Give AI agents your APIs over MCP, without giving them everything
Absorb turns your OpenAPI spec and a short policy into the only tools an agent can call, strips every response to approved fields, and keeps credentials inside your network.
Self-hosted, deterministic, no code changes to your API.
- AllowlistUnlisted operations do not exist for the agent.
- Field levelResponses cut to the fields you name.
- Edge secretsCredentials never reach agents or schemas.
- Every callOne audit record per call, exportable.
Every call passes four checks before it reaches your API
A full spec hands an agent every destructive route and every field of every response. Absorb sits between them and removes both.
- Tool existsOnly operations the policy names are listed. Anything else is an unknown tool, logged as a denial.
- Arguments validChecked against the schema and policy conditions before any request leaves.
- Credentials addedInjected at the edge from environment or vault. Agents never hold them.
- Response filteredUnlisted fields dropped, size capped, and the call written to the audit log.
What actually reaches the model
{ "id": "ACME-142", "status": "blocked", "priority": "high", "summary": "SSO certificate expired on customer tenant","raw_description": "Full thread with customer","customer_email": "[email protected]","ssn": "123-45-6789","blocker_flag": true, "assignee": { "name": "Dana Reyes","email": "[email protected]","phone": "+1 555 0100"},"comments": [ ... ],"custom_fields": { "contract_value": 125000 }}
Full walkthrough, architecture and data handling, or the policy reference.
Compared with what you would use instead
| Spec wrappers | API gateways | In-house code | Absorb | |
|---|---|---|---|---|
| What the agent can call | Every documented operation | Routes a key may reach | Whatever each wrapper exposes | Only operations the policy names |
| Response data | Upstream body, unmodified | Forwarded, optional transforms | Filtered by hand, drifts silently | Filtered field by field |
| Credentials | In the agent's config file | Shared service account | An env variable per wrapper | Held at the edge, or the agent's own identity |
| Audit | App logs, where they exist | Request-level access logs | Whatever each service logs | One record per tool call |
| Tenth API | Tenth full security review | New routes and plugins | Ten codebases to maintain | Ten policies, one runtime |
Also see Absorb vs MCP gateways and Kong, Apigee and MuleSoft integrations.
Priced per production API. Non-production is unlimited.
Same compiler, filtering and audit record in every edition.
Identity and authorization packs, MSA, 24x7 Sev-1.
What is includedFull comparison, add-on packs and what counts as a production API
Common questions
Do we have to change our API to use it?
No. Absorb reads the OpenAPI specification you already publish, including Swagger 2.0, and calls the API exactly as any client would. If the specification is out of date, absorb probe reports where before agents encounter it.
Which agents and clients work with it?
Anything that speaks the Model Context Protocol: Claude Desktop, Cursor, Windsurf, VS Code and in-house agents, over streamable HTTP, the legacy SSE transport or stdio.
How long does the first API take?
A session. You write a policy, run absorb diff until the surface matches what you intended, then deploy the sidecar beside the API. The review document comes out of the same compilation.
What happens when an agent asks for something the policy forbids?
The tool does not exist in the agent's list, so there is nothing to call. A request for an unlisted tool returns the same error as a typo and is recorded as a denial.
Where does it run, and what do you see?
Inside your network, as a sidecar, a service behind your gateway or a binary on a virtual machine. No request or response data reaches us, and the product makes no outbound connection to us. Details are on the security page.
How is it licensed?
By production API, with unlimited non-production use and the same enforcement in every edition. See pricing.
Put your first API under policy control
Send a spec and the rules you need enforced. We compile it with your team and hand over the policy and review document.