One secure gateway for all your tools Agents need access. Enterprises need control. Say what agents can do. Prove what they did. Approve what the organization can reach. Unvetted servers are denied by default. Expose only the tools a group needs, not the whole catalog a server ships. Allow and deny by server, tool, transport, and call, evaluated before anything runs. Cut off a server or a tool and every session picks it up on the next call. A structured event per evaluation, tied to user and agent, streamed to your SIEM. One enforcement point, whatever the server is. Add a server once. Publish it to those that need it. Approve once, publish by group The groups you scope it to pick it up on their next session. Connect the client once One endpoint per client. Catalog and policy changes land without anyone reconfiguring anything. Containerized servers run isolated Each one in its own container, separated from the machine it was launched from. Credentials stay in your store Supplied when a tool runs, never distributed through client config files. We already run the servers you are trying to govern. We package and distribute MCP servers We publish and version the servers your developers want, in registries you already trust. We control how they execute Isolated execution on the runtime you already run in production. One control point across every source Remote, internal, and Docker-packaged servers enforce the same identity, policy, and audit rules. The same model covers the agent itself Tools called from Docker Sandboxes and third-party clients follow one policy model, not two. Plugs into the systems you already trust. SSO and identity Sign in through your provider. Policy follows the groups you already manage. Structured events per tool call, in the pipeline your security team already watches. Credentials are read at call time from the store that already holds them. Write rules in the gateway, or delegate to the policy engine you already run. Catalogs and registries Publish private catalogs from registries you already operate, internal servers included. Deploy it where your compliance team already said yes. Managed in your cloud Docker-operated, inside your own account or VPC. Data and traffic stay in your environment. Air-gapped appliance

Private Kubernetes with no outbound connection. Catalogs, server images, and policy load from inside your network. Docker-managed cloud Multi-tenant, operated by Docker. Governed MCP without running the infrastructure. Control agent execution. Control agent tool use. Audit both. Docker Sandboxes Governs agent execution: the network the agent can reach, the files it can touch, and which MCP servers load in each sandbox. See Docker Sandboxes MCP Enterprise Gateway Governs agent tool use: which servers and tools any client can call, with identity, policy, and credentials applied to every call. Docker AI Governance Control and visibility across both: what an agent may execute in a sandbox, and what tools it may call through the gateway. One place to set policy, one record of what happened. See AI Governance Already governing MCP in production. Thousands of developers Multiple agent harnesses Global semiconductor manufacturer Replaced separate MCP configurations across several coding agents with one approved catalog for thousands of developers. Its platform team scopes access by identity group and revokes it organization-wide without redistributing anything. Thousands of developers Multiple agent harnesses Consumer social platform With hundreds of millions of monthly users, it retired a homegrown MCP proxy for a governed gateway: identity-bound policy, a record of every tool call, and internal servers reaching agents without handing credentials to developers. Common questions What does the gateway actually do on each call? It authenticates the user through your identity provider, resolves which servers and tools that user’s groups can reach, evaluates policy for the specific call, injects the credentials the call needs, routes it to the server, and records the decision. Which clients can connect? Clients that speak MCP, including Claude Code, Cursor, VS Code, Codex, ChatGPT Enterprise, and agents your teams build in house. What kinds of servers can I connect? Remote services over HTTP or SSE, containerized servers, and the internal servers your own teams build. Containerized servers run isolated in their own containers. Where do credentials live? In your approved secret store. The gateway supplies them when a tool runs, so long-lived credentials are not distributed through client configuration files. Can it run fully air-gapped? Yes. Catalogs, server images, and policy load from inside your network with no outbound connection. How does this relate to Docker Sandboxes? Sandboxes governs the environment an agent runs in. The gateway governs which servers and tools it can call. Either works alone, and many customers run both. What is Dynamic MCP? A way of exposing tools so the agent discovers and invokes what it needs instead of loading every definition up front, which keeps context usage flat as the catalog grows. Give agents access. Keep control of every call. Talk to an expert Thank you for your interest. The Docker Team will be in touch