Blog on Formal - Network security for the agentic era

Giving Cloud Agents Production Access with OIDC, Not Secrets

Fri, 23 Oct 2026 00:00:00 +0000

At Formal, we hate secrets. Since day one, we’ve been on a quest to drive the number of long-lived secrets in our infrastructure to zero.

We want our product and the way our customers interact with it to reflect that philosophy, too. Accordingly, we built OIDC Integrations a few months ago: a way for arbitrary machine workloads to authenticate to Formal on the strength of their own infrastructure identity, and optionally attest a human identity along the way.

PSA: fork() considered harmful in macOS

Tue, 25 Aug 2026 00:00:00 +0000

At Formal, we love proxies, and we’ve been spending a lot of time writing proxies that don’t just run in containers but also on endpoints. As a result, our Go code has been running more and more on macOS lately. It also has been growing more and more Swift CGo bindings!

Upon upgrading to macOS Tahoe 26.5.2, however, some customers were experiencing some bizarre high CPU usage from our endpoint. We grabbed the following profile via sample:

The Metabase Zero Day and the Case for Enhanced Data-Layer Security

Tue, 11 Aug 2026 00:00:00 +0000

At Formal, when we meet with security engineers and CISOs to listen to their use cases and introduce our product, they always challenge us to frame our conversation in a way that makes their lives better and/or easier.

Yes, security absolutely cares about keeping up with fast-moving vendors and the rapidly improving tech stack. They love the opportunity to learn how they could be tackling the same problems more efficiently. But, they’re also grounded by the real-world risks they carry, ones they must knock out as quickly as possible before the clock runs out.

Announcing Connector v2.0.0

Wed, 08 Jul 2026 00:00:00 +0000

Today, we’re releasing version 2.0.0 of the Formal Connector, which significantly overhauls the way the Connector synchronizes data with the control plane. Our new system substantially improves data efficiency and reliability. We’ve been testing it with several customers over the past few months, and we’re excited to make it generally available today.

Change synchronization, more efficiently

The v1 Connector relied on a long-lived outbound gRPC connection, through which the control plane pushed configuration and policy changes in real time. Because network disruptions often caused the Connector to miss these pushed events, we had to add a frequent polling mechanism that dramatically increased database load and wasted bandwidth.

Security Debt We Never Created

Thu, 07 May 2026 00:00:00 +0000

Formal is critical-path software. In order to guard access to our customers’ most sensitive data and compute resources, the Formal Connector sits in a privileged network position in customer VPCs with connectivity and authentication to that infrastructure. Because of this setup, we take this responsibility incredibly seriously and invest significantly in reliability and security to ensure the availability of customer access and confidentiality of customer data.

As an early-stage startup, however, these efforts don’t require a large security team in order to provide full security coverage. Rather, we’ve kept the architecture straightforward, avoiding overcomplexity and obfuscation.

Stop Building Scaffolding: Who Cares About MCP vs CLI

Sat, 14 Mar 2026 00:00:00 +0000

The bitter lesson of AI infrastructure over the past three years is simple: any scaffolding built to compensate for model limitations is invariably destined to become obsolete. Not because the scaffolding was badly built. But because the models got smarter.

The debate about whether AI agents should use MCP or CLIs is the latest instance of this pattern, and it’s missing the point entirely. Both sides are arguing about scaffolding.

Editing Code Visually Without Sacrificing Fidelity

Thu, 29 Jan 2026 00:00:00 +0000

The Challenge

At Formal, we’ve chosen to build powerful primitives first. The downside is that powerful primitives are often harder to use. Think about coding in Rust versus JavaScript – more control means more responsibility. That’s why we’re also investing heavily in powerful abstractions that solve the UX problem.

We built the Formal Connector on top of OPA (Open Policy Agent). Compared to other products that invent bespoke JSON or YAML schemas for allow/deny rules, this is a much more powerful approach.

Using Proxies to Hide Secrets from Claude Code

Tue, 13 Jan 2026 00:00:00 +0000

Sandboxing agentic coding tools is a networking problem

Allowlisting commands on a trusted host for an agentic coding tool can be somewhat fraught. Taking inspiration from Simon Willison:

Sandboxes help us reason about their relation to the lethal trifecta:

What untrusted content is the sandbox exposed to?
How can they externally communicate?
What sensitive data are we providing to the sandbox?

Anthropic provides several sandboxing tools specific to Claude Code:

Introducing Fine Grained Control for Connector Logs

Wed, 17 Dec 2025 00:00:00 +0000

How does the Formal Connector work?

The Formal Connector is a protocol-aware reverse proxy that sits between identities (AI agents, users, and machines) and sensitive systems such as databases, SSH, Kubernetes clusters, and APIs. As requests flow through this Connector, teams gain visibility on requests and sessions to then enforce security policies such as blocking, masking, hashing, and more.

What data does the Formal Connector log?

The Formal Connector can see the traffic that passes through such as SQL queries, HTTP requests and responses, and stream events.

Allowlisting Some Bash Commands is Often the Same as Allowlisting All with Claude Code

Wed, 05 Nov 2025 00:00:00 +0000

Introduction

At Formal , we are heavy users of agentic coding tools for software development, and we’re trying to continue performing local development with these tools on our (admittedly beefy) laptops for as long as possible. One example is Claude Code. These tools feel particularly magical when verification loops are as fast as possible.

Having to explicitly approve every file edit Claude Code makes is time intensive — and so is having to explicitly approve every command Claude Code wants to run to get feedback on that code change before we review it ourselves. Some examples include running go build, go test, restarting a docker container, and running our linter!

From Security Problem to Security Solution

Thu, 30 Oct 2025 00:00:00 +0000

We built what our customers needed: a security-first PHI protection system that could deploy on-premise and provide defense in depth. We deployed it and it integrated into their environment seamlessly. Then some interesting happened – other healthcare companies started asking about it.

Why Healthcare Data Protection Needs a Security Mindset

At our core, we’re a security company. We think about threats, least privilege, and defense in depth. So when our customers came to us asking for PHI redaction and classification, we did what security companies do: we researched the threat landscape.

Formal Named Cloud Security Segment Leader in Latio Market Report

Tue, 14 Oct 2025 00:00:00 +0000

The Shift within Cloud Security and Privileged Access Management

Cloud Security is undergoing the most significant transformation since the rise of CNAPP. As infrastructure, data, and AI systems converge, the traditional separation between Cloud Security and Privileged Access Management (PAM) is disappearing.

What used to be distinct layers – runtime protection, posture management, identity access – are now merging into a single continuum of visibility and enforcement.

The 2025 Latio Cloud Security Report captures this moment clearly: organizations no longer want multiple, disjointed tools for cloud visibility, access, and enforcement. Instead, they’re moving toward unified access control and data-flow governance, where the same platform can both monitor and mediate how sensitive workloads are touched – by humans, systems, or AI agents.

The Permission Pitfall: Securing MCP Servers Without Limiting Value

Tue, 03 Jun 2025 00:00:00 +0000

Back in November, Anthropic introduced the Model Context Protocol (MCP), as the new (and now) standard way for connecting AI assistants to data sources and tools. The goal was to give LLM models the data context it needs to be effective at scale.

MCP has described as the “USB-C of AI agents” connecting AI agents to data and tools through a common interface. Instead of one-off integrations, MCP provides a consistent communication pattern, paving the way for flexible tool use and smarter systems.

Down the Rabbit Hole: Implementing SSH Port Forwarding over AWS Session Manager

Fri, 07 Feb 2025 00:00:00 +0000

I’m Formal’s newest hire. I graduated from Stanford two months ago, and my first day on the job was Monday, January 20. After a fast onboarding setting up my work laptop and phone, I was quickly added to our customer-shared channels.

That day, one of our customers paged us asking for help with an issue they were having. Two of the many protocols that the Formal Connector supports include SSH and AWS Session Manager (SSM), which our customer heavily relies on for engineering access to compute resources. This had been working well for them, but they had recently encountered some issues in trying to set up Remote SSH development via Visual Studio Code, in order to run machine learning workflows on a remote dev box with a GPU. This seemed like an odd bug, and so my first Formal task ended up being to investigate and fix the issue.

Building a Protocol-Aware Reverse Proxy: Lessons from Handling MongoDB's Unique Framing

Fri, 03 Jan 2025 00:00:00 +0000

The Formal Connector is a protocol-aware reverse proxy that interprets various wire-protocols (HTTP, Postgres, MySQL, Kubernetes, and much more) to provide security teams better visibility and control of their data flows.

Customers often start using Formal for one type of data store and then over time Formal covers more data stores in their stack. To keep the Formal deployment simple we built a feature that enables the Formal Connector to listen on a single port for multiple technologies. This feature works by detecting the incoming wire-protocol and then automatically loading the right wire-protocol interpreter.

Formal Comes Out of Stealth with $6.8M in Funding to Secure the Modern Data Stack

Tue, 19 Nov 2024 00:00:00 +0000

We’re excited to announce our seed funding round led by Thrive Capital with participation from Y Combinator, the founders of Datadog, Clickhouse, including C-level executives from Rippling, Plaid, Vanta and more.

This isn’t just a financial milestone. It’s a recognition of visionary customers like Gusto, Notion and Ramp who trust Formal to protect their most sensitive data and a bet on every customer who will trust us in the future.

“In a world where success is increasingly defined by one’s ability to safely leverage insights and AI, Formal is the leader to help enterprises secure and take action on their data. Formal has the right combination of talent, momentum, and technical insights required to solve this very difficult problem and help reimagine how every business can build incredible products safely on top of their most sensitive information.”