Features
Everything your platform team needs to govern AI tooling
One control plane, deployed on your infrastructure, sitting between your people and every MCP server, skill, and agent they use.
01
MCP server registry
Register every MCP server your organization runs in one place. See what each one exposes before anyone connects to it.
02
Tool-level permissions
Allow, block, or flag individual tools within a server — not just the server as a whole. A database server's read tool and its delete tool are different decisions.
03
Skill & agent distribution
Publish skills and agents to a catalog your organization pulls from, instead of passing configs around by hand. Update once, roll out everywhere.
04
Telemetry & audit log
Every call through the control plane is recorded — tool, server, caller, outcome. Answer "what did our AI tools do last week" without guessing.
05
Per-team and per-role policy
Different teams need different access. Scope policy to a team, a role, or an individual without maintaining a separate deployment for each.
06
Self-hosted control plane
Self-hosted, on your infrastructure. Your policies, telemetry, and credentials never leave your network.
Governance in practice
Permissions that match how tools actually get misused
Most incidents don't come from the tool being present — they come from the tool being able to do more than it should have been allowed to.
~/meshum · tool access
| read | write | exec | delete | |
|---|---|---|---|---|
| filesystem | ✓ | ✓ | – | – |
| postgres | ✓ | • | – | – |
| github | ✓ | ✓ | • | – |
| slack | ✓ | • | – | – |
- pagerduty / readallowed
- github / readallowed
- github / writeallowed
Distribution
A skill declares what it needs. Meshum checks it against policy.
Skills and agents declare the servers and tools they depend on. Meshum won't distribute a skill to a team whose policy doesn't already allow what it asks for.
Architecture
Your infrastructure, your control plane
Meshum is self-hosted. It sits between your people and every MCP server, skill, and agent — enforcing policy and recording telemetry on every call.
control plane