MCP tools multiply faster than governance can keep up

Every AI agent we shipped needed the same missing layer: a governed way to reach the tools, data sources, and internal systems it depends on. Model Context Protocol (MCP) made it easy to expose a tool to an agent. It did not make it safe to expose that tool without oversight.

In a regulated enterprise, that gap isn’t cosmetic. Every ungoverned MCP server an agent can reach is a new integration point with no audit trail, no policy enforcement, and no single place to see what an agent is actually allowed to touch.

Qantara (قنطرة — arch bridge) is IOTA’s answer: a fully on-prem control plane through which every AI interaction in the organisation crosses — model traffic, tool traffic, and the governance around both. It is built on the open-source ToolHive runtime with a bespoke layer for data sovereignty, air-gapped deployment and Arabic-first workloads.

It’s four components working as one system:

• MCP Registry — a single, versioned catalog of every tool an agent is allowed to discover, approved before it’s ever reachable.

• MCP Gateway — enforces policy at the moment of the call: who can invoke which tool, with what data, under what conditions.

• MCP Runtime — isolates tool execution so a compromised or misbehaving tool can’t reach beyond its sandbox.

• AI Gateway — the single ingress for every model and agent request, giving one place to observe, rate-limit, and audit AI traffic across the enterprise.

The result is a platform IOTA runs its own products on first: iChat’s tool calls, and every future IOTA agent, pass through Qantara before they touch anything real.

Technology stack

• Model plane: Envoy AI Gateway as the data plane, with a Qantara control plane written in Go — model routing, team budgets, a PostgreSQL spend ledger, inline policy enforcement and OpenTelemetry audit

• Tool plane: the ToolHive operator on Kubernetes — an MCP Registry for discovery and governance, a Virtual MCP Server that aggregates tools behind one endpoint, and isolated MCP server runtimes with hardened profiles

• Policy: Cedar policy packs enforced inline on every tool call

• Model serving: in-cluster vLLM, with adapters for Azure, AWS and GCP endpoints where an institution allows them

• Identity: one shared OIDC issuer across the model plane and the tool plane, with an embedded admin console for models, teams and budgets

• Packaging: Helm charts, images from the customer’s own OCI mirror and offline catalog bundles — air-gapped by default

• Catalog: a curated regional MCP catalog on the open MCP Registry schema

Status

Qantara is in development. The AI Gateway control plane is implemented end to end, and the registry, tool gateway and runtime are deployed and verified by an automated acceptance test on a Kubernetes cluster: completions route by model, usage lands in the ledger at catalog prices, exhausted budgets and disallowed models are refused, and the registry serves the curated catalog plus auto-discovered servers. Feature parity against commercial AI gateways is tracked in the repository.