Govern every AI agent in your enterprise. Start free.
Connect any agent to any tool with identity, guardrails and audit.
$0 forever
Govern your first agents. No card, no call.
- Up to 15 users
- Up to 15 integrations
- Proxy MCP support
- Standard support
Talk to us
Govern every agent, on every machine, across every team.
Everything in Free, plus:
- Identity from your IdP, with SCIM
- Action-level permissions inside each tool
- Runtime guardrails on tool calls, prompts and inference calls
- Shadow AI discovery across the fleet
- Background agents
- Token analysis and client-side usage policies
- SaaS, EU cluster, self-hosted or air-gapped
- Log streaming to your SIEM
- Priority support and dedicated account management
Fewer than 250 seats? The team plan is available in-app once you outgrow Free.
What industry leaders are saying
"I want my team moving fast with AI. I also need real control — not a policy doc no one enforces. Willow is the first company that gave me both."
"We are six to ten months ahead of most companies in AI adoption. More code to production, fewer incidents, real outcomes. Willow is what made it possible to move that fast without slowing down our security posture."
.svg)
"We sell trust. We couldn't run our own AI on default-allow.
Willow fixed that."
"Willow gave us a single platform to govern and secure our developers’ local machines, especially around exposure to MCP servers and external skills. It improved our ability to control access and reduce risk."
"With Willow, our development and delivery velocity increased dramatically. By bringing all our knowledge sources into one unified hub, the platform eliminates friction, saves developers valuable time."
"Our R&D teams were going to use AI either way. The question was whether I'd see it. Now I do. So do my auditors."
One platform. One line item.
Most teams are buying five tools to do what Willow does from one control plane.
What you're buying today
- ✕MCP gateway
- ✕Shadow AI scanner
- ✕DLP bolt-on for prompts
- ✕Approval workflow scripts
- ✕Agent observability tool
What you buy instead
One control plane, one contract, one audit trail.
The token savings alone pay for the platform.
Willow is inline on every agent tool call. It shows token spend per user, per tool and per device, then cuts the waste: context that loaded for nothing, tools nobody calls. Usage policies are enforced client-side across Claude Code, Cursor and Codex.
Token and model spend per user, per tool and per device, across the fleet. Local and stdio MCPs included, not just remote. Agent hours attributed to the repository that consumed them.
Token usage policies enforced client-side by the Willow Usage Hooks plugin. MCP output payload and format optimisation. Skill token analysis to find oversized skills.
Optimize view with recommended actions, and spend trend before and after in the analytics explorer.
Every capability, side by side
Identity and access
| Capability | Free | Enterprise |
|---|---|---|
| Human seats | Up to 15 | Unlimited |
| Every agent gets an identity tied to a real employee | Included | Included |
| Identity inherited from Okta, Entra ID or JumpCloud | — | OIDC, OAuth2, JWT |
| SSO and SCIM, with agent access revoked on offboard | — | Included |
| Your existing IdP groups become agent RBAC | — | Included |
| Custom org roles, enforced on every API endpoint | — | Included |
| Machine users for agent-to-agent work | — | Included |
Gateway and connectivity
| Capability | Free | Enterprise |
|---|---|---|
| Connected integrations | Unlimited | Unlimited |
| MCP support | Proxy only | Proxy, built-in and on-premises |
| Wrap any internal API as an MCP | — | Included |
| Bring your own agent | Included | Claude, Cursor, Codex, Copilot, OpenCode, homegrown |
| Per-user auth, including client credentials per user | — | Included |
| Credentials in a vault, BYOK and external KMS | — | Included |
| Customer-controlled encryption key rotation | — | Included |
| MCP traffic and OAuth via your own HTTP proxy | — | Included |
| Per-user and per-org rate limits | — | Included |
| Org IP allowlist | — | Included |
Guardrails and enforcement
| Capability | Free | Enterprise |
|---|---|---|
| Action-level permissions inside each tool | — | Per tool, per action, per condition |
| PII redaction and prompt-injection protection at runtime | — | Included |
| Guards on prompts, not just tool calls | — | Included |
| Guards on Anthropic inference calls | — | Included |
| Guard Hooks: enforcement in the client, outside the gateway | — | Claude Code, Cursor, Codex |
| Prompt guards on web AI | — | ChatGPT, Claude, Gemini, M365 Copilot, DeepSeek |
| Encoded content decoded before guard checks | — | base64 and hex |
| Allowed AI Tools per MCP, enforced in the gateway | — | Included |
| Unmanaged MCPs and skills blocked in the client | — | Included |
| High-risk skills held until they clear a risk threshold | — | Included |
| Bulk disable, approve or annotate MCP tools | — | Included |
| Blocked users see the reason and can request access | — | Included |
| Approvals in Slack, or interactively in the AI client | — | Included |
| MCP versioning with revert, and draft mode for edits | — | Included |
| Identity risk score from CrowdStrike, usable as a guard condition | — | Included |
| Vibe apps governance | — | Lovable, Bolt, Base44 |
Discovery and fleet coverage
| Capability | Free | Enterprise |
|---|---|---|
| Shadow AI discovery: unsanctioned agents, MCPs and skills | — | Browser extension and endpoint agent |
| Local and stdio MCPs seen, not just remote | — | Included |
| Agent memory discovery per user | — | Included |
| Extension deployed via MDM, no per-employee install | — | Included |
| Radar: KPI scorecard with coverage caveats and drill-downs | — | Included |
| Risk scoring on skills, with reasoning exposed | — | Included |
Background agents
| Capability | Free | Enterprise |
|---|---|---|
| Agents that fire on a trigger and run the job to completion | — | Included |
| Triggers | — | Slack, webhooks, schedules, alerts |
| Runtimes | — | Claude Managed Agents, AWS AgentCore, Cursor Cloud Agents, kagent, your own harness |
| Each agent scoped to the tools its job needs, with its own audit trail | — | Included |
| Agent-owned credentials per integration | — | Included |
| Harness pull mode: agents poll, no inbound webhook exposed | — | Included |
| Dedicated Slack app per agent | — | Included |
Token analysis and optimisation
| Capability | Free | Enterprise |
|---|---|---|
| Token and model spend per user, per tool and per device | — | Included |
| Model breakdown and agent hours by repository | — | Included |
| Fleet-wide spend, including local and stdio MCPs | — | Included |
| Token usage policies enforced client-side | — | Claude Code, Cursor, Codex |
| MCP output payload and format optimisation | — | Included |
| Skill token analysis | — | Included |
| Optimize view with recommended actions | — | Included |
Enablement
| Capability | Free | Enterprise |
|---|---|---|
| Self-serve portal: employees connect tools without a ticket | Basic | Full, with per-page visibility config |
| Governed marketplace of connectors, skills and plugins | — | Curated per group |
| AI Champions manage their own team's toolkit | — | Included |
| Provision a group and everyone gets the tools, no setup | — | Included |
| Push skills and plugins to the fleet | — | Included |
| Verified badge and signing for plugins and skills | — | Included |
| Skill and plugin sync from GitHub or Bitbucket | — | Included |
| Claude Code policy console with MDM export | — | Included |
Audit and observability
| Capability | Free | Enterprise |
|---|---|---|
| Audit trail: every action tied to a real human | Limited | Immutable, timestamped, queryable |
| Covers user actions, admin actions, HTTP and stdio calls | — | Included |
| Log streaming | — | Splunk, Loki, Grafana, CrowdStrike, Panther, S3, webhook |
| OpenTelemetry export from Claude Code and Codex | — | Included |
| Adoption analytics: weekly active users, top tools, by group | — | Included |
| Blocked versus passed action reporting, per guard | — | Included |
| Analytics explorer and custom dashboards | — | Included |
Deployment
| Capability | Free | Enterprise |
|---|---|---|
| SaaS | Included | Included |
| EU cluster, fully EU-managed | — | Included |
| Self-hosted in your cloud | — | AWS, GCP, Azure |
| On-premises and air-gapped | — | Included |
| Hybrid gateway | — | Included |
Support and terms
| Capability | Free | Enterprise |
|---|---|---|
| Support | Standard | Priority, dedicated account management |
| Onboarding | Self-serve | Guided POV |
| Compliance | — | SOC 2 Type II, GDPR-Ready, current penetration test report |
| Security review support, DPA and sub-processor list | — | Included |
| Billing | — | Annual, AWS Marketplace |
Deploy where compliance requires
SaaS
Live the same day.
EU cluster
Fully EU-managed.
Self-hosted
Your cloud: AWS, GCP or Azure.
On-premises & air-gapped
Full isolation for regulated industries.
Audit logs stream to Splunk, Loki, Grafana, CrowdStrike, Panther, S3 or a webhook, and OpenTelemetry exports to any OTLP backend.
A POV with no cost and no internal headcount
Visibility
Identity
Tools
Live & readout
FAQS
Everything you need to know about Willow pricing and platform
Your agents are already in the wild.
Give them a Basecamp. Go from AI chaos to AI work, in minutes.
