One gateway. Every agent. Full accountability.
The Omnafy Gateway is the control room for your agent workforce. It decides what agents can touch, watches everything they do, and proves it afterward.
What sits inside the gateway
Every capability an agent can reach is declared, scoped, and recorded. There is no side door.
One MCP gateway
Every tool from every connected system sits behind a single endpoint, with namespacing and per-identity visibility. An agent only sees what its scope allows.
Runs in your VPC
The gateway and every agent run inside your own VPC, not ours. Omnafy operates the control plane; your systems and the data agents touch never leave your cloud account.
Agent & workflow directory
Versioned, declarative definitions with a draft, approve, live lifecycle. Changes to agent behavior are reviewed like code.
Triggers
Schedules, inbound email and documents, and system events start runs automatically. Anything can also be run manually by an authorized person.
Approval queues
Consequential actions arrive with the evidence attached. Approve, correct, or decline; every decision is recorded and feeds the evaluations.
Run explorer
A full transcript of every run: each tool call, its inputs, outputs, outcome, and cost. When you ask why the agent did something, there is an answer.
Metering & reporting
Per-run cost accounting rolls up to monthly reports. You always know what your agent workforce costs and what it produced.
Agents that build agents
Describe a workflow in plain English; a builder agent drafts the definition for human approval. Created agents can never exceed their creator's permissions.
How a request travels
The same path applies whether the caller is an autonomous agent, a copilot, or a member of staff in an MCP client.
Authenticate
- Every caller carries its own identity, never a shared account
- Scopes are resolved per request, not per session
- Tools outside the caller's scope are invisible, not just blocked
Authorize
- Each tool carries a risk tier that sets its supervision level
- T1 and above can require an approval before the call executes
- Policy lives in one place, so it cannot drift between systems
Record
- Inputs, outputs, outcome, and cost captured per call
- Approvals recorded with the evidence the reviewer saw
- Every record is attributable to a specific agent and run
The same gateway, for your team
A person in an MCP client and an autonomous agent are both just callers with an identity. Your staff connect Claude, Claude Cowork, or any MCP client to the same gateway, under the same permissions, approvals, and audit. No new interface, no migration.
For your staff
- Real operations on real systems, not copy-paste into a chat window
- Only the tools their role allows, so nothing is overwhelming
- Answers grounded in live company data rather than a stale export
For you
- Every action attributed to a named person
- Risky operations still route through approval
- One policy layer covering humans and agents alike
For the rollout
- The fastest way to feel what an agent workforce is like
- Runs while the autonomous agents are still ramping up
- The usage shows you which workflows to automate first
The gateway runs in your VPC.
This is the part most agent stacks get wrong. The Omnafy control plane runs as a managed service, but the execution plane, meaning the gateway, the agents, and every byte they process, runs inside your own VPC. Your data never leaves your cloud account.
Your cloud, your control
- Deployed inside your own VPC, in your cloud account
- Agents and the data they touch never leave your environment
- Omnafy operates only the managed control plane, never your data
Built for regulated data
- PHI and other regulated data stay in your account
- Meets network isolation and data-residency requirements
- Your existing cloud security controls still apply