Speakeasy Gram
An enterprise MCP gateway and AI control plane that gives every team one governed path to its MCP servers.
- Source repo
- speakeasy-api/gram
- Stars
- ★ 275
- Last updated
- today
- License
- AGPL-3.0
- Primary language
- Go
- FA score
- 53/100 · Major gaps
At a glance
- How it runs
- Works with
- Portable with changesChatGPT · Claude Code
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- High · needs real infrastructure
- You'll need
- Typical use
- A platform team needs one governed entry point for MCP servers spanning SaaS vendors, public APIs and internal systems, instead of per-team client configs.
- Not a fit if
- Small teams wanting a fully offline, no-SaaS setup
- Individuals who just need a local MCP client without central governance
- Source review
- 53/100 · Major gaps
What does this agent do, and when should you use it?
Gram is the open source stack behind Speakeasy's AI control plane, built around an enterprise-grade MCP gateway. It centralizes MCP servers, Skills, Plugins and Assistants and distributes them to teams by role, synced from the IdP you already run such as Okta, Azure AD or Google Workspace. Access control is enforced through RBAC and OAuth 2.1 at team, server and tool level, while every prompt, response and agent action is inspected in real time for prompt injection, PII and shadow AI use. Observability is built on OpenTelemetry, tracking token use and cost per team with budgets, expensive-session drill-downs and tool-effectiveness analysis. The stack is a Golang backend with a TypeScript dashboard, Goa design-first APIs, Temporal workflows and OpenRouter as the LLM gateway. You can use the hosted app.getgram.ai platform or bring the whole stack up locally with the ./zero script.
Gram registers the MCP servers, Skills, Plugins and Assistants your organization connects, turning them into a single governed catalog. It maps roles from your IdP into RBAC permissions that are enforced at team, server and tool granularity, so a given team only reaches the MCP tools it is entitled to. At runtime it intercepts each agent request and applies security policy to prompts, responses and tool calls: sensitive data is blocked, redacted or logged, and prompt injection, PII leakage and shadow AI use are detected. Every tool call, permission change and access event is logged and searchable. Telemetry collected via OpenTelemetry rolls up token and cost usage per team, feeding budgets and tool-effectiveness reporting, and OAuth 2.1 handles authorization when resources are distributed to teams.
- A platform team needs one governed entry point for MCP servers spanning SaaS vendors, public APIs and internal systems, instead of per-team client configs.
- A security team wants to block sensitive-data leakage and keep an audit trail while employees call MCP tools from Claude, ChatGPT or Cursor.
- An IT admin wants existing Okta or Azure AD roles to determine which MCP tools each team can access without hand-maintaining accounts.
- A FinOps or engineering lead needs to track token consumption and cost by team and session, and set budgets for expensive workloads.
- A developer wants a seeded local environment with deployed APIs, agent sessions, telemetry and risk findings to debug gateway policy or dashboard work.
How do you install or deploy this agent?
Local development requires Mise and Docker. The repository's ./zero script installs dependencies, runs pending database migrations and starts the dashboard and services; run it until it succeeds.
./zeroThe script guides you to install Mise or Docker if they are missing. To work on several branches at once, each git worktree can run its own full stack on its own ports:
wt switch --create my-featureThe hosted platform needs no installation: sign up at https://app.getgram.ai/. For a fully local start, keep running ./zero until it completes.
How do you use this agent?
Once services are up (or even before, since the seed talks to the databases directly), populate your local organization with a realistic environment — a deployed API, agent sessions, telemetry, risk findings, teammates and an API key:
mise seedRe-running the command resets the seeded data. Then open the local dashboard to inspect MCP connections, policies and usage panels. The hosted equivalent is https://app.getgram.ai/, with documentation at https://www.getgram.ai/docs/introduction.
What are this agent's strengths and limitations?
- One control plane for MCP connectivity, permissions, policy and observability, instead of per-team MCP client configuration.
- RBAC and OAuth 2.1 enforced at team, server and tool level, synced from existing IdPs such as Okta, Azure AD and Google Workspace.
- OpenTelemetry-based token and cost tracking with budgets, session drill-down and tool-effectiveness analysis, plus searchable audit events.
- Both a hosted platform and an open source self-hosted stack, with a single ./zero path to a full local environment.
- Self-hosting needs Mise and Docker plus database migrations and multiple services such as Temporal, which is substantial infrastructure work.
- LLM traffic goes through OpenRouter and billing uses Polar, so the hosted path is tied to those vendor ecosystems.
- AGPL-3.0 licensing needs review if you redistribute it or offer it as a network service.
- Built for enterprise governance; individuals or small teams may find the role and policy model heavy for their needs.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Speakeasy Gram This agent | 53 · Major gaps | Self-hosted serviceFreemium | ★ 275 | today | Go | ChatGPT · Claude Code |
| Archestra | 71 · Some gaps | Self-hosted serviceFreemium | ★ 4.4k | today | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| Preloop | 84 · Good | — | ★ 81 | today | Python | Codex · Claude Code |
| Kontext | 83 · Good | CLIFreemium | ★ 232 | today | Go | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows real least-privilege design: RBAC, OAuth2.1, IdP sync, team/server/tool-level permissions, and org:admin-only device-agent config with platform-admin-only update_channel/blocked_versions (least_privilege=2). User confirmation is thin: ZIP installs embed hooks credentials that must be distributed privately, docs admit local user settings are user-modifiable and personal accounts cannot be enforced, with no unified destructive-action confirmation or recovery (user_confirmation=1). Data-flow transparency is decent: README and runbooks describe telemetry, OpenTelemetry, sensitive-data blocking/redaction/logging, and OpenClaw plugins seeing gateway secrets but scrubbing config-shaped payloads (data_flow_transparency=2). Sensitive-data handling has PII/secret detection and redaction claims but mostly marketing assertions without implementation evidence (sensitive_data_handling=2). Dependency security lists Mise/Docker/Stripe/Temporal but no lockfiles, SBOM, or vulnerability scanning evidence (dependency_security=1). External effects: runbooks create Stripe sandbox objects, write DB rows, mint hooks keys, but lack unified side-effect confirmation/undo (external_effects=1). Rollback is limited to deleting test clocks/orgs and --force overwrite; research doc notes a corrupt ZIP destroys the old install with no revocation guarantee (rollback=1). Source attribution: README says Built by Speakeasy with contributor links, but publisher is unverified and there is no signing or provenance proof (source_attribution=1).
Self-consistency is good: multiple docs agree on USI/RSI/RSC, Stripe billing, and OpenClaw coverage, and the research doc explicitly labels supported/conditional/contradicted (self_consistency=2). Dependency availability relies on ./zero bootstrapping Mise/Docker with no version pinning or offline path, and CLI keys expire in ~90 days (dependency_availability=1). Failure messages are strong: stripe:status, plugins doctor, debug logs, and ordered troubleshooting checklists (failure_messages=2).
Audience and scenarios cover enterprise admins, developer laptops, and server/CI without device agent (audience_and_scenarios=2). Capability boundaries are explicit: OpenClaw coverage is partial under claude-cli, ZIPs are snapshots not subscribed sources, local settings are user-modifiable (capability_boundaries=2). Trigger precision is weak: hooks silently do not fire without allowConversationAccess, and version support is pinned to 2026.6.34 with 2026.7.1-2 unrequalified (trigger_precision=1). Environment fit covers macOS/Linux/Windows differences, Bash assumptions, and Cursor team-admin local-import gating (environment_fit=2).
Information architecture is clear: README splits Observe/Secure/Connect/Distribute, docs split runbooks/research (information_architecture=2). Install notes are detailed: ./zero, mise seed, Stripe setup, OpenClaw install steps (install_notes=2). Naming stability is weak: GRAM_HOOKS_* deprecated in favor of SPEAKEASY_AI_HOOKS_*, older binaries read only old names (naming_stability=1). Examples exist but no consolidated FAQ (examples_and_faq=1). Known limitations are well documented: OpenClaw coverage traps, no nightly canary, ZIP update behavior (known_limitations=2). License is full AGPL-3.0 text (license=3). Versioning/changelog is absent beyond scattered version tables (versioning_changelog=1). Maintenance responsibility has CONTRIBUTING, Slack, support email, but publisher is unverified with no explicit SLA or maintainer commitment (maintenance_responsibility=1).
Output usability is good: runbooks give executable commands, SQL checks, and checkpoints (output_usability=2). Marginal value is enterprise MCP gateway, centralized governance, and observability, incremental for orgs with existing IdP (marginal_value=2). Cost-benefit requires deploying Mise/Docker/Temporal/Postgres/Stripe full stack with high ops cost, and AGPL constrains commercial distribution, so the ratio is unclear (cost_benefit=1).
Claim traceability is strong: the research doc labels each claim supported/conditional/contradicted/undocumented/code-derived with official doc citations (claim_traceability=2). Cross-source corroboration: code paths (repo.go, handler.go, generate.go) align with official docs (cross_source_corroboration=2). Fact/inference separation is explicit, repeatedly stating no end-to-end validation and that screenshots are synthetic UI evidence (fact_inference_separation=2).
- Publisher identity is unverified; README claims such as SOC 2 Type II and ISO 27001 cannot be independently confirmed from repository files.
- ZIP installs embed hooks credentials; docs admit local user settings are user-modifiable and personal accounts cannot be enforced, creating credential-leak and governance gaps.
- The research doc notes a corrupt ZIP destroys the old install with no revocation guarantee, so rollback is limited.
- Requires full Mise/Docker/Temporal/Postgres/Stripe stack with no lockfiles or vulnerability-scan evidence, and CLI keys expire in ~90 days.
- OpenClaw coverage is partial under claude-cli and silently does not fire without allowConversationAccess; only version 2026.6.34 is qualified.
- AGPL-3.0 imposes source-disclosure obligations on commercial distribution and network services; assess compliance impact.