Agents and engineers reach the same places: model providers, MCP servers, SaaS APIs and production data. We put a proxy on each path and manage both from one control plane, so every use case below maps to the product that sits where the traffic flows.

Which product powers each use case?

Endpoint is our egress proxy for AI agent security. It runs on macOS, Windows and Linux hosts, and as a native sidecar in Kubernetes pods. In Transparent Mode (macOS and Linux), it terminates TLS on the connections your network rules select, so it sees LLM calls, web requests and MCP traffic from the agents and engineers on that device.

That outbound path powers three use cases:

  • AI gateway (also called an LLM gateway): policies and logs on requests to LLM provider APIs.
  • Secure web gateway: process-aware rules for agent traffic, alongside the web gateway you already run.
  • Shadow AI: a review queue of MCP servers people use without a Formal resource, and of skills seen in Claude Code requests.

PAM runs the Connector, a reverse proxy deployed as a container in your VPC in front of databases, SSH hosts, Kubernetes and APIs. It identifies the user behind each connection and evaluates policies on requests and responses. That’s what data masking needs: the Connector masks sensitive columns in query results before they reach the client.

The MCP gateway uses both products. The Connector routes remote MCP servers from your Catalog, adds the upstream credential, enforces policies and logs every tool call. On devices, Endpoint adds the user’s Formal identity, so MCP clients keep the server’s original URL.

What do the use cases share?

Endpoint and the Connector report to one control plane: the same users and groups, policies written in Rego, and logs for every request they proxy. The control plane can’t read your data. Only Endpoint and the Connector see the traffic.

Who runs this in production?

Cursor replaced its homegrown access proxies with the Formal Connector and routes its Cloud Agents’ access to data through Formal.

“Without Formal, we couldn’t have agents with access to sensitive data. With Formal, because we are able to inspect all traffic and enforce controls, we are able to provide a safe environment for the agents to get the job done.”

— Travis McPeak, Head of Security @ Cursor

Read how Cursor gives engineers and AI agents secure access.