer.
What happens with a tool SAVI has not seen?
Each server has a setting for tools that are not in its registry: allow, warn or block. Run discovery to list the server's tools, with the descriptions and hints the server publishes, and give each a risk tier.
How does an approval work?
A restricted tool can be marked as needing approval. Under a block rule, its calls are then held instead of refused. The agent gets a pending answer and checks back. Someone with the right permission approves or declines; an approved call is then run by SAVI, and the work survives a restart. A request expires after an hour by default.
Can tool calls be tied back to the agent's run?
Yes. With the SAVI SDK's tool-call instrumentation on, each call carries the agent's run ID, so it joins the run's cost and call record.
Where are the rules written?
On the governance side of SAVI, the same place as model rules: restrict tools on a server for the whole workspace or a team, and choose alert, warn or block. Conditions that depend on the calling agent do not apply to tool calls yet.
Writing the rules? Governance · AI register
Put a person in the loop for the calls that matter.
Tell us which tools your agents use. We will set up the gateway with you and walk through the rules and the approval queue.