mcpip cloud
The managed gateway, while it's being built.
MCPIP Cloud will run the zero-trust authorization control plane for you — the same fail-closed, opaque, write-before-execute WORM gateway you can self-host today, without you operating the Redis, the durability posture, or the upgrades. It is not operating yet. Subscribing today buys early access and a signed Cloud entitlement — not a hosted gateway. Until the control plane ships, you self-host, free.
delivered today
- An Ed25519-signed MCPIP Cloud entitlement license, on your account page.
- A place in the early-access queue — hand-onboarded, in order.
- The self-hosted gateway, free and uncapped, in the meantime.
planned · not yet built
- A hosted gateway tenant provisioned for you.
- Managed Redis, durability posture, and upgrades.
- A per-tenant, customer-verifiable WORM signing key.
no tenant is provisioned on checkout · no GA, SLA, or compliance attestation is claimed for Cloud · cancel any time from the billing portal
By subscribing you agree to the Terms of Service and Privacy Policy.
what a subscription buys today
An entitlement and a seat at the table — not a hosted gateway.
Today
A signed Cloud entitlement license
Checkout mints an Ed25519-signed tier=cloud license bound to your subscription — your customer id, agent count, and expiry, re-issued as the subscription renews. You can read it, copy it, and verify its signature from your account page.
Today
An early-access place in the queue
You are onboarded by hand, in order. We talk through your identity provider and the workflows you want behind the gate, and you shape what the managed plane becomes — that is the point of buying at this stage.
Today
The full gateway, self-hosted, free
Nothing is being withheld while you wait. The same fail-closed, opaque, write-before-execute gateway is source-available and free to self-host, with no agent cap. You run a one-time key ceremony — your own signing keys, integrity manifest and license, all self-issued at no cost — because production refuses to boot on defaults. Cloud changes who operates it, and who runs that ceremony — never what the software does.
what we are building
Hosting the control plane will never mean holding your identity.
None of the three below is running yet — they are the design commitments the managed plane is being built to. We are stating them now so early-access customers can hold us to them.
Your IdP
plannedWe verify, we never mint
Bring your own identity provider; the hosted gateway will only VERIFY its JWTs — MCPIP never mints identity, and identity-shaped keys in tool arguments are a hard deny. This is already how the shipped gateway behaves; hosting it will not put us in your trust path for who an agent is.
Your key
plannedCustomer-verifiable WORM signing
Each tenant is to get its own WORM signing key, so the write-before-execute audit chain is signed per tenant and verifiable by you. The signed chain exists in the gateway today; the per-tenant hosted key ceremony is what we are building.
Your boundary
plannedThe tenant as the isolation unit
The planned shape: an isolated gateway backed by its own durable Redis, so the tenant is the security boundary rather than a shared row in a multi-tenant table. None of it is provisioned yet — no tenant is created when you subscribe.
what runs today vs what we operate later
Two tiers you can run right now. One we are still building.
Source-available core, free forever, no agent cap. No signup, no sales call. This is the tier that runs right now.
Enterprise features and support, inside your perimeter — including fully offline deployments.
Not operating yet. Subscribing buys early access plus a signed Cloud entitlement — while it is being built you still self-host.
early access · the managed control plane is not operating yet · no GA, SLA, or compliance attestation is claimed for Cloud
request early access
Get on the list.
Tell us who you are and what you want to govern. The list is free — no card, no subscription. We onboard deliberately, and we'll reach out to talk through your identity provider and the workflows you want behind the gate.
- 01We reach out, by hand, in order — from cloud@mcpip.ai
- 02You self-host the free gateway meanwhile — nothing is withheld
- 03You shape the managed plane before it exists
cloud_early_access
draft