Vertlock FAQ
Plain answers, honest scope.
What is Vertlock?
Vertlock is a governed MCP gateway for AI-agent tool access. It lets companies connect AI agents to real company tools without handing agents raw credentials. Vertlock routes tool calls through policy, approval gates, revocation, and audit receipts.
What is a governed MCP gateway?
A governed MCP gateway sits between AI agents and tools exposed through MCP (Model Context Protocol). Instead of agents calling every tool directly, the gateway checks who the user is, what the agent is allowed to do, whether approval is required, whether the action should be blocked, and what evidence should be recorded.
Why do AI agents need tool permissions?
AI agents can act across tools, APIs, files, issue trackers, CRMs, and internal systems. Without tool permissions, a useful agent can accidentally get too much authority. Vertlock gives teams a way to define allowed, approval-required, and blocked actions.
Does Vertlock keep credentials away from AI agents?
Yes. Vertlock is designed so company credentials are brokered by Vertlock instead of being placed directly inside an agent prompt, config, or runtime. The agent calls through the governed MCP path; Vertlock holds and applies the credential where policy allows.
Does Vertlock sandbox agents?
No. Vertlock governs tool calls routed through Vertlock. It does not sandbox the agent, inspect all network traffic, stop direct API access outside Vertlock, or guarantee that authorized data cannot be misused after it is returned to the agent.
What actions can Vertlock approve or block?
Vertlock can allow low-risk tool calls, require human approval for high-impact actions, or block actions by policy. A typical proof path might allow a safe GitHub read, block a dangerous delete action, and require approval for an action that changes state.
What are audit receipts?
Audit receipts are records of governed tool calls. They help teams inspect what an agent attempted, what policy decision was made, whether approval was required, whether a downstream call occurred, and what result was recorded. Receipts are hash-chained, so history cannot be quietly rewritten — even by an admin.
What is Vertlock Proof?
Vertlock Proof is a five-step trust demo: allowed read, denied dangerous action, approval-gated action, revocation drill, and ledger verification. It is designed to prove the core trust path before teams connect agents to real work.
Is Vertlock open source?
Yes — Vertlock has an Apache-2.0 OSS self-host path for technical teams that want full control and can operate security infrastructure. OSS includes the core gateway and local operation path. Hosted Vertlock Cloud adds managed operations, updates, backups, approvals, monitoring, evidence, and support.
Who should use Vertlock?
Vertlock is for engineering, security, IT, and operations teams that want AI agents to use company tools but need controlled permissions, brokered credentials, human approvals, revocation, and audit evidence.
Still have questions? Ask them on a 20-minute demo.