Sallyport and Britive
Approves calls one by one, but only for MCP tools.
Britive comes from just-in-time cloud access and has brought a real approval step to agent tool calls. Time-boxed grants and continuous evaluation signals sit behind it. On MCP they are one of the few vendors doing the thing we do.
| Them | Sallyport | |
|---|---|---|
| Per-call human approval | MCP tool calls | MCP and the HTTP proxy, one policy across both |
| Arbitrary HTTP host | No | Yes, through the reverse proxy |
| Any public HTTP host | The connector catalogue | Any host you hold a key for |
| Time-boxed grants | Yes | Yes, checked at the boundary of every call |
| Tamper-evident journal | Logging | Hash-chained, signed per entry, keys published |
Where they are ahead
Cloud entitlement depth. If your agents mostly need short-lived roles in AWS, Azure and GCP, that is their home ground and they have been on it for years.
Where the difference is
Agents do not stay inside one protocol. The same agent opens a pull request from an MCP client, then a CI job hits the same binding through the proxy. One broker across both keeps one policy, one approval inbox and one journal instead of two.