Give your AI every app, not every permission

Yes, a hosted one. Every call from Claude, ChatGPT, Cursor, Microsoft Copilot or any MCP client passes through Elaichi, which checks the caller's roles and restrictions before the call leaves and writes every call that runs to the audit log. Unlike a gateway you deploy in front of servers you run, Elaichi also runs most of its 650+ connectors itself, so there is nothing to host. Vendors' own MCP servers, and a remote MCP server your company runs, go through the same gateway under the same rules.

Four steps. Connect: pick from 650+ connectors and finish a hosted connect flow, where credentials are vaulted and encrypted. Compose: every connection instantly becomes a toolbox of MCP tools, or you curate a template toolbox with renamed tools, frozen parameters, and defaults. Authorize: point Claude, ChatGPT, Cursor, Microsoft Copilot (through a Copilot Studio agent) or any MCP client at the one org-wide endpoint and sign in with OAuth. No per-toolbox URL and no embedded token. Govern: roles decide who can do what, restrictions decide which tools are even visible, and every call lands in an append-only audit log.

You share a capability, not a password. A shared toolbox can expose the sharer's connection: recipients call the third-party API through it without ever seeing credentials, and cannot step outside the tools and parameters you fixed. Every call is clamped server-side by the toolbox's tool list, frozen parameters, and restrictions.

Yes, and restrictions work on individual tools rather than whole applications. Set an allow or block rule on a role or on one person, and a person-level rule can only narrow what the role allows. A restricted tool is left out of the model's tool list and cannot be called. If the model searches for it, it sees only the name, marked restricted.

Yes, with automations. A schedule, an incoming event, or a message starts a sequence of steps that call tools, transform results, branch, wait, and pause for a person to approve the ones that matter. Each call a workflow makes follows your restrictions and lands in the audit log. Workflows, collections and live dashboards come with the Black plan, which you can try free for 14 days.

Any MCP client that speaks Streamable HTTP. Claude, ChatGPT and Cursor connect directly, Microsoft Copilot connects through a Copilot Studio agent, and the Elaichi Agent works inside the app. Elaichi MCP endpoints speak standard MCP JSON-RPC (initialize, tools/list, tools/call). Setup is one URL and an OAuth sign-in — no bridge command, no API key, and no credential in the address.

Frozen parameters are tool arguments fixed by the toolbox curator and stripped from the schema the model sees. They are force-merged at execution time, so the AI cannot override them, though it may see them. You can freeze a Google Drive tool to one specific folder, and the agent can only ever query that folder.

Connected tools are never listed one by one, however few you have. In their place the endpoint advertises two meta-tools, search_tools(query) and execute_tool(name, arguments), and Elaichi's own catalog operations stay listed individually. A short tool list makes a model choose better, and this one stays the same size however many applications you connect.

Nobody you share an app with ever sees its login. Third-party credentials are held in a dedicated credential vault, encrypted at rest with AES-256-GCM, and are never returned by the API, not to users, not to admins, not to agents. Session, API, and MCP tokens are stored as keyed hashes and shown only once.

Yes. Custom connectors let you author a connector from a JSON config with base URL, auth, resources, and methods, or fork any of the 650+ public connectors, including its documentation. Forks track upstream lineage, so you can review and selectively pull upstream improvements later.

Self-hosted MCP servers multiply credentials, have no shared governance, and leave no audit trail. Elaichi centralizes connections with vaulted credentials, lets admins choose what each role can reach, enforces that everywhere a tool can be reached or run, logs every tool call that runs, and lets admins revoke a person's access at once.