Govern every AI agent in your enterprise. Start free.
Connect any agent to any tool with identity, guardrails and audit.
$0 forever
Govern your first agents. No card, no call.
- Up to 15 users
- Up to 15 integrations
- Proxy MCP support
- Standard support
Talk to us
Govern every agent, on every machine, across every team.
Everything in Free, plus:
- Identity from your IdP, with SCIM
- Action-level permissions inside each tool
- Runtime guardrails on tool calls, prompts and inference calls
- Shadow AI discovery across the fleet
- Background agents
- Token analysis and client-side usage policies
- SaaS, EU cluster, self-hosted or air-gapped
- Log streaming to your SIEM
- Priority support and dedicated account management
Partner with us
Bring MCP gateways and AI usage control tools to every customer you serve.
Built for:
- Resellers and distributors, with partner margin and deal registration
- MSSPs and MSPs, with a multi-tenant console and usage-based pricing
- Consultancies and SIs, with a rollout playbook and certification track
- Technology partners, with a Marketplace listing and API access
Trusted by security, IT and engineering teams at the world's leading organizations
★★★★★From Shadow AI to CISO Approval in Two Weeks
Willow surfaces shadow AI nobody knew existed, and that visibility is exactly what gets a skeptical CISO to yes in two weeks instead of months. That's rare for security tooling and it's the clearest driver of the fast, org-wide adoption.
See more →
★★★★★Building AI Agents With Real Enterprise Guardrails
Makes enterprise AI genuinely usable without sacrificing security or control. The least-privilege model is a huge win: tools are scoped to the task, every action is logged, and I can clearly show auditors who did what, when, and in which system. Feels like the missing layer between AI tools and real company systems.
See more →
★★★★★Best-in-Class Agent Governance
Handles governance at the point where the agent actually gets its tools, not as a report after the fact. Every tool call is scoped to least privilege before it ever runs, and the full audit trail lands in our SIEM without us having to build a pipeline for it.
See more →
★★★★★The rare vendor where the integrations you need are already built
Found Jira, GitHub, Slack, Snowflake, and Salesforce already sitting there. Impressed by how it handled the long tail of our stack, not just the obvious names. Credential handling is a small thing that matters; tokens rotate without anyone getting paged.
See more →
★★★★★A Game-Changer for Secure AI Tooling
Everything goes through one governed gateway, so access, permissions, guardrails, security policies, and logs are handled in one place. Automatic risk assessment for tools saves time. The separation between read and write tools is very helpful from a security perspective.
See more →
★★★★★Gave us the confidence to say yes to AI tooling faster
We can see exactly which MCP servers are connected, what they're allowed to do, and enforce policy on new ones before they ever reach an employee's hands. Onboarding a new MCP server into our governed catalog takes minutes instead of a drawn-out security review cycle.
See more →★★★★★Willow Support That's Fast, Knowledgeable, and Truly Hands-On
The team is on Slack, responds fast, and actually knows the product, not reading from a script. Had an edge case with a custom connector and someone from their team was debugging it with me in real time same day. That almost never happens anymore.
See more →
★★★★★Secure, Auditable AI Rollouts Without the Bottlenecks
Runtime-scoped permissions — agents get task-specific access instead of standing API keys, which shrinks blast radius significantly. Centralised audit trails tied to real employee identity make post-incident tracing painless. Extends our existing identity stack rather than replacing it.
See more →
★★★★★Connectors were already there, didn't need to open a single IT ticket
Slack, Google Drive, Rocketlane, HubSpot, all connected, no ticket to IT to get any of it working. My team built out specific tools for things we actually do every day. That's not generic AI chat, that's stuff scoped to our actual job. Didn't expect a governance layer to also make it this easy to self serve.
See more →
★★★★★Rock-Solid Reliability at Enterprise Scale
Running this across the whole org, zero downtime drama. Hundreds of employees on this daily across multiple teams, and I was bracing for the usual growing pains. Hasn't happened. It just holds up the way you want infrastructure to hold up.
See more →
★★★★★Makes AI Governance Much Easier
How easy it is to manage MCP servers and user access from one place without changing our existing Okta setup. Shadow AI detection was useful because it helped us identify a few unapproved AI tools during rollout that we otherwise would have missed.
See more →
★★★★★Seamless Tool Integration with a Simple, Effortless UI
Custom toolsets for different departments provide a tailor-made setup right out of the box. The UI is simple and clear. Started with engineering; six months later, HR, legal, and finance are all on it too.
See more →
“I want my team moving fast with AI. I also need real control — not a policy doc no one enforces. Willow is the first company that gave me both.”
Eden Fogel
Head of Operations & Compliance, Agora
.svg)
“We are six to ten months ahead of most companies in AI adoption. More code to production, fewer incidents, real outcomes. Willow is what made it possible to move that fast without slowing down our security posture.”
Asaf Yonay
Head of AI Core, WIX
“We sell trust. We couldn't run our own AI on default-allow. Willow fixed that.”
CISO
Global Cybersecurity Company
“Willow gave us a single platform to govern and secure our developers’ local machines, especially around exposure to MCP servers and external skills. It improved our ability to control access and reduce risk.”
Assaf Grimberg
SVP Software Engineering, Innovid
“With Willow, our development and delivery velocity increased dramatically. By bringing all our knowledge sources into one unified hub, the platform eliminates friction, saves developers valuable time.”
Elihai Blomberg
DevOps Manager, Riskified
“Our R&D teams were going to use AI either way. The question was whether I'd see it. Now I do. So do my auditors.”
CISO
Fortune 500 Pharmaceutical Company
One platform. One line item.
Most teams are buying five tools to do what Willow does from one control plane.
What you're buying today
- ✕MCP gateway
- ✕Shadow AI scanner
- ✕DLP bolt-on for prompts
- ✕Approval workflow scripts
- ✕Agent observability tool
What you buy instead
One control plane, one contract, one audit trail.
The token savings alone pay for the platform.
Willow is inline on every agent tool call. It shows token spend per user, per tool and per device, then cuts the waste: context that loaded for nothing, tools nobody calls. Usage policies are enforced client-side across Claude Code, Cursor and Codex.
Token and model spend per user, per tool and per device, across the fleet. Local and stdio MCPs included, not just remote. Agent hours attributed to the repository that consumed them.
Token usage policies enforced client-side by the Willow Usage Hooks plugin. MCP output payload and format optimisation. Skill token analysis to find oversized skills.
Optimize view with recommended actions, and spend trend before and after in the analytics explorer.
Every capability, side by side
Identity and access
| Capability | Free | Enterprise |
|---|---|---|
| Human seats | Up to 15 | Unlimited |
| Every agent gets an identity tied to a real employee | Included | Included |
| Identity inherited from Okta, Entra ID or JumpCloud | — | OIDC, OAuth2, JWT |
| SSO and SCIM, with agent access revoked on offboard | — | Included |
| Your existing IdP groups become agent RBAC | — | Included |
| Custom org roles, enforced on every API endpoint | — | Included |
| Machine users for agent-to-agent work | — | Included |
Gateway and connectivity
| Capability | Free | Enterprise |
|---|---|---|
| Connected integrations | Unlimited | Unlimited |
| MCP support | Proxy only | Proxy, built-in and on-premises |
| Wrap any internal API as an MCP | — | Included |
| Bring your own agent | Included | Claude, Cursor, Codex, Copilot, OpenCode, homegrown |
| Per-user auth, including client credentials per user | — | Included |
| Credentials in a vault, BYOK and external KMS | — | Included |
| Customer-controlled encryption key rotation | — | Included |
| MCP traffic and OAuth via your own HTTP proxy | — | Included |
| Per-user and per-org rate limits | — | Included |
| Org IP allowlist | — | Included |
Guardrails and enforcement
| Capability | Free | Enterprise |
|---|---|---|
| Action-level permissions inside each tool | — | Per tool, per action, per condition |
| PII redaction and prompt-injection protection at runtime | — | Included |
| Guards on prompts, not just tool calls | — | Included |
| Guards on Anthropic inference calls | — | Included |
| Guard Hooks: enforcement in the client, outside the gateway | — | Claude Code, Cursor, Codex |
| Prompt guards on web AI | — | ChatGPT, Claude, Gemini, M365 Copilot, DeepSeek |
| Encoded content decoded before guard checks | — | base64 and hex |
| Allowed AI Tools per MCP, enforced in the gateway | — | Included |
| Unmanaged MCPs and skills blocked in the client | — | Included |
| High-risk skills held until they clear a risk threshold | — | Included |
| Bulk disable, approve or annotate MCP tools | — | Included |
| Blocked users see the reason and can request access | — | Included |
| Approvals in Slack, or interactively in the AI client | — | Included |
| MCP versioning with revert, and draft mode for edits | — | Included |
| Identity risk score from CrowdStrike, usable as a guard condition | — | Included |
| Vibe apps governance | — | Lovable, Bolt, Base44 |
Discovery and fleet coverage
| Capability | Free | Enterprise |
|---|---|---|
| Shadow AI discovery: unsanctioned agents, MCPs and skills | — | Browser extension and endpoint agent |
| Local and stdio MCPs seen, not just remote | — | Included |
| Agent memory discovery per user | — | Included |
| Extension deployed via MDM, no per-employee install | — | Included |
| Radar: KPI scorecard with coverage caveats and drill-downs | — | Included |
| Risk scoring on skills, with reasoning exposed | — | Included |
Background agents
| Capability | Free | Enterprise |
|---|---|---|
| Agents that fire on a trigger and run the job to completion | — | Included |
| Triggers | — | Slack, webhooks, schedules, alerts |
| Runtimes | — | Claude Managed Agents, AWS AgentCore, Cursor Cloud Agents, kagent, your own harness |
| Each agent scoped to the tools its job needs, with its own audit trail | — | Included |
| Agent-owned credentials per integration | — | Included |
| Harness pull mode: agents poll, no inbound webhook exposed | — | Included |
| Dedicated Slack app per agent | — | Included |
Token analysis and optimisation
| Capability | Free | Enterprise |
|---|---|---|
| Token and model spend per user, per tool and per device | — | Included |
| Model breakdown and agent hours by repository | — | Included |
| Fleet-wide spend, including local and stdio MCPs | — | Included |
| Token usage policies enforced client-side | — | Claude Code, Cursor, Codex |
| MCP output payload and format optimisation | — | Included |
| Skill token analysis | — | Included |
| Optimize view with recommended actions | — | Included |
Enablement
| Capability | Free | Enterprise |
|---|---|---|
| Self-serve portal: employees connect tools without a ticket | Basic | Full, with per-page visibility config |
| Governed marketplace of connectors, skills and plugins | — | Curated per group |
| AI Champions manage their own team's toolkit | — | Included |
| Provision a group and everyone gets the tools, no setup | — | Included |
| Push skills and plugins to the fleet | — | Included |
| Verified badge and signing for plugins and skills | — | Included |
| Skill and plugin sync from GitHub or Bitbucket | — | Included |
| Claude Code policy console with MDM export | — | Included |
Audit and observability
| Capability | Free | Enterprise |
|---|---|---|
| Audit trail: every action tied to a real human | Limited | Immutable, timestamped, queryable |
| Covers user actions, admin actions, HTTP and stdio calls | — | Included |
| Log streaming | — | Splunk, Loki, Grafana, CrowdStrike, Panther, S3, webhook |
| OpenTelemetry export from Claude Code and Codex | — | Included |
| Adoption analytics: weekly active users, top tools, by group | — | Included |
| Blocked versus passed action reporting, per guard | — | Included |
| Analytics explorer and custom dashboards | — | Included |
Deployment
| Capability | Free | Enterprise |
|---|---|---|
| SaaS | Included | Included |
| EU cluster, fully EU-managed | — | Included |
| Self-hosted in your cloud | — | AWS, GCP, Azure |
| On-premises and air-gapped | — | Included |
| Hybrid gateway | — | Included |
Support and terms
| Capability | Free | Enterprise |
|---|---|---|
| Support | Standard | Priority, dedicated account management |
| Onboarding | Self-serve | Guided POV |
| Compliance | — | SOC 2 Type II, GDPR-Ready, current penetration test report |
| Security review support, DPA and sub-processor list | — | Included |
| Billing | — | Annual, AWS Marketplace |
Deploy where compliance requires
SaaS
Live the same day.
EU cluster
Fully EU-managed.
Self-hosted
Your cloud: AWS, GCP or Azure.
On-premises & air-gapped
Full isolation for regulated industries.
Audit logs stream to Splunk, Loki, Grafana, CrowdStrike, Panther, S3 or a webhook, and OpenTelemetry exports to any OTLP backend.
A POV with no cost and no internal headcount
Visibility
Identity
Tools
Live & readout
FAQS
Everything you need to know about Willow pricing and platform
Your agents are already in the wild.
Give them a Basecamp. Go from AI chaos to AI work, in minutes.
