How xpander fits into your current AI stack
AI Gateway, MCP Gateway, Agent Runtime, and AI Workspace on one platform, sharing one identity, one set of rules, and one record of every action, inside your environment.
One identity
across everything
People sign in once through your identity provider over OIDC. Their identity follows every model call, tool call, and agent action.
Model calls
Through the AI Gateway, with the person behind every call.
Tool calls
Through the MCP Gateway, with each person’s own permissions where you choose.
Agent actions
In the Agent Runtime and AI Workspace, recorded under the same identity.
Sign in once with Okta, Entra ID, or a self-hosted Keycloak.
Governance
in one place
One set of rules for every model call, tool call, and agent action.
Roles
Roles and permissions for admins, builders, and users.
Policies
Policies per group, for example who can read or create secrets.
Budgets
Budgets per group, member, key, agent, task, and end user.
Approvals
Approvals for sensitive actions.
A record of every action
Downloadable as CSV or JSON.
Groups
Link xpander groups to your identity provider’s groups. Membership updates each time a person signs in.
Use ours, or keep yours
Keep your AI gateway, MCP servers, agents, and AI clients. xpander governs the calls that go through it, so you only add what’s missing.
Your AI gateway
Your MCP servers
Your agents
Claude and ChatGPT
Your identity provider
One identity across every tool
One policy set
Budgets
Approvals
One audit record
Export the audit log
Built into
your infrastructure
Because everything runs inside your environment, your prompts, data, and agent memory don’t depend on a cloud provider’s data agreement.
Kubernetes-native
Deploys into any Kubernetes 1.28 or later, such as EKS, in your cloud account, on-premises, or air-gapped.
Your data stores
The databases xpander needs run in your cluster, or point it at your own, such as Amazon RDS.
Your secrets
Read from your vault or secrets manager at the moment of use.
Your models
Private access to models in your cloud account, or to your own GPUs.
An example
One process,
end to end
How one automation moves from an engineer’s laptop to production, step by step.
1 · Build
An engineer builds the agent in Claude Code or Codex, the way they already work.
Get agents off laptops →
2 · Approve once
IT approves production access once in xpander, instead of per project.
AI agent governance →
3 · Run
The agent runs in the Agent Runtime, inside your environment.
Explore Agent Runtime →
4 · Record
Every model call, tool call, and approval is logged.
How we handle security →
One record of every action
Every model call, tool call, and approval is recorded with the person and agent behind it.
