PROBLEM 01INTEGRATION SPRAWL
Three integrations, one job
Want your enterprise knowledge in Claude AND ChatGPT AND your IDE? Three custom integrations. Three rate limit configs. Three audit trails. Three places to update when the schema changes.
Ready to get started?
Deploy sovereign AI on your infrastructure - in weeks, not months.
Developers · MCP · 8 tools · 240+ inbound servers
Katonic speaks Model Context Protocol both ways. Eight tools out to Claude Desktop, ChatGPT, and Cursor. The same gateway calls 240+ external servers.
Whichever way the call flows, governance fires. The protocol changes - the controls don't.
8 Katonic tools exposed 240+ external servers reachable stdio · SSE · HTTP transports Same governance both ways
OpenAI function calling. Claude tools. Gemini extensions. Every model provider invents their own tool format. Each one wants you to wrap your enterprise data behind a different glue layer. Same business logic, three integrations. No shared audit. No shared governance. Three places to break when you need to revoke access.
Want your enterprise knowledge in Claude AND ChatGPT AND your IDE? Three custom integrations. Three rate limit configs. Three audit trails. Three places to update when the schema changes.
Most ad-hoc tool integrations skip permissions, skip audit, skip safety checks. The chatbot can answer questions because the tool ran with elevated privileges. The compliance review never sees the tool calls.
Pulling MCP tools from the public internet means fetching code from somewhere unknown. No allow-list. No version pinning. No security scan. Your agents end up calling untrusted servers with your data.
External AI systems use Katonic as a tool source - chat with our agents, search our knowledge, generate documents. Our agents use external systems as tool sources - hit Salesforce, file a Jira, post to Slack. Both directions speak the same protocol. Both directions hit the same governance.
Katonic publishes 8 MCP tools that any compliant client can call. Claude Desktop, ChatGPT with custom GPTs, Cursor, your team's internal agent platform - they all see the same Katonic capabilities. Configure once in Katonic, every client gets the update.
WHAT EXTERNAL CLIENTS CAN DO
Connect Katonic to 240+ MCP tool servers covering Salesforce, Jira, GitHub, Slack, Snowflake, and more. Your agents browse a curated catalogue, request approval where needed, and call tools through a governance proxy that enforces policy and audits every call.
WHAT YOUR AGENTS CAN DO
Both directions go through the governance proxy: identity check, policy match, PII scan, approval routing, audit log. Doesn't matter if Claude Desktop is asking your agent for HR data or your agent is asking Salesforce for an account record. The controls fire either way.
Eight tools cover what external agents actually need: talk to a Katonic agent, search knowledge, create documents, analyse data, discover what's available, evaluate quality, and call governed tools. Pure protocol translation. No new business logic behind them.
Manage the 8 tools Katonic exposes at /developer/mcp. Browse the 240 external MCP servers Katonic can consume at /marketplace/mcp-servers. Test any tool live before exposing it.
MCP Server
Katonic as an MCP server. 8 tools exposed to any external AI agent (Claude Desktop, Copilot Studio, OpenAI Assistants).
https://app.your-org.katonic.ai/mcp/sse?token=kapi_live_b71d...Auth via API key. Same key used for the Public API. Same scopes apply. Works with any MCP-compatible client.
Tool calls today
55,311
across 8 tools
Connected clients
23
Claude Desktop · 18
Governance pass
100%
all calls audited
P95 latency
184ms
tool execution + governance
Exposed tools · 8
katonic_chat● GOVERNEDChat with a published agent
katonic_knowledge_search● GOVERNEDPermission-aware knowledge search
katonic_create_documentGenerate document from natural language
katonic_analyze_data● GOVERNEDQuery data, generate charts, run SQL
katonic_list_agentsList published agents with descriptions
katonic_run_evaluationTrigger an agent evaluation run
katonic_search_toolsDiscover available tools on the platform
katonic_execute_tool● GOVERNEDExecute a governed tool
/developer/mcp and /marketplace/mcp-servers in your sandbox today. The 8 exposed tools, the 240+ catalog, the live test bench - same chrome, real data.An employee using Claude Desktop asks a question that needs enterprise context. Claude reaches for the Katonic MCP tool, the tool runs as that employee, the knowledge engine filters by their source permissions, the answer comes back with citations, and your audit log records the call - just like it does when the same employee uses Workroom in the browser.
Q3 added two changes to the remote work policy in HR-2024-08 amendment:
[1] HR-2024-08 amendment · p.1 · [2] HR FAQ · International Remote · Confluence
STEP 01 · IDENTITY
caller: Claude Desktop (mcp_key_8a3...)
acting as: sarah@your-org
permissions: HR group, Legal group
STEP 02 · TOOL DISPATCH
tool: katonic_knowledge_search
policy match: rbac.search_internal
verdict: ✓ ALLOW
STEP 03 · KNOWLEDGE ENGINE
hybrid search · 3 docs returned
filter: sarah's source permissions applied
top result: HR-2024-08 (0.94)
STEP 04 · GUARDRAILS
output check: 8/8 rails pass
PII: scrubbed · safety: clean · grounding: ✓
STEP 05 · AUDIT WRITTEN
trace_id: 7c3f9a2b...
Same audit table the UI writes to.
Source: mcp/claude-desktop
The auditor asks: "How do we know employees aren't using Claude Desktop to bypass our HR data controls?" Answer: every tool call records the source (mcp/claude-desktop), the acting user identity, the policy that matched, the result document IDs, and the trace ID. Filterable in the same audit log as everything else.
An external AI client connects to mcp.your-org.katonic.ai with a key. The protocol negotiation reveals the 8 tools available. The AI picks the right tool based on the user's request. The call goes through governance, gets an audit trace, and the result comes back. Five steps, all standard MCP.
The five steps · annotated
The MCP server isn't a separate path with separate controls. It's a protocol translation layer in front of the same governance proxy. Anything you can do in the UI, with the controls that govern it, you can also do via MCP - with the same controls, in the same audit, against the same approvals queue.
The MCP key is bound to a user. Every tool call runs as that user. Permissions on knowledge sources are enforced per-call.
The same policy engine that gates UI tool calls also gates MCP tool calls. Same six actions × five risk levels.
Eight rail types check responses before they leave Katonic. Whether the response goes to the Workroom or to Claude Desktop, the rails fire.
Every MCP call gets a trace_id that links to the same audit table as the UI. Filter by source to see all MCP traffic separately if needed.
MCP keys carry their own rate limits. Claude Desktop usage doesn't compete with the chat widget's quota.
High-risk tool calls (writes, deletes, sends) route through the same approval queue regardless of caller. Manager approves once.
How do we let internal users use Claude Desktop without leaking data?
Connect Claude Desktop to the Katonic MCP server. Each user gets their own scoped key. Knowledge searches run with their permissions. Data they're not authorized to see never reaches Claude. Audit logs every tool call by user.
Can I expose my custom tool through this?
Yes. Register your tool in the platform - URL, schema, auth. It joins the catalogue of 240+ external tools your agents can call, and it shows up under katonic_search_tools so external AI clients can discover it too. Same governance applies.
What stops Claude Desktop from calling random tool servers?
An allow-list. Your team approves which external MCP servers your agents can reach. Unknown servers are blocked at the gateway. Outbound calls are logged with the same trace IDs as inbound, so you can correlate.
Same audit log as the UI?
Same audit table, same schema, same retention. Each row records the source - whether the call came from Workroom, Claude Desktop, ChatGPT, or your CI pipeline. Filter the audit log by source to slice MCP traffic specifically.
N integrations. N audit logs. Forever.
Build a custom Claude tool, a custom GPT, a Cursor extension. Each one has its own auth, its own rate limits, its own glue layer. Same business logic, three implementations. Update breaks two of them.
Free tools. Unknown supply chain.
Pull MCP servers from the public ecosystem. Most don't respect enterprise permissions. None integrate with your audit. No version pinning, no allow-list, no security scan. Your data flows through whoever wrote them.
Same protocol. Same governance. Day one.
8 tools expose every Katonic capability. 240+ vetted external tool servers reachable from your agents. Bidirectional, governed, audited. Same proxy, same trace IDs, same audit log as the UI.
Three years from now, every AI client will speak Model Context Protocol. The companies that built around proprietary tool formats will be the ones doing rewrites. We bet early on MCP because the alternative was custom plumbing per client, custom audit per integration, and custom governance for each one. The protocol is the bet. Governance is the moat.
Sandbox access in 24 hours. Comes with an MCP key, copy-paste config for Claude Desktop, and a sample agent that exercises three of the eight tools so you can see the audit log update in real time.
Same controls. Different protocol. Both governed.