The agent never sees a key.

An MCP gateway sits between your agents and your tools, so it has to be the most careful part of the setup. This page says exactly what Exorails stores, what it shows, and what it never does.

Last reviewed September 2026 · [email protected]
01 — What the agent sees
Agent
Claude Code, Codex, Cursor
Holds the environment URL. Sees tool names, schemas, results.
call →← result
Exorails gateway
Resolves the environment, opens the vault
Decrypts the credential in memory, adds it to the upstream request, forwards the call, discards it.
call + key →← result
Tool
Your MCP servers
Receive an authenticated request, exactly as before.
The agent sees
  • The environment URL, which is a capability: anyone holding it can call the tools in it
  • Tool names, descriptions and input schemas
  • Tool results, as returned by the upstream server
The agent never sees
  • API keys, tokens, connection strings or OAuth grants
  • Upstream server addresses, which stay inside the environment
  • Other environments, other members' URLs, or the account itself
02 — The vault

Encrypted at rest, one key per environment, decrypted only for the length of a call.

Envelope encryption

Every secret is encrypted with AES-256-GCM under a data key that belongs to its environment. Data keys are wrapped by a master key that is never stored with the data and never written to the database in clear.

Write-only by design

A value is pasted once. No screen, API or export returns it afterwards. Rotation replaces it; there is no read.

Used at call time

The gateway decrypts in memory, adds the credential to the upstream request, and drops it when the response is back. Secrets never sit in a cache.

Never in logs

The call log stores tool, agent, status and latency. Request and response bodies are not stored by default. Anything that is stored passes through a secret-pattern redactor first.

03 — Isolation and rotation

An environment is a wall

Tools, secrets and calls belong to one environment. A key used by one project cannot be referenced from another, even inside the same account. A URL only resolves the tools of its own environment.

Rotate in one place

Rotate a secret and every tool that uses it picks up the new value on the next call. Rotate a URL and the old token stops resolving immediately. Remove a team member and their URLs stop with them.

URL leaked
Rotate the URL. Tools and secrets stay. Old URL dead in under a second.
Key leaked upstream
Rotate the secret. Every environment using it follows. No client changes.
Laptop lost
Nothing to do for the keys: they were never on it. Rotate the URLs it held.
04 — Access

Single sign-on

Google and GitHub sign-in for everyone; enforced SSO on Team. SAML and OIDC on Enterprise. Passwords are hashed with Argon2id; magic links expire in 15 minutes.

Roles

Owner, admin, member. Members use environments; admins change them; only owners touch billing and deletion.

Audit log

Who created, rotated or deleted what, and when. 90 days on Team, exportable on Enterprise.

Access review

One list of every member and every URL they hold, with last use. Revoke from the list.

05 — Compliance
GDPRData processing agreement on request. Data is hosted in the European Union. Sub-processors are listed in the docs.
Encryption in transitTLS 1.2 or higher on every hop, agent to gateway and gateway to tool. HSTS on all domains.
No training on your dataTool calls and results are never used to train anything. They pass through and are not retained beyond the call log fields.
Responsible disclosureReport to [email protected]. We acknowledge within two business days and publish fixes in the changelog.
Independent auditA SOC 2 programme is planned once the service leaves beta; this page will say so the day it starts, not before.

Keys in the vault. URLs in the agents.

Create your first environmentSelf-hosted and Enterprise