Agents reach real systems.
Someone has to sign that off.
Omniio puts one MCP endpoint in front of 140 servers, and puts the three things a security review asks for around it: who gets in, what a tool is allowed to do, and what is written down afterwards.
- SSO + SCIMFrom Business up, through your own IdP
- 60sA held call waits for a human, then hands back a URL
- 365 daysOf every call, argument and refusal, kept verbatim
- No seat priceMetered on calls, so adding people costs nothing
Joining the company is joining Omniio.
Two halves that are usually bought together and are genuinely separate. SSO answers who is this person. SCIM answers who should exist at all. Both land on Business and Enterprise, on the one gate a team already needs, so they cannot drift apart.
Your IdP authenticates, we don’t
List the email domains you own and they route to your provider at sign-in. Omniio asks for openid email profile and nothing further — no refresh token for your directory, because that is a credential we would then have to protect and have no use for.
Offboarding that actually offboards
Your directory pushes joiners and leavers. A deprovision deactivates the member and frees the seat in the same motion that closes their mailbox — and the team screen shows how many people a connection has provisioned and how many it has since deactivated, so it is checkable rather than assumed.
Issuer https://your-org.okta.comRedirect URI https://omniio.dev/api/auth/sso/callbackScopes openid email profileSCIM base URL https://omniio.dev/api/auth/scim/v2SCIM auth Bearer <token issued to your team, shown once>One connection per team, enforced by a unique constraint rather than by a check somebody could forget to write. Setting one up needs a team on Business or above and the owner or admin role — the same people who can already invite a member, since both end in somebody new being in the team.
Pick a mode. Watch what the gateway does.
Set per tool, per account. The gate runs before the aggregator, so a denied tool never reaches the upstream server and its credential is never unsealed. Refusals are recorded through the same recorder as real calls — “what did my agent try to do” has to include the things that were stopped.
- agentrun_tool("linear__create_issue", { title: "Ship the gateway page" })
- omniiopolicy is ask → open an approval, notify, hold
- youopens /app/tools/approvals/… and reads the arguments
- omniioapproved within the 60s wait → claimed, single-use
- upstreamPOST linear.app · issue LIN-482 created
- agentCreated LIN-482. (Undecided after 60s it returns the approval URL instead, and the request stays open.)
Held for 60 seconds, then handed back as a URL — never dropped.
An allow rule is a judgement about a tool as it was. Omniio fingerprints every published definition on refresh. When an upstream materially changes what a tool accepts, the rule is suspended rather than deleted: one approval runs that call, and reading the change puts the rule back. That is the whole mechanic of a rug pull, closed.
Kept as long as the plan says.
Every call is stored with its arguments and its result verbatim, which is a real cost — so the window is tiered, enforced by the nightly prune, and applied in the query too. Between prune runs there are rows on disk that are past the promise, and a log that showed them would be the version you believed.
- Free7 days
- Pro30 days
- Scale90 days
- Business180 days
- Enterprise365 days
Signed webhooks
Every recorded call fans out as an event — tool_call.succeeded and tool_call.failed — signed HMAC-SHA256 over the timestamp and body in a omniio-signature header. Refusals are events too, so a denied call reaches your SIEM.
Webhook reference →A read API over the trail
The same rows the activity screen shows, paged for a program: up to 200 calls a request with a cursor, plus servers, tools and usage. Bearer-authenticated with a key you can revoke.
Read API →Traces on your trace
Trace context arrives in the MCP request's `_meta` and Omniio's spans hang off it, so a slow agent turn shows which of the six tools it called was the slow one — in your own tracing tool, not a second one.
How tracing works →Export and erasure
Everything an account holds is exportable as JSON on demand, and deleting an account removes its credentials, its grants and its call history rather than flagging them.
Data handling →A team pools the plan. Nothing else.
The tempting design is a shared workspace where one admin connects GitHub once and everybody uses it. That is a service account with extra steps: the audit trail stops naming a person, and one leaver’s token keeps working. Omniio does the opposite.
- The plan and its call allowance, billed once for the whole team
- Single sign-on, so joining the company is joining Omniio
- SCIM, so leaving the company closes the Omniio account too
- One invoice, one renewal, one place to raise the ceiling
- Credentials — each person's tokens and OAuth grants are theirs alone
- Server toggles — what you have on is not what a colleague has on
- The MCP endpoint's contents — same URL, different tools behind it per person
- Tool policy and the approval queue, which are decided per account
Business carries up to 50 members; Enterprise is negotiated and has no ceiling. Invites expire after 14 days. Everyone points the same client config at https://mcp.omniio.dev — what is behind it is theirs.
What a review usually asks.
Which IdPs work?
Anything that speaks OIDC — Okta, Entra ID, Google Workspace, JumpCloud, Auth0. You give Omniio the issuer and client, Omniio gives you the callback URL, and the email domains you list get routed to your IdP at sign-in. Omniio never sees a password and never asks for offline_access: a refresh token for your directory is a credential we would then have to protect and have no use for.
Does SCIM actually close accounts?
Yes. A deprovision from your directory deactivates the member, which frees the seat and ends the person’s access in the same motion that closes their mailbox. The team screen shows both numbers — how many people a connection has provisioned and how many it has since deactivated — so an offboarding you thought happened is checkable rather than assumed.
What stops an agent doing something irreversible?
A per-tool policy. Deny refuses before the upstream server is contacted and before that server’s credential is unsealed. Ask holds the call for 60 seconds while a human reads the exact arguments; if nobody answers, the agent is handed the approval URL instead of a failure, and the request stays open for 15 minutes. An approval covers those arguments once — it is claimed when spent, so a second call cannot ride it.
What happens when a tool changes underneath us?
An allow rule is a judgement about a tool as it was. When an upstream materially changes what a tool accepts or claims to do, Omniio records the change and suspends the allow rule — the next call needs one approval, and reading the change on the review screen puts the rule back. Changes detected before you connected the server are not shown to you, because a review queue nobody lived through teaches people to clear it without reading it.
How long is the audit trail kept?
180 days on Business, 365 on Enterprise. It is enforced by the nightly prune and applied in the query, so the log never shows you rows that are past the promise. Every call is stored with its arguments and result verbatim — including the ones that were refused.
Is there a seat price?
No. Omniio meters MCP calls, not people, so adding a colleague costs nothing until they actually make calls. Business carries up to 50 members as a ceiling on a shared allowance rather than a price list; Enterprise is negotiated and has none. Invites expire after 14 days.
Can we self-host it?
Not today. Omniio is a hosted gateway; what an Enterprise agreement changes is the contract, the volume, the retention and the support terms, not where it runs. If a deployment boundary is a hard requirement for you, say so in the form below — it is the thing we most want to hear about before we build it.
Tell us the volume and the constraints.
Rough monthly call volume, the servers you depend on, and any residency or SSO requirements. A person reads it and replies — there is no sequence.