# Durin

> Durin provides MCP Governance so enterprises can hand off work to AI agents in peace. Agents do not have to stay read-only: administrators decide in one place which changes agents can make and which need review. Durin keeps identity, policy, approvals, execution, and audit on one governed path.

## When To Use This

- Use Durin when an enterprise team needs governed MCP or agent access through identity, policy, approvals, and audit.
- Use Durin to evaluate whether an agent request should be allowed, denied, or sent for exact independent approval.
- Use Durin to inspect MCP Governance boundaries, trust evidence, and deployment prerequisites before rollout.
- Use the free AI & MCP Risk Audit when a team wants a plain-English risk grade for its AI agent and MCP setup before rollout. It is a risk signal, not a formal audit, certification or legal advice.
- Do not use Durin as an AI model host, a universal network observer, or proof that unmanaged direct API calls are covered.

## How Agents Should Call Durin

- Follow the MCP client setup guide for guided CLI setup or a remote HTTP connection. For governed provider tools, copy the exact personal or single-connection URL issued by Durin; do not guess one.
- Authenticate each exact remote endpoint separately. Browser sign-in alone does not authenticate an MCP client, and tokens for different endpoints are not interchangeable.
- Start with a reviewed read on an allowed resource. Inspect its authorization decision and execution outcome separately in request activity before testing changes.
- An approval-required action has not run. A different eligible reviewer must decide it, then the requester retries the identical call before expiry. Approval workflows can route review to named people, teams or roles.
- Reuse idempotency keys only for the same operation, arguments, approval, and policy version.
- Check an uncertain dispatched write in the provider before attempting another write.

## Agent Onboarding

- Free tier: the first Durin connection is free, with access policies, approvals and audit included.
- Self-serve signup: create an account at https://app.getdurin.com/signup, or run npx @accessdurin/cli and choose Create an account. No sales contact is needed.
- Credentials: agents need no API key. MCP clients find the authorization server through the protected resource metadata, register themselves with dynamic client registration or a Client ID Metadata Document, and sign in with OAuth and PKCE.
- Sandbox: call durin_simulate_request on https://getdurin.com/mcp, or open https://getdurin.com/get-started, to see allowed, approval-required and denied requests without an account. After signup, request the Durin sandbox connection from Connections; once an administrator approves it, try approvals before connecting company systems.

## Developer Resources

- [Durin public MCP server](https://getdurin.com/mcp): Streamable HTTP with no sign-in. Read-only tools search these docs (durin_search_docs), return any page as Markdown (durin_get_page) and run a governed request in a synthetic sandbox (durin_simulate_request).
- [Durin workspace MCP server](https://app.getdurin.com/mcp): Streamable HTTP for workspace and administration tools. Sign in with OAuth; the tools you see follow your role and consent scopes.
- [Durin CLI on npm](https://www.npmjs.com/package/@accessdurin/cli): The official durin command. Run npx @accessdurin/cli to sign up or log in, onboard an organization and connect Claude Code, Codex, Cursor, Windsurf or OpenCode; durin tools call runs governed tools from scripts.
- [Durin CLI repository](https://github.com/accessdurin/cli): Public repository for the @accessdurin/cli package.

## Reading This Site

- Request public page URLs with the Accept: text/markdown header for their Markdown representation.
- Use the knowledge base for setup and operating instructions, and the provider guides for each connection's authorization requirements.
- Use pricing and trust pages for current commercial terms and governance boundaries. Provider authorization and contractual commitments depend on the account and agreement.

## Primary Resources

- [Home](https://getdurin.com/): Durin governs AI agent access through MCP, with policies, human approvals, and audit records for requests routed through its gateway.
- [Get started](https://getdurin.com/get-started): See what an agent is allowed to do. Run an MCP request through Durin’s policy checks without an account or API key.
- [MCP Governance](https://getdurin.com/mcp): Connect your agents to company tools through Durin, with your rules checked before a request runs.
- [Integrations](https://getdurin.com/integrations): Connect approved MCP clients and upstream systems through Durin’s identity, consent, policy, and production trust boundary.
- [Pricing](https://getdurin.com/pricing): First connection free. Your first four paid connections are $399 each per month. Each additional paid connection is $199 per month. Access policies, approvals, and audit are included with every plan, including the free connection. Contact sales for Enterprise tenant isolation, SSO, SCIM directory sync, uptime, and support commitments.
- [Docs](https://getdurin.com/docs): Guides and reference for MCP Governance with Durin — connections, billing, user management, policies, recipes, and troubleshooting.
- [Developers](https://getdurin.com/developers): Connect Claude Code, Codex, Cursor, your own MCP server, or a custom harness to the Durin gateway with a personal MCP endpoint.

## Getting started

Set up your account, add your first connection, and run your first governed request.

- [What is Durin?](https://getdurin.com/docs/what-is-durin): Understand where Durin sits between an AI client and your company tools.
- [Create your workspace](https://getdurin.com/docs/quickstart): Create an account and finish organization onboarding.
- [MCP basics](https://getdurin.com/docs/general-faq): Learn what an MCP client, server, and gateway do.
- [Install and set up Durin Endpoint Client](https://getdurin.com/docs/endpoint-client): Install on macOS, Windows or Linux, verify your download, connect your organization and manage application updates.

## Connections & MCP

Add providers, configure MCP clients, and manage upstream connections.

- [Understanding connections](https://getdurin.com/docs/connections-overview): Learn the difference between an installation and personal access.
- [Add a provider connection](https://getdurin.com/docs/add-connection): Install and enable one provider from the connection directory.
- [MCP provider setup guides](https://getdurin.com/docs/mcp-provider-guides): Choose a provider how-to, prepare its account requirements, and add its Durin connection URL to your agent.
- [How to add GitHub MCP](https://getdurin.com/docs/add-github-mcp): Connect GitHub through Durin and verify an allowed read and a denied request before rollout.
- [How to add Slack MCP](https://getdurin.com/docs/add-slack-mcp): Connect Slack through Durin and verify an allowed read and a denied request before rollout.
- [How to add Notion MCP](https://getdurin.com/docs/add-notion-mcp): Prepare Notion access, add the connection in Durin, and connect an agent with your personal connection URL.
- [How to add Atlassian (Jira) MCP](https://getdurin.com/docs/add-atlassian-rovo-mcp): Prepare an Atlassian (Jira) connection and understand the setup requirements before adding its Durin URL to an agent.
- [How to add Gmail MCP](https://getdurin.com/docs/add-gmail-mcp): Prepare Gmail access, add the connection in Durin, and connect an agent with your personal connection URL.
- [How to add Google Drive MCP](https://getdurin.com/docs/add-google-drive-mcp): Prepare Google Drive access, add the connection in Durin, and connect an agent with your personal connection URL.
- [How to add Google Docs MCP](https://getdurin.com/docs/add-google-docs-mcp): Prepare Google Docs access, add the connection in Durin, and connect an agent with your personal connection URL.
- [How to add Google Calendar MCP](https://getdurin.com/docs/add-google-calendar-mcp): Prepare Google Calendar access, add the connection in Durin, and connect an agent with your personal connection URL.
- [How to add Linear MCP](https://getdurin.com/docs/add-linear-mcp): Connect Linear through its named card in Durin and verify an allowed read and a denied write before rollout.
- [How to add Sentry MCP](https://getdurin.com/docs/add-sentry-mcp): Connect Sentry through its named card in Durin and verify an allowed read and a denied write before rollout.
- [How to add PostHog MCP](https://getdurin.com/docs/add-posthog-mcp): Connect PostHog through Durin and verify an allowed read and a denied request before rollout.
- [Add a custom MCP server](https://getdurin.com/docs/custom-mcp-server): Connect a remote server using its public HTTPS MCP endpoint.
- [MCP client setup](https://getdurin.com/docs/mcp-client-setup): Connect your AI client to your personal Durin endpoint.
- [Connect a client to one connection](https://getdurin.com/docs/connection-endpoint): Limit a client’s discovery and calls to one saved MCP connection.
- [Enable or disable a connection](https://getdurin.com/docs/manage-connections): Pause or restore routing for an entire installation.
- [Manage connection credentials](https://getdurin.com/docs/connection-credentials): Update personal provider consent or an organization-owned API token.
- [Restore provider access](https://getdurin.com/docs/connection-issues): Diagnose a provider error after your client has connected to Durin.

## Billing

Understand connection-based pricing, manage payments, and track usage.

- [How connection pricing works](https://getdurin.com/docs/billing-overview): Understand connection pricing and Enterprise identity features.
- [Enable Enterprise SSO and Directory Sync](https://getdurin.com/docs/enterprise-identity): Check your organization’s package, configure identity, and plan package changes.
- [Manage payment details](https://getdurin.com/docs/manage-billing): Set up billing or update your organization’s payment method.
- [Understand your invoice](https://getdurin.com/docs/billing-faq): Reconcile connection quantity, tier pricing, and changes during the month.
- [Understand transfer usage](https://getdurin.com/docs/transfer-usage): Check your organization’s pooled transfer allowance.

## User management

Invite members, organize teams, and control access across your organization.

- [Invite a member](https://getdurin.com/docs/invite-members): Invite a person and link their verified account to your organization.
- [Verify a domain](https://getdurin.com/docs/verify-domain): Add the DNS TXT record for a connected domain and check ownership.
- [Revoke a member’s access](https://getdurin.com/docs/revoke-member): Remove organization access from a linked account.
- [Manage team membership](https://getdurin.com/docs/teams): Maintain members and inspect inherited restrictions and team-specific rules.
- [Manage client sessions](https://getdurin.com/docs/sessions-and-clients): Inspect or revoke an MCP client’s authorization.

## Policies & approvals

Define rules, set approval gates, and manage the governance boundary.

- [Understanding policy decisions](https://getdurin.com/docs/policies-overview): Read the allowed, denied, and approval-required results.
- [Enterprise MCP gateway evaluation kit](https://getdurin.com/docs/mcp-gateway-evaluation-kit): A vendor-neutral test plan for identity, tool changes, resource restrictions, independent approvals and uncertain writes. Record observations instead of trusting feature labels.
- [Change the access policy](https://getdurin.com/docs/create-policy): Set defaults or target specific requests, then review JSON and contradictions.
- [Draft custom rules with AI](https://getdurin.com/docs/draft-policy-with-ai): Describe a restriction, then review its generated JSON and contradiction check.
- [Review an exact approval](https://getdurin.com/docs/approvals): Review pending actions, record a decision and check the requester’s retry.
- [Review requests in Slack](https://getdurin.com/docs/slack-approvals): Deliver reviews to a private channel or linked administrators and record decisions.
- [Manage approval memory](https://getdurin.com/docs/approval-memory): See which decisions were saved, when they were used and how to stop future use.
- [Durin Smart Evaluation](https://getdurin.com/docs/content-evaluation): Choose how tool requests and responses are checked, and understand write reversibility reports.
- [Investigate a denied request](https://getdurin.com/docs/policy-issues): Find the failed access check before changing a policy.

## Recipes

Step-by-step patterns for common setups and workflows.

- [Start with read-only access](https://getdurin.com/docs/recipe-readonly-first): Verify one reviewed read while keeping writes blocked.
- [Scope a connection to a team](https://getdurin.com/docs/recipe-team-scoped-access): Make one installation available only to its assigned teams.
- [Test a write approval](https://getdurin.com/docs/recipe-approval-gate): Exercise approval and exact retry with a supported sandbox write.
- [Use several providers in one client](https://getdurin.com/docs/recipe-multi-provider): Discover your available connections through one personal MCP endpoint.

## Security & activity

Understand credentials, read request outcomes, and investigate latency.

- [Review Shadow MCP discoveries](https://getdurin.com/docs/shadow-mcps): Find reported MCP access outside Durin and check device coverage before acting.
- [Sync governance evidence to Vanta](https://getdurin.com/docs/vanta-evidence): Connect your Vanta account and check the evidence collected and delivered.
- [Credential security](https://getdurin.com/docs/security-faq): Understand how Durin and provider credentials stay separate.
- [Read request activity](https://getdurin.com/docs/audit-issues): Find a request and distinguish its decision from its execution outcome.
- [Stream audit events to your SIEM](https://getdurin.com/docs/siem-streaming): Configure an HTTPS or Splunk HEC receiver and inspect delivery and recovery.
- [Investigate request latency](https://getdurin.com/docs/request-performance): Compare Durin timing with the upstream provider’s response time.

## More Public Resources

- [Downloads](https://getdurin.com/downloads): Install the Endpoint Client for your operating system and connect your device to Durin.
- [Book a demo](https://getdurin.com/try-durin): Tell us about your team and book a Durin demo to explore agent access, policies, approvals, and audit records.
- [Product Tour](https://getdurin.com/product): Draft policies with AI, bring people into the decisions that matter, and see what your agents are doing.
- [Solutions](https://getdurin.com/solutions): Use MCP Governance with Durin to give AI agents a managed path to company systems. Set permissions, approve sensitive actions, and review what happened.
- [Enterprise IT](https://getdurin.com/solutions/enterprise-it): Give enterprise users a clear path to approved AI agents and company systems, with one place to manage access, approvals, and rollout evidence.
- [Security](https://getdurin.com/solutions/security): Give security a connected view of agent requests, approvals, revocation, execution outcomes, and the boundary of gateway coverage.
- [Platform engineering](https://getdurin.com/solutions/platform-engineering): Give platform teams a repeatable way to configure connections, review policy changes, preserve tenant boundaries, and move governed access toward production trust.
- [Compliance](https://getdurin.com/solutions/compliance): Give reviewers a connected record of governed AI agent access, from the requesting identity and policy to approval, execution, and outcome.
- [ISO42001](https://getdurin.com/solutions/iso-42001): Work through the ISO/IEC42001 checklist, see what’s open before each audit stage, and let Durin record evidence for the AI agents using your company systems.
- [Singapore SAFR](https://getdurin.com/solutions/singapore-safr): Understand Singapore SAFR for AI agents: runtime identity, policies, approvals and decision records. Compare Durin’s controls with your institution’s responsibilities.
- [AI Governance Program](https://getdurin.com/ai-governance): Durin’s 90-day AI governance program maps your AI use, defines policies, and sets up MCP controls and evidence for agent requests routed through Durin.
- [Security](https://getdurin.com/security): Review Durin’s MCP security controls for AI agents: identity checks, access policies, independent approvals, and audit records for routed requests.
- [About](https://getdurin.com/about): Durin, also known as Durin Security, helps IT, security, and platform teams govern how AI agents use company systems. We bring access policies, human approvals, and audit records together for requests routed through our gateway.
- [Privacy](https://getdurin.com/privacy): How durin handles personal data across its website, application, support, and gateway: your rights, breach notification, and how long we keep each kind of data.
- [Partners](https://getdurin.com/resellers): Introduce your clients to governed AI access with Durin. Approved partners earn commission on eligible customer payments. Durin handles the subscription and billing; you deliver the advice, implementation or managed services.
- [Referrals](https://getdurin.com/referrals): Current Durin customers and their active users can share a personal referral link and earn commission when a referred organization pays Durin, under the program terms.
- [Design partners](https://getdurin.com/design-partners): Durin is live. Run MCP Governance in production for six months, unbilled, and shape what we build next.
- [Terms](https://getdurin.com/terms): Read the terms for using durin, including accounts, acceptable use, the warranty disclaimer, liability cap, indemnity, and Singapore governing law.
- [DPA](https://getdurin.com/privacy/dpa): Read and sign the durin data processing addendum: processing roles, security measures, subprocessors, international transfer safeguards under the PDPA and GDPR Chapter V, and breach notice.
- [Subprocessors](https://getdurin.com/privacy/subprocessors): See the subprocessors that process customer personal data for durin, what each one processes and where, and how changes are notified under the data processing addendum.
- [Deployment](https://getdurin.com/deployment): Start with one workflow. Connect your systems, decide what agents can change and prove the controls before expanding.
- [AI & MCP Risk Audit](https://getdurin.com/audit): See what your agents can access, which changes need oversight, and what to fix first.
- [How your data moves](https://getdurin.com/audit/data-flow): From your first answer to your downloaded report: what stays on your device, what is sent, and what Durin keeps.
- [Blog](https://getdurin.com/blog): Practical guides to MCP Governance, approvals, and AI agent governance for teams evaluating a governed agent path.

## Editorial Guides

- [MCP configuration is a permission now](https://getdurin.com/blog/mcp-configuration-is-a-permission): The Langflow vulnerabilities show why MCP connection settings need clear ownership, access checks and review, alongside controls on how agents use their tools.
- [Inside Durin: how a governed MCP request works](https://getdurin.com/blog/inside-durin): Follow one agent tool call through Durin, from the signed-in request and access checks to review, credential handling and the recorded outcome.
- [MCP gateway vs MCP security: what a gateway covers](https://getdurin.com/blog/mcp-gateway-vs-mcp-security): A gateway checks access and records the agent requests it receives. See which MCP security risks it handles and which still need other controls.
- [AI tool approval process: apps, connections and agent actions](https://getdurin.com/blog/ai-tool-approval-process): Set up an AI tool approval process that is quick for low-risk tools and careful about the company systems an agent can reach and the actions it can take.
- [MCP server governance: from intake to retirement](https://getdurin.com/blog/mcp-server-governance): Keep an MCP server inventory, approve servers before use, review each tool, treat changed definitions as new decisions and retire servers cleanly.
- [MCP access governance: who can use which tools and data](https://getdurin.com/blog/mcp-access-governance): Tie each MCP request to a person, grant access through teams, keep tools and data to what the work needs, and keep access current as people change roles.
- [MAS AI risk management guidelines: what they mean for AI agents](https://getdurin.com/blog/mas-ai-risk-management-guidelines-agents): What Singapore’s MAS AI guidelines mean for teams using agents: understanding their work, assessing risks and choosing where people need to review actions.
- [Your next shadow IT problem is an AI agent.](https://getdurin.com/blog/mcp-proxy-for-it-teams): A practical guide for IT teams evaluating MCP Governance and a managed route for AI agent access.
- [A trusted employee. An overprivileged agent.](https://getdurin.com/blog/mcp-security-for-cisos): A CISO guide to unmanaged agent access, MCP Governance boundaries, prompt injection, and production gates.
- [MCP Governance architecture for CTOs.](https://getdurin.com/blog/mcp-gateway-architecture-for-ctos): A CTO guide to MCP Governance architecture, trust boundaries, approval semantics, and production trust.
- [When AI can act, who is accountable?](https://getdurin.com/blog/ai-agent-governance-for-ceos): A CEO guide to governing AI agent access, reducing shadow connections, and setting responsible rollout gates.
- [What is an MCP gateway? How it works and when to use one](https://getdurin.com/blog/what-is-an-mcp-gateway): An MCP gateway connects AI clients to upstream tools through one access point. Learn how it works, how it differs from a server or proxy, and what to evaluate.
- [MCP Governance vs API gateway: which controls do you need?](https://getdurin.com/blog/mcp-gateway-vs-api-gateway): Compare MCP Governance with API gateway controls, check what your existing platform supports, and identify gaps in tool policy, approvals, and audit.
- [AI agent approval workflows: steps and examples](https://getdurin.com/blog/ai-agent-approval-workflow): Build an AI approval workflow in six steps: choose actions that need review, assign approvers, set expiry, approve the exact request and confirm the result.
- [MCP Governance: a practical guide to servers, access and approvals](https://getdurin.com/blog/mcp-governance-guide): MCP Governance in practice: decide which servers and tools to trust, who can use them and which actions need review, then test and keep evidence as you grow.
- [Centralize MCP access with Durin](https://getdurin.com/blog/centralized-mcp-access-with-durin): See how Durin connects AI clients to approved tools, checks access, handles write approvals, and records decisions through a governed MCP path.

## Machine-readable Resources

- [Sitemap](https://getdurin.com/sitemap.xml): Canonical public pages, including localized versions.
- [OpenAPI contract](https://getdurin.com/reference/openapi.json): The HTTP API schema in JSON.
- [Security review](https://getdurin.com/trust/review.md): A downloadable Markdown security review brief.
- [Durin MCP discovery](https://getdurin.com/.well-known/mcp): The public and workspace MCP servers, their transports and their authorization in JSON.
- [Durin OAuth protected resource metadata](https://app.getdurin.com/.well-known/oauth-protected-resource/mcp): RFC 9728 metadata naming the authorization server and scopes for the workspace MCP server.