Network security for the agentic era

Least privilege for agents and humans

Reverse and forward proxies that keep credentials out of agents’ and humans’ hands, enforce fine-grained policies, and audit every action.

Get a demo › Read the docs ›

14:32:08claude-code · mayaSELECT email FROM usersMASKED

14:32:09[email protected]SELECT email FROM usersALLOWED

14:32:11claude-code · leoPOST api.github.com/repos/acme/api/pullsTOKEN INJECTED

14:32:12agent-vm-7f · samkubectl exec api-7fMFA APPROVED

Securing 1M+ requests/sec in tier-0 infrastructure

“Without Formal, we couldn’t give agents access to sensitive data. With Formal, we inspect all traffic and enforce controls, so we can give agents a safe environment to get the job done.”

Travis McPeak

Head of Security, Cursor

1,000+Resources secured

10+Technologies secured

40M+Logs per week

600K+Sessions per week

Watch the case study ›

Formal Endpoint for agent sandboxes

Control every byte that leaves your agent sandboxes

Formal Endpoint runs as the egress proxy of every agent sandbox. Deploy it as a Kubernetes sidecar, on a VM, inside a microVM, and more.

Every byte inspected: dozens of wire protocols, from DNS to layer 7
Risky actions blocked: such as an agent auto-merging its own PR
No secrets in the sandbox: credentials are injected at the proxy
Tied to a human: short-lived OIDC identity across Cursor, Devin, AWS, Azure, and GCP

Secure cloud agents ›

egress · cursor-agent-7f3afor [email protected]

ALLOW  POST api.anthropic.com/v1/messages
       masked 2 secrets
ALLOW  GET  github.com/acme/api/pull/481
BLOCK  POST api.github.com/graphql
       enablePullRequestAutoMerge · policy human-review
ALLOW  POST mcp.linear.app · create_issue
BLOCK  PUT  paste.example.com/raw
       not in egress allowlist

Formal Endpoint for workstations

Bring shadow AI into the light

Formal Endpoint runs on every macOS, Linux, and Windows laptop and sees traffic from every process, including browsers, Claude, Codex, Cursor, and everything they spawn.

Humans and agents told apart: every request is attributed to the engineer or to the agent acting for them
Direct and indirect traffic inspected: what the harness sends to LLMs and MCP servers, and everything its tools reach on the network, from databases and git to the web and APIs
Shadow AI discovered: the agents, MCP servers, and skills nobody approved
Spend and adoption tracked: every AI tool and model in one place
Secrets masked: before they reach model providers

Set up the Endpoint ›

endpoint · maya-macbookmacos

claude-code pid 4121
├─ POST api.anthropic.com    ALLOW
│    masked 1 secret
├─ mcp linear.create_issue   ALLOW
└─ mcp unknown-server.dev    BLOCK
     not in catalog
cursor pid 4388
└─ GET  pastebin.com         BLOCK
     web policy

Formal PAM

Gatekeep access to your most sensitive resources

Engineers and agents reach Postgres, Snowflake, SSH, and Kubernetes with their own identity and native clients. No shared credentials or standing access. Every query is masked, blocked, or allowed inline, and every session is recorded.

psql · prod-postgres

prod=> SELECT email, ssn FROM users;
 a***@gmail.com | ***-**-****
-- masked by policy mask-pii
prod=> DROP TABLE users;
ERROR: blocked by no-ddl-in-prod

Learn more ›

Formal Catalog

Govern access to every resource in your org

One place where employees find the databases, MCP servers, and skills they can use, and request the ones they can’t.

catalog · acme

prod-postgresAccess

linear · mcpAccess

k8s-prodPending

github · mcpRequest

Learn more ›

Formal Workflows

Create just-in-time access that expires on its own

Chain a trigger to actions: a Slack request form, an approval, a time-bound policy exception, a message back. Define workflows in YAML and manage them with Terraform.

workflow · prod-write-access

09:41 maya requests write · 2h
09:42 sam approves in Slack
09:42 no-writes-prod suspended
11:42 access expired

Learn more ›

One platform

Replace your point tools with one network security stack

Gateways, PAM, SASE, VPNs, and routers are all the same thing: proxies. Formal’s two products, Endpoint and Connector, are powerful proxies that replace all of them. Formal Endpoint is a forward proxy on laptops, VMs, and pods. It terminates TLS to inspect and control every byte that leaves the machine. Formal Connector is a reverse proxy in your VPC that gatekeeps access to your most sensitive resources.

Connector

Privileged access management

Just-in-time access to databases, SSH, and Kubernetes. Short-lived credentials, session recording, and no standing privileges.

EndpointConnector

LLM & MCP gateway

See every prompt, response, and tool call between your agents, model providers, and MCP servers. Allow, block, or rewrite requests and mask sensitive data before it leaves.

EndpointConnector

Credential injection proxy

Agents and engineers never hold secrets. Formal injects API keys, tokens, and database credentials into requests at the proxy, so nothing can leak from a laptop, a prompt, or a sandbox.

Endpoint

Secure web gateway

Control what agents and employees can reach from their machines, with protocol-level visibility into every outbound request.

For developers

Security as code

Write guardrails for agents the way you write infrastructure. Policies are written in Rego, reviewed in Git, and shipped with Terraform, Pulumi, or the API. This one lets cloud agents open pull requests but never merge them.

Read the docs ›

Build with

Terraform

Build with

Pulumi

Build with

API

# Agents open pull requests. Humans merge them.
resource "formal_policy" "agents_cannot_merge" {
  name        = "agents-cannot-merge"
  description = "Cloud agents cannot merge pull requests"
  status      = "active"

  module = <<-EOT
    package formal.v2
    import future.keywords.if

    request := {
      "action": "block",
      "type":   "block_with_formal_message",
      "reason": "Agents cannot merge pull requests"
    } if {
      input.user.type == "machine"
      input.http.hostname == "api.github.com"
      input.http.method == "PUT"
      endswith(input.http.path, "/merge")
    }
  EOT
}

import * as formal from "@formalco/pulumi";
import { readFileSync } from "fs";

// Agents open pull requests. Humans merge them.
new formal.Policy("agents-cannot-merge", {
  name:        "agents-cannot-merge",
  description: "Cloud agents cannot merge pull requests",
  status:      "active",
  module:      readFileSync("agents-cannot-merge.rego", "utf8"),
});

# Agents open pull requests. Humans merge them.
jq -n --rawfile code agents-cannot-merge.rego '{
  name: "agents-cannot-merge",
  description: "Cloud agents cannot merge pull requests",
  status: "active",
  code: $code
}' |
curl "https://api.joinformal.com/core.v1.PoliciesService/CreatePolicy" \
  -H "X-API-KEY: $FORMAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d @-

Blog

Latest updates

All posts ›

PSA: fork() considered harmful in macOS

A macOS Network framework bug plus Go's fork/exec path can hang endpoint processes at 98% CPU. posix_spawn is the way out.

Aug 25, 2026 · Drew Gregory

The Metabase Zero Day and the Case for Enhanced Data-Layer Security

Lessons from the Metabase zero day, including how data access controls can limit exposure and support incident response.

Aug 11, 2026 · Coleen Coolidge

Announcing Connector v2.0.0

Version 2.0.0 of the Connector significantly improves data efficiency and reliability when synchronizing data with the control plane.

Jul 8, 2026 · Aditya Saligrama

Ready to (zero) trust your agents?

One network security layer for every agent and human, from the laptop to production.

Get a demo › Read the docs ›