Network security for the agentic era

Least privilege for agents and humans

Reverse and forward proxies that keep credentials out of agents’ and humans’ hands, enforce fine-grained policies, and audit every action.

Get a demo ›

14:32:08claude-code · mayaSELECT email FROM usersMASKED

14:32:09[email protected]SELECT email FROM usersALLOWED

14:32:11claude-code · leoPOST api.github.com/repos/acme/api/pullsTOKEN INJECTED

14:32:12agent-vm-7f · samkubectl exec api-7fMFA APPROVED

Securing 1M+ requests/sec in production infrastructure

“Without Formal, we couldn’t give agents access to sensitive data. With Formal, we inspect all traffic and enforce controls, so we can give agents a safe environment to do the job.”

Travis McPeak

Head of Security

Watch the case studyHow Cursor secures engineers and AI agents with Formal

1,000+Resources secured

10+Technologies secured

40M+Logs per week

600K+Sessions per week

Read the full story ›

Formal Endpoint for agent sandboxes

Control every byte that leaves your sandboxes

One egress proxy for every sandbox: Kubernetes sidecar, VM, or microVM.

Every byte inspected: dozens of wire protocols, from DNS to layer 7
No secrets in the sandbox: credentials are injected at the proxy level, so agents never hold them
Tied to a human: short-lived OIDC identity across Cursor, Devin, AWS, Azure, and GCP

Get a demo ›

“Going from 0.0.0.0/0 to an allowlist felt like progress, until we realized every allowed domain is still an exfiltration channel. Formal lets our production agent do the work safely.”

Kevin Qiu · Lead Security Engineer

egress · cursor-agent-7f3aevery protocol

ALLOW  dns    A registry.npmjs.orgALLOW  tls    github.com:443ALLOW  http   POST api.anthropic.com/v1/messages              masked 2 secretsALLOW  pg     SELECT email FROM usersALLOW  ssh    git push origin feat/retryBLOCK  http   PUT paste.example.com/raw              not in egress allowlist

sandbox  POST api.github.com/repos/acme/api/pulls         authorization: <none>formal   policy allow · acting for [email protected]         + authorization: Bearer ghp_••••••••github   201 Createdsandbox  201 Created         the token never entered the sandbox

VERIFY  cursor  agent-7f3a     → [email protected]VERIFY  devin   session-41c    → [email protected]VERIFY  aws     lambda/triage  → [email protected]VERIFY  gcp     run/eval-job   → [email protected]VERIFY  azure   aca/agent-02   → [email protected]        tokens expire in 15m · no static keys        every request traced to a human

Formal Endpoint for workstations

Bring shadow AI into the light

Sees traffic from every process on every laptop: browsers, Claude, Codex, Cursor, and everything they spawn.

Humans and agents told apart: know whether a git push came from an engineer or their agent, and block agents that drift from their intent
Shadow AI discovered: find every unapproved harness, MCP server, and skill, then approve or block it
Spend and adoption tracked: every AI tool and model in one place, then route requests and optimize spend based on need

Get a demo ›

“We did a vendor bakeoff between a number of products and Formal came out on top.”

Daniel Pyykonen · Deputy CISO

endpoint · maya-macbookattribution

HUMAN  maya         GET  github.com/acme/api/pull/481AGENT  claude-code  POST api.anthropic.com/v1/messagesAGENT  └─ git       push origin feat/retryAGENT  └─ git       push --force origin main  BLOCK                     drifted from task: fix retry logicHUMAN  maya         psql prod-replicaAGENT  cursor       GET  registry.npmjs.org/react       every request tagged human or agent

type     name                laptops  statusharness  claude-code             186  approvedharness  aider                     7  newmcp      linear                  140  approvedmcp      unknown-server.dev        3  unapprovedskill    pdf-extract              12  new→ approved aider for engineering→ blocked unknown-server.dev on 3 laptops

model          requests  spendclaude-sonnet  1.2M      $18,420  ██████████gpt-5          410k      $6,110   ███gemini-pro     220k      $2,980   ██adoption      188 of 214 engineers · 88%top tool      claude-code on 186 laptops

Formal PAM

Gatekeep access to your most sensitive resources

Engineers and agents reach Postgres, Snowflake, SSH, and Kubernetes with their own identity and native clients. No shared credentials or standing access. Every query is masked, blocked, or allowed inline, and every session is recorded.

psql · prod-postgres

prod=> SELECT email, ssn FROM users;
 a***@gmail.com | ***-**-****
-- masked by policy mask-pii
prod=> DROP TABLE users;
ERROR: blocked by no-ddl-in-prod

Get a demo ›

Formal Catalog

Govern access to every resource in your org

One place where employees find the databases, MCP servers, and skills they can use, and request the ones they can’t.

catalog · acme

prod-postgresAccess

linear · mcpAccess

k8s-prodPending

github · mcpRequest

Get a demo ›

Formal Workflows

Create just-in-time access that expires on its own

Chain a trigger to actions: a Slack request form, an approval, a time-bound policy exception, a message back. Define workflows in YAML and manage them with Terraform.

workflow · prod-write-access

09:41 maya requests write · 2h
09:42 sam approves in Slack
09:42 no-writes-prod suspended
11:42 access expired

Get a demo ›

One platform

Replace your point tools with one network security stack

LLM and MCP gateways, PAM, SASE, VPNs, and routers are all the same thing: proxies. Formal’s two products, Endpoint and Connector, are powerful proxies that replace all of them. Formal Endpoint is a forward proxy on laptops, VMs, and pods. It terminates TLS to inspect and control every byte that leaves the machine. Formal Connector is a reverse proxy in your VPC that gatekeeps access to your most sensitive resources.

Connector

Privileged access management

Just-in-time access to databases, SSH, and Kubernetes. Short-lived credentials, session recording, and no standing privileges.

EndpointConnector

LLM & MCP gateway

See every prompt, response, and tool call between your agents, model providers, and MCP servers. Allow, block, or rewrite requests and mask sensitive data before it leaves.

EndpointConnector

Credential injection proxy

Agents and engineers never hold secrets. Formal injects API keys, tokens, and database credentials into requests at the proxy, so nothing can leak from a laptop, a prompt, or a sandbox.

Endpoint

Secure web gateway

Control what agents and employees can reach from their machines, with protocol-level visibility into every outbound request.

For developers

CLI, API, MCP, SDK, IaC — ship it.

Formal API

Formal is API-first: everything in the Control Plane is an API call. The API is defined in Protobuf, so our SDKs are generated from the same contract the server enforces.

Read the API docs →

Formal CLI

formal ls

Read the docs →

Formal MCP

Let Claude, Cursor, and other MCP clients search the docs, fetch logs, create policies, and more.

claude mcp add formal https://mcp.formal.ai/mcp --transport http

Read the docs →

IaC everything

Write guardrails for agents in Rego and ship them with Terraform, Pulumi, or the Kubernetes operator. This one lets cloud agents open pull requests but never merge them.

Read the policy docs →

# Agents open pull requests. Humans merge them.
resource "formal_policy" "agents_cannot_merge" {
  name        = "agents-cannot-merge"
  description = "Cloud agents cannot merge pull requests"
  status      = "active"

  module = <<-EOT
    package formal.v2
    import future.keywords.if

    request := {
      "action": "block",
      "type":   "block_with_formal_message",
      "reason": "Agents cannot merge pull requests"
    } if {
      input.user.type == "machine"
      input.http.hostname == "api.github.com"
      input.http.method == "PUT"
      endswith(input.http.path, "/merge")
    }
  EOT
}

import * as formal from "@formalco/pulumi";
import { readFileSync } from "fs";

// Agents open pull requests. Humans merge them.
new formal.Policy("agents-cannot-merge", {
  name:        "agents-cannot-merge",
  description: "Cloud agents cannot merge pull requests",
  status:      "active",
  module:      readFileSync("agents-cannot-merge.rego", "utf8"),
});

# Agents open pull requests. Humans merge them.
apiVersion: joinformal.com/v1
kind: FormalPolicy
metadata:
  name: agents-cannot-merge
spec:
  description: Cloud agents cannot merge pull requests
  status: active
  code: |
    package formal.v2
    import future.keywords.if

    request := {
      "action": "block",
      "type":   "block_with_formal_message",
      "reason": "Agents cannot merge pull requests"
    } if {
      input.user.type == "machine"
      input.http.hostname == "api.github.com"
      input.http.method == "PUT"
      endswith(input.http.path, "/merge")
    }

Blog

Latest updates

All posts ›

Giving Cloud Agents Production Access with OIDC, Not Secrets

How Formal uses OIDC to give cloud coding agents auditable, policy-controlled, short-lived access to production data and cloud infrastructure without long-lived secrets.

Oct 23, 2026 · Aditya Saligrama

PSA: fork() considered harmful in macOS

A macOS Network framework bug plus Go's fork/exec path can hang endpoint processes at 98% CPU. posix_spawn is the way out.

Aug 25, 2026 · Drew Gregory

The Metabase Zero Day and the Case for Enhanced Data-Layer Security

Lessons from the Metabase zero day, including how data access controls can limit exposure and support incident response.

Aug 11, 2026 · Coleen Coolidge

Ready to (zero) trust your agents?

One network security layer for every agent and human, from the laptop to production.

Get a demo ›