Greymatter.ioGreymatter.io
Start for Free
Greymatter.ioGreymatter.io Why Greymatter.io?
Pricing Start for Free
Platform • App, API & AI Gateway

One checkpoint for every app, API, and AI call.

Calls into your apps, APIs, and models pass through it, and so do calls out to AI providers and tools. You see them all.

ztfabric  1,284 svc · 46 ns
▲ 12 degraded    ● 3,418 healthy
Platform›greymatter-edge
AccessApp GuardListenersLogsMCP RouterPeersSecurity
⋮⋮⋮ ⌄
greymatter-edge(spiffe://greymatter.io/ztfabric.ztfabric.greymatter-edge ⧉ )
DEPLOYMENTztfabric · ztfabrichttp_auto · tcpPlatform ManagedPlatformTLSmTLSFIPSPost-quantum readySPIREMCP Router
38 of 40 MCP servers reachable. 2 had no calls in the last 5 minutes.greymatter-edge_mcp_router_agent · Listener :10936TECHNOLOGY PREVIEW
WHAT IS HAPPENING
All 24 pods are running and ready. No destination it calls is failing. 38 of 40 MCP servers reachable. 2 had no calls in the last 5 minutes. Every data plane is connected to the control plane.
24 pods · 24 ready36 listenershttp_auto · tcp0 destinations failing
Pods ready24 of 24
Data planesall healthy
Control plane3 of 3 connected
SPIRE certificate ⓘRotating automatically
File certificate ⓘNov 1, 2027 · 363 days
Failed connections ⓘnone
Requests ⓘ184,920 in 2m 30s
Sources failingnone
Destinations failingnone
App Guard ⓘ12,480 events · 24h
WAF ⓘ1,906 events · 24h
SPIRE24 of 24 connected · 0 silent
TRIAGE
Deployment · 24 pods · 24/24 ready · nothing to show
+23 more pods · Running
Show all 24 pods
Call record
Ran tool get_doc_metadata on docs · Nov 2, 7:59:37 PM
Back to MCP Router
WHAT HAPPENED
The router let this call through.
MCP SERVER ANSWEREDA result
TOOK5 ms
THE REQUEST
WHOdata · verified at an earlier hop, carried by Greymatter
WHEREgreymatter-edge · router listener :10936
WHENNov 2, 7:59:37 PM
ANSWER200 OK
PROTOCOLModern · MCP 2026-07-28
›   RAW
Console view · sample data. We masked names and identifiers.
The seam problem

Every vendor sells you a piece. Greymatter.io sells you the whole.

Three vendors. Three rulebooks. Three teams that do not talk. That is how an AI agent reaches something nobody approved, and nobody notices until the damage is done.

Route all traffic through one path your team owns, with no app rewrites.

IDPOLLOGENFORCINGGreymatterONE GATEAppFamiliar. Expected.APIConstant. Unquestioned.AI AgentActs alone. Spreads fast.✓ Identity verified✓ Policy enforced✓ Every request loggedGreymatterONE GATEIDPOLLOGENFORCINGAppFamiliar.Expected.APIConstant.Unquestioned.AI AgentActs alone.Spreads fast.✓ Identityverified✓ Policyenforced✓ Everyrequestlogged
Consolidated, by design.

One gateway to manage. One place to control what gets through.

Fewer systems to secure means fewer gaps an attacker can use.

01Access02Outbound03Limits

Only verified people, services, and agents get in.

✓No new passwords to manage or leak. People sign in through the identity provider you already run
✓Every request carries a real name. Your logs show who or what sent it, not a shared key
✓AI agents reach only the tools you approve (MCP Router, in preview). Tools outside their role never appear

Access decisions are made once, not over and over.

Your data leaves only by routes you approve.

✓Sensitive prompts go only to AI vendors you vetted, such as OpenAI, Anthropic, or Azure OpenAI
✓Your people stay anonymous to AI providers. Greymatter does not add their names to calls that go out to AI providers
✓Shadow connections stop hiding. Apps that reach unapproved AI services or software download sites show up in the Console

Move fast on new AI and APIs without losing sight of where your information goes.

Your systems stay up. Your budget stays intact.

✓APIs survive traffic spikes. Set request caps per tenant, per person, or per path, shared across every copy of a service
✓No surprise AI usage. People work within a daily AI allowance, which can cover every model you offer
✓Hitting a ceiling crashes nothing. Apps and AI tools get a standard “slow down” reply they already know how to handle

One noisy tenant or runaway agent cannot take everyone down.

Platform services
17 services
Console
greymatter-dashboard
3/3
Documentation
greymatter-docs
3/3
Greymatter API
greymatter-api
3/3
DATA AND MESSAGING
Datastore
greymatter-datastore
3/3
Flow ledger
greymatter-flow-ledger
3/3
NATS
greymatter-nats
5/5
IDENTITY
SPIRE
spire-edge
3/3
OPERATORS
Platform operator
TSO
greymatter-tso
3/3
TELEMETRY
Audit agent
3/3
Forensic audits
greymatter-forensic-audits
3/3
TRAFFIC CONTROL
FTRM
3/3
Control
greymatter-control
5/5
Edge
greymatter-edge
3/3
MCP ROUTER
Rate limit service
greymatter-ratelimit
3/3
SERVES
Platform services / Traffic control
EdgeAvailable
greymatter-edge · greymatter-proxy:main
The edge service. It ends TLS, runs the firewall, and routes traffic to h●●●●, the dashboard, the docs, and the control plane.
Kind  DeploymentNamespace  z●●●●●●●Group  Traffic controlRole  MCP routerManaged by  Platform ManagedListeners  7
Transport securityTLS 1.3mTLSFIPSPost-quantum ready
Last read 11/3/2026 9:27 AMOpen service page ↗
Working. Nothing is named against this service.
Pods ready
6 of 6
Checks passing
5 of 5
Failing or degraded
0
Restarts
1
Sources calling
214
Last at 09:26:36
Uptime
Not reported by the API
Mesh connection
From the service page
Data planes
All healthy
Control plane
3 of 3 connected
SPIRE
6 of 6 connected · 0 silent
Failed connections
None
Requests
48,210 in 2m 30s
Traffic
Open the Peers tab
Direction
Peer
Port
Security
Traffic
State
In
ip:10.•••.•.•
:10●●●
TLS · TLS 1.3 · PQ
1,284,507 requests
a few seconds ago
Served
Out
greymatter-api
:10●●●
mTLS · TLS 1.3 · PQ
982,341 requests
an hour ago
Served
Out
greymatter-dashboard
:10●●●
mTLS · TLS 1.3 · PQ
418,906 requests
an hour ago
Served
In
greymatter-ask
:10●●●
mTLS · TLS 1.3 · PQ
96,214 requests
an hour ago
Served
Out
greymatter-docs
:10●●●
mTLS · TLS 1.3 · PQ
27,483 requests
38 minutes ago
Served
open-webuiDEPLOYMENTRunning2/2 readyCalls6 workloadsStrict MeshAutons: openwebuiIN THE MESHOUTSIDE HOSTS · BY NAMEmTLS · TLS 1.3 · PQ· to :8080Open WebUI Grok egressDEPLOYMENTRunning1 pod · 1/1 readymTLS· to :8080Open WebUI MCP RouterDEPLOYMENTRunning1 pod · 1/1 readymTLS · TLS 1.3 · PQ· to :5432postgresSTATEFULSETRunning1 pod · 2/2 readyTLS· to :443huggingface.coTLS· to :443cas-server.xethub.hf.coTLS· to :443us.aws.cdn.hf.coAI traffic leaves by one route:Open WebUI Grok egress →api.x.ai·mTLS · TLS 1.3 · PQ· to :443
open-webuiDEPLOYMENTRunning2/2 readyCalls6 workloadsStrict MeshAutons: openwebuiIN THE MESHOUTSIDE HOSTS · BY NAMEmTLS · TLS 1.3 · PQ· to :8080Open WebUI Grok egressDEPLOYMENTRunning1 pod · 1/1 readymTLS· to :8080Open WebUI MCP RouterDEPLOYMENTRunning1 pod · 1/1 readymTLS · TLS 1.3 · PQ· to :5432postgresSTATEFULSETRunning1 pod · 2/2 readyTLS· to :443huggingface.coTLS· to :443cas-server.xethub.hf.coTLS· to :443us.aws.cdn.hf.coAI traffic leaves by one route:Open WebUI Grok egress →api.x.ai·mTLS · TLS 1.3 · PQ· to :443
Platform services / Traffic controlRate limit serviceAvailableOne rate limit service for the whole platform. Every proxy asks itwhether a request is within its limit or budget.Transport securityTLS 1.3mTLSFIPSPost-quantumWorking. Nothing is named against this service.Pods ready2of 2Sources calling6Limits enforced4Over limit today3requests refusedBudgets and limits by namespaceOpen the Rate limits tabNAMESPACEBUDGETLIMITUSED TODAYclaimsclaims-assistant50,000 tokens per person per day14 people · 62% usedsupportsupport-ai20,000 tokens per person per day9 people · 48% usedpaymentspayments-apiperson=* · 600 requests per minutepeak 31% this windowpartnerspartner-apitenant=* · 1,200 requests per minutepeak 97% this window
Platform services / Traffic controlRate limit serviceAvailableOne rate limit service for the whole platform. Every proxy asks itwhether a request is within its limit or budget.Transport securityTLS 1.3mTLSFIPSPost-quantumWorking. Nothing is named against this service.Pods ready2of 2Sources calling6Limits enforced4Over limit today3requests refusedBudgets and limits by namespaceOpen the Rate limits tabNAMESPACEBUDGETLIMITUSED TODAYclaimsclaims-assistant50,000 tokens per person per day14 people · 62% usedsupportsupport-ai20,000 tokens per person per day9 people · 48% usedpaymentspayments-apiperson=* · 600 requests per minutepeak 31% this windowpartnerspartner-apitenant=* · 1,200 requests per minutepeak 97% this window
Platform services
17 services
Console
greymatter-dashboard
3/3
Documentation
greymatter-docs
3/3
Greymatter API
greymatter-api
3/3
DATA AND MESSAGING
Datastore
greymatter-datastore
3/3
Flow ledger
greymatter-flow-ledger
3/3
NATS
greymatter-nats
5/5
IDENTITY
SPIRE
spire-edge
3/3
OPERATORS
Platform operator
TSO
greymatter-tso
3/3
TELEMETRY
Audit agent
3/3
Forensic audits
greymatter-forensic-audits
3/3
TRAFFIC CONTROL
FTRM
3/3
Control
greymatter-control
5/5
Edge
greymatter-edge
3/3
MCP ROUTER
Rate limit service
greymatter-ratelimit
3/3
SERVES
Platform services / Traffic control
EdgeAvailable
greymatter-edge · greymatter-proxy:main
The edge service. It ends TLS, runs the firewall, and routes traffic to hippo, the dashboard, the docs, and the control plane.
Kind  DeploymentNamespace  ztfabricGroup  Traffic controlRole  MCP routerManaged by  Platform ManagedListeners  7
Transport securityTLS 1.3mTLSFIPSPost-quantum ready
Last read 11/3/2026 9:27 AMOpen service page ↗
Working. Nothing is named against this service.
Pods ready
6 of 6
Checks passing
5 of 5
Failing or degraded
0
Restarts
1
Sources calling
214
Last at 09:26:36
Uptime
Not reported by the API
Mesh connection
From the service page
Data planes
All healthy
Control plane
3 of 3 connected
SPIRE
6 of 6 connected · 0 silent
Failed connections
None
Requests
48,210 in 2m 30s
Traffic
Open the Peers tab
Direction
Peer
Port
Security
Traffic
State
In
ip:10.•••.•.•
:10908
TLS · TLS 1.3 · PQ
1,284,507 requests
a few seconds ago
Served
Out
greymatter-api
:10908
mTLS · TLS 1.3 · PQ
982,341 requests
an hour ago
Served
Out
greymatter-dashboard
:10908
mTLS · TLS 1.3 · PQ
418,906 requests
an hour ago
Served
In
greymatter-ask
:10936
mTLS · TLS 1.3 · PQ
96,214 requests
an hour ago
Served
Out
greymatter-docs
:10908
mTLS · TLS 1.3 · PQ
27,483 requests
38 minutes ago
Served

Only verified people, services, and agents get in.

✓No new passwords to manage or leak. People sign in through the identity provider you already run
✓Every request carries a real name. Your logs show who or what sent it, not a shared key
✓AI agents reach only the tools you approve (MCP Router, in preview). Tools outside their role never appear

Access decisions are made once, not over and over.

ztfabric1,284 svc · 46 nsSearch 9,842 objects across 8 types⌘K× 7 failing▲ 12 degraded● 3,418 healthy
The Grid›openwebui
Pod cardsNetwork graph
read 02:20:21 PM EST · every 15s
PortAll ports ⌄
flow-ledger · 18,442 raw rows · 11 shown · updated a few seconds ago
5 peers at Listener :10908 are drawn at their application port
Tier 0 · 1 workload
Tier 1 · 1 workload
Tier 2 · 6 workloads
Open WebUIⓘDEPLOYMENT
Running6 pods · 6/6 ready
2 services 2 fronted
Human CuratedCR▦ ⋮⋮
open-webuiⓘREPLICASET
Running4 pods · 8/8 ready
1 service 1 direct · 0 wider
Strict MeshAutoCalls 7 workloads
mTLS · to :8080
mTLS · to :8080
mTLS · to :8080
TLS · to :443
mTLS · TLS 1.3 · PQ · to :5432
TLS · to :443
TLS · to :443
mTLS · to :3001
Open WebUI Grok egress …ⓘREPLICASET
Running6 pods · 6/6 ready
2 services 1 direct · 1 wider
Open WebUI toolsⓘREPLICASET
Running2 pods · 2/2 ready
Open WebUI MCP RouterⓘREPLICASET
Running6 pods · 6/6 ready
3 services 2 direct · 1 wider
postgresⓘSTATEFULSET
Running4 pods · 8/8 ready
2 services 1 direct · 1 wider
cas-server.xethub.hf.co
huggingface.co
us.aws.cdn.hf.co

Your data leaves only by routes you approve.

✓Sensitive prompts go only to AI vendors you vetted, such as OpenAI, Anthropic, or Azure OpenAI
✓Your people stay anonymous to AI providers. Greymatter does not add their names to calls that go out to AI providers
✓Shadow connections stop hiding. Apps that reach unapproved AI services or software download sites show up in the Console

Move fast on new AI and APIs without losing sight of where your information goes.

ztfabric1,284 svc · 46 nsSearch 9,842 objects across 8 types⌘K× 7 failing▲ 12 degraded● 3,418 healthy
The Grid›jupyterhub›jupyterhub-edge-version-main
AccessApp GuardBlast RadiusListenersLogsPeersSecurity
⋮⋮⋮ ⌄
Jupyterhub Edge(spiffe://greymatter.io/ztfabric.ztfabric.jupyterhub-edge ⧉ )
DEPLOYMENTztfabric · jupyterhubHuman CuratedCRTLSmTLSFIPSPost-quantum readySPIRE
SOURCES FAILING
0
DESTINATIONS FAILING
0
ALLOWED · LAST FAILED
0
Allowed now. Last failed earlier
CALLS
INBOUND
ip:10.•••.•.• →TLS · TLS 1.3412,906 requests · live
OUTBOUND
jupyterhub-proxy ←mTLS · TLS 1.3 · PQ398,214 requests · live
keycloak-edge ←TLS · TLS 1.3 · PQ21,733 requests · live
flow-ledger · 36,118 raw rows · 3 shown · updated a few seconds ago
ⓘ How to read
WHAT IS HAPPENING
All 6 pods are running and ready. No destination it calls is failing. Every data plane is connected to the control plane.
6 pods · 6 ready0 destinations failing
Pods ready6 of 6
Data planesall healthy
Control plane3 of 3 connected
SPIRE certificate ⓘRotating automatically
File certificate ⓘNov 2, 2027 · 364 days
Failed connections ⓘnone
Requests ⓘ31,842 in 2m 30s · 0 server errors (0%)
Sources failingnone

Your systems stay up. Your budget stays intact.

✓APIs survive traffic spikes. Set request caps per tenant, per person, or per path, shared across every copy of a service
✓No surprise AI usage. People work within a daily AI allowance, which can cover every model you offer
✓Hitting a ceiling crashes nothing. Apps and AI tools get a standard “slow down” reply they already know how to handle

One noisy tenant or runaway agent cannot take everyone down.

1 / 3 · Swipe for more
Every day fragmented is a day exposed.

Stop buying three checkpoints. Start running one.

One set of rules for apps, APIs, and AI.

Start for Free Meet Our Security Experts Browse How to Buy →
Download the AI Gateway white paper
Go deeper

Additional resources

Use case API Security Learn More → Platform AI Guardrails & DLP Learn More → Blog Simplified Application Networking Read the Blog →
Swipe for more
Straight answers

Frequently asked questions

The Greymatter App, API & AI Gateway is one controlled path for app, API, and AI agent traffic. It is part of the platform, not a separate AI gateway. As a result, you get one set of rules and one record of who reached what. Greymatter does not add the person's name to calls bound for AI providers.

No. Greymatter works alongside the gateway tools you already run. Your apps also keep their standard AI client and point it at the approved path.

Greymatter has AI agents sign in with the login you already use. MCP is how AI agents use tools on their own. Left unmanaged, one agent can reach tools nobody approved. With the MCP Router, a Technology Preview in 2.5.0, tools outside an agent's role never appear to it. Tool servers also never receive the user's login. AI Guardrails then inspects MCP traffic, including event streams.

Yes. Greymatter AI Guardrails inspects prompts and responses for threats on the same traffic. The gateway itself controls who can connect. Both come with the platform, with nothing extra to buy.

Yes. In Greymatter, your team sets a daily AI token budget for a person or a group. One budget can also cover all the models you offer. Once a person goes over budget, the call never leaves. The person gets a standard quota error instead.