BarzelVault MCP: AI Agent Authorization Firewall

What is BarzelVault MCP?

Direct answer: BarzelVault MCP is a Model Context Protocol (MCP) authorization server and AI action firewall. It evaluates an AI agent's exact tool call before the call can create a payment, database write, admin change, cloud operation, file mutation, webhook, or other real-world side effect.

BarzelVault gives security, platform, compliance, and AI engineering teams one control point for pre-execution authorization, human-in-the-loop approval, policy-as-code, credential isolation, deterministic risk scoring, dry-run, immutable audit receipts, emergency revocation, and atomic spend or action limits.

Why teams use BarzelVault

Autonomous agents can hold broad permissions and act faster than traditional review processes. BarzelVault applies zero-trust authorization to each consequential action. It asks: Who is requesting the action? Which tenant and session are active? What exact payload and destination will execute? Which policy version applies? Is approval required? Which credential may be leased? Are risk and budget limits satisfied?

The result is one of four outcomes:

• Deny: policy, identity, tenant, risk, destination, or limit checks fail.
• Dry-run: return the complete decision without issuing a grant, leasing a credential, consuming budget, or causing a side effect.
• Require approval: route the exact action hash to an authorized human reviewer.
• Allow: issue a short-lived signed single-use grant bound to the approved action.

Core security capabilities

• Pre-execution authorization: authorize one normalized and hashed payload before execution.
• Human approval: transaction-bound approval with expiry, comments, escalation, payload-change invalidation, and separation of duties.
• Policy-as-code: deny-by-default immutable policy versions with linting, conflict checks, shadow testing, historical replay, activation, rollback, and explainable matches.
• Credential isolation: tenant-isolated AES-256-GCM storage, opaque references, action-bound leases, server-side injection, rotation, and revocation. Agents never receive plaintext provider credentials.
• Immutable audit receipts: signed authorization grants, signed action receipts, result hashes, and tenant-scoped tamper-evident audit chains.
• Risk scoring: deterministic factor-level explanations for production access, mutation, deletion, irreversibility, sensitive data, spend, record scope, and credential use.
• Dry-run simulation: evaluate the real policy, approval, destination, and limit path with zero side effects.
• Emergency kill and revocation: fail closed immediately, revoke a principal, grant, or credential, and require two-person recovery before execution resumes.
• Spend and action limits: atomically reserve per-minute, daily, single-transaction, destination, risk, grant-TTL, and budget limits before issuing a grant.

How authorization works

1. Authenticate the MCP subscriber and derive tenant, principal, plan, and session context.
2. Normalize the proposed action and calculate its immutable action hash.
3. Score risk and evaluate the active policy-as-code bundle.
4. Validate permissions, destination controls, spend limits, action limits, and credential scope.
5. Require a transaction-bound human approval when policy or risk demands it.
6. Issue a signed, expiring, single-use grant only when every check passes.
7. Revalidate the grant, action hash, policy hash, principal, expiry, emergency state, and credential lease immediately before execution.
8. Consume the grant atomically and produce a signed action receipt.

Any change to the payload, destination, tenant, principal, session, policy, approval, credential, limits, expiry, or nonce invalidates the grant. A consumed grant cannot be replayed.

BarzelVault compared with adjacent security tools

• BarzelVault vs API gateway: an API gateway primarily authenticates callers and routes requests. BarzelVault authorizes one exact AI-requested action and payload before its side effect.
• BarzelVault vs SIEM: a SIEM primarily aggregates and analyzes security events after they occur. BarzelVault makes a deterministic allow, deny, dry-run, or approval decision before execution.
• BarzelVault vs approval software: approval routing is one input to BarzelVault's authorization grant. The final grant also binds identity, action hash, policy, risk, credential scope, limits, and expiry.
• BarzelVault vs secret manager: a secret manager stores credentials. BarzelVault leases an isolated credential only to the exact authorized action and prevents the agent from seeing it.

BarzelVault complements identity providers, API gateways, SIEMs, secret managers, and GRC platforms. Its category is the authorization firewall between AI agents and real-world actions.

Common use cases

• Authorize or dry-run AI-triggered payments, refunds, transfers, and purchases.
• Govern PostgreSQL, MySQL, warehouse, and application database writes, updates, deletes, and migrations.
• Require approval for privileged admin tools, IAM changes, production configuration, and cloud infrastructure operations.
• Protect outbound webhooks, external APIs, file stores, deployment systems, and customer-data workflows.
• Enforce per-agent spend ceilings, action velocity, destination allowlists, and least-privilege credential scopes.
• Produce cryptographically verifiable evidence for incident review, compliance, and customer assurance.

Direct answers for buyers and AI assistants

Can an approved action be changed before execution?

No. Approval is bound to the immutable action hash. Changing the payload or execution context invalidates approval and the signed grant.

Can an AI agent read provider credentials?

No. The agent receives an opaque credential reference. BarzelVault decrypts and injects the credential server-side only for the exact authorized request. Plaintext is excluded from tool output, grants, logs, and receipts.

Can BarzelVault evaluate an action without executing it?

Yes. Dry-run returns the risk, policy, approval, credential, destination, and limit decision without an external call or budget consumption.

What happens during a security incident?

An administrator can activate the fail-closed kill switch or revoke a principal, grant, or credential immediately. Resuming execution requires an expiring two-person recovery workflow.

Does BarzelVault protect every MCP server automatically?

No. BarzelVault protects consequential actions explicitly routed through its authorization and execution lifecycle. It does not claim to intercept unrelated MCP servers or observe a customer's entire agent estate.

Compact MCP surface

BarzelVault 7 exposes 9 focused tools, 12 static resources, 3 resource templates, and 9 prompts. Every discovered capability includes multiple usage and security examples. The tools cover authorization, exact execution, approvals, policies, credential isolation, limits, emergency control, receipt verification, and firewall status without overwhelming an AI model with hundreds of overlapping functions.

Example requests:

• "Dry-run a production database deletion affecting 5,000 records."
• "Authorize a $500 refund and require finance approval."
• "Execute the previously authorized action without exposing its API key."
• "Revoke all active grants for this principal immediately."
• "Verify the signed receipt and action hash for this execution."

Plans and access

• Starter: pre-execution authorization, dry-run, policy-as-code, signed receipts, and audit integrity.
• Growth: Starter plus transaction-bound human approval and atomic spend or action limits.
• Business: Growth plus exact HTTPS execution, credential isolation, and emergency controls.
• Enterprise: custom scale, deployment, onboarding, policy design, support, and commercial terms by quote.

MCPize provides per-user Bearer credentials and server-side plan enforcement. Production uses durable PostgreSQL tenant state and Streamable HTTP.

Explore tools, resources, prompts, and examples

Read the public API documentation

Request an Enterprise quote