Let people connect AI to company systems through one MCP gateway
An MCP Connection gives your people one address per MCP server. They sign in as themselves, and Oriant checks and records every call before it reaches the server.
One MCP Connection per MCP server
An MCP Connection is your workspace’s route to one MCP server: a name that is unique in your workspace, plus the server’s URL. AI clients reach it at https://app.oriant.app/mcp/{name} instead of connecting to the server. Oriant forwards only to registered connections. Adding or removing a connection needs a Permission that the Owner and Admin Roles hold. For every request, Oriant signs the person in, decides whether they may use the tool from the MCP Policies attached to their directory groups, and records the MCP Call before it forwards it.
Each member signs in as themselves
The first time someone uses a connection, one browser flow starts from their AI client. They sign in to Oriant with a passkey or authenticator code, approve the AI client, and sign in to the MCP server with their own account. The server then sees the person, and the call is recorded against the same person. An AI client always acts as one human member of your workspace. Oriant creates no accounts for agents and allows no anonymous access.
Server tokens stay encrypted in Oriant
Oriant stores each member’s server token encrypted with XChaCha20-Poly1305 and uses it only to forward that member’s calls. The AI client never receives it. If a server expires or revokes a token, the member reconnects from the AI client. Removing a connection deletes every member’s stored token for it and keeps its call history.
Claude Code, Cursor and Claude
Claude Code adds a connection with claude mcp add --transport http. Cursor reads the address from ~/.cursor/mcp.json. Claude on web, desktop and mobile takes it under Settings, Connectors, Add custom connector, and a connector added on the web also works in Claude Desktop and the mobile apps. Oriant accepts local apps that sign in through a callback on the same machine, Cursor desktop and Claude’s cloud. People keep their tools, and a direct connection to an MCP server is shown by the agent, not blocked.
Verified MCP servers and any server by URL
Asana, Cloudflare, Linear, PostHog and Slack are verified and added in one click. Most servers let Oriant register itself, so there is nothing to paste. Slack and Asana need your own app, and Oriant shows the steps and the redirect URL to use. Any other MCP server works when you add it by its URL. The quickstart takes about five minutes from adding a connection to a first recorded call.
If Oriant is unavailable
MCP calls through Oriant stop. A call that cannot be recorded is not forwarded, and a call is refused if the member’s policies cannot be read. Connections that go straight to a server are not affected, because they do not pass through Oriant. If the endpoint agent stops, its proxy settings are turned off so the machine keeps working. A direct connection stores the server token in each AI client and leaves only the server’s own logs as a record. Through Oriant the token stays in Oriant, and every call has a record that names the member and the AI client.
Hosted in Europe or self-hosted
The hosted version at app.oriant.app runs in Europe. You can also self-host the gateway and dashboard on one machine with Docker and a single Postgres, and no account is needed. The self-hosted edition keeps every call record in your own Postgres. It does not include Skills scanning.
Read the docs
More of Oriant
What can your AI reach today?
Oriant lists the AI clients, MCP servers, API keys and Skills on your machines, and it governs what AI does in your systems.