Protect the model call and the actions that follow

An agent can move from a model request to a tool call, a direct API request, and a production query. Formal applies policies to supported traffic across that workflow.

Keep upstream secrets out of the agent

Formal can inject configured database credentials, provider keys, API tokens, and remote MCP OAuth credentials at the proxy.

Limit what the agent can read and change

Policies can block destructive database operations, mask sensitive results, and restrict supported remote tool and API actions, using the agent identity and request context.

Trace actions back to an identity

Formal records supported queries, commands, tool calls, and model activity. Agent identities and human attribution help security teams investigate what happened.

Secure the full agent workflow

LiteLLM routes model, MCP, and A2A traffic through an application gateway. Formal applies network-level policies to supported model, tool, API, database, SSH, and Kubernetes traffic from agents.

The comparison covers how an agent receives identity, obtains temporary access, uses credentials, calls models and tools, and reaches production systems. It also distinguishes protocol-level controls from the gateway, network, or runtime integrations LiteLLM provides.

Limit what the agent can retrieve and send

A coding agent might read a production table, call a remote tool, and send the result to a model provider. A useful policy needs to account for the data returned as well as the action requested.

Formal can allow a supported read operation, mask sensitive fields in the result, block a destructive statement, and apply separate policies to the next supported model or remote tool request. Each connection must pass through the relevant Formal proxy for those policies to apply.

Why teams move from LiteLLM to Formal

  1. Scope access to the agent task. Give an agent identity-based, time-bound access and apply protocol policies to the requests it makes within that access.
  2. Reduce sensitive data in model context. Mask supported database results and model or tool content before protected information moves to the next service.
  3. Cover direct connections as well as tools. Agents also use database clients, HTTP SDKs, and subprocesses. Endpoint can inspect supported network traffic selected by routing rules outside a single MCP client.