Aembit now offers an MCP Identity Gateway (Beta) that sits between AI agents and MCP servers,
enforcing Access Policies, performing secure token exchange, and providing visibility into MCP activity.
Deployed on a Linux VM, the Gateway ensures AI agents never hold direct credentials for enterprise systems.
Key capabilities:
- Proxies MCP traffic with identity-aware policy enforcement
- Performs secure token exchange using OAuth 2.0 and API key credentials
- Provides per-user credential management and centralized MCP routing
- Logs agent identity, user identity, and policy decisions for auditability
- Fail-closed behavior—denies access by default unless explicitly allowed
For setup instructions and architecture details, see MCP Identity Gateway.
Aembit now provides an MCP Server that enables AI agents and users to query Aembit event logs
using structured commands.
Built on the Model Context Protocol specification, the MCP Server enables agentic observability and
auditability for organizations using Aembit.
Key capabilities:
- Query audit logs, authorization events, and workload events
- Integrations with MCP Inspector, Claude Code, GitHub Copilot, and Visual Studio
- Resource-set-based access scoping for least-privilege access
- Read-only access—no create, update, or delete operations
- Full audit trail of all MCP Server queries
For setup and connection guides, see Aembit MCP Server.
Aembit has added a new MCP User-Based Access Token Credential Provider type.
This type enables per-user OAuth credentials for MCP servers using the OAuth 2.0 Authorization Code flow.
The MCP Identity Gateway manages user-specific tokens when connecting to downstream MCP servers.
Key capabilities:
- OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (PKCE) support
- MCP Server URL discovery with auto-population of OAuth endpoints
- Per-user credential scoping
- Token introspection and lifetime management
For configuration details, see MCP User-Based Access Token Credential
Provider.
Aembit now supports component copying between Resource Sets.
You can replicate Access Policy components—including Client Workloads, Server Workloads, Trust Providers,
Credential Providers, and Access Conditions—from one Resource Set to another.
You can also copy entire Access Policies with all related components at once.
Key capabilities:
- Copy individual components or entire Access Policies between Resource Sets
- Each copy receives a unique identifier while the original remains unchanged
- Supports environment promotion, regional deployments, and safe experimentation
For details, see About component copying
and Copy components.