Speakeasy Gram (speakeasy-api/gram) is the AGPL-3.0 open-source stack behind Speakeasy’s AI control plane: an enterprise MCP gateway that gives every team one governed path to MCP servers, provisioning access by role from the identity provider the company already runs and enforcing policy on every prompt, response, and tool call in flight.
Its thesis follows a pivot the vendor names out loud: the 2025 launch framed building and hosting MCP servers as the hard problem, and a year of that taught Speakeasy the actual hard problem was auth, observability, and distribution, so the product re-centered on the gateway where identity, policy, and audit live.
What it is #
The open-source repository holds the full stack (a Go backend on the Goa design-first framework, a TypeScript dashboard, Temporal for workflows, Polar for billing, OpenRouter as the LLM gateway), and ./zero brings the whole thing up locally with Mise and Docker, seeding a realistic org with sessions, telemetry, and risk findings.
The commercial form is the hosted platform at app.getgram.ai, and an enterprise self-host option runs in your own cloud or on-premises, on Kubernetes, with customer-managed KMS keys and, since 2026-10-13, gateway nodes reachable only on your own Tailscale tailnet.
Four products share one identity, policy, and audit trail: the MCP gateway (distribution with RBAC at team, server, and tool granularity, synced from Okta, Entra ID, or Google Workspace over SCIM), agent identity (Speakeasy acts as the OAuth 2.1 authorization server and brokers upstream credentials, so agents never hold vendor API keys), agent security (inline detectors for secrets, PII, financial data, government IDs, and health data, plus custom CEL and plain-language rules), and agent observability (OpenTelemetry token and cost tracking per team with budgets).
Policy actions are log, warn or confirm, deny, or quarantine the session, with the admin choosing fail-open or fail-closed, and every allow-or-deny decision lands in a searchable audit trail that streams to Slack, PagerDuty, or a SIEM.
Agent hooks (Anthropic hooks, LiteLLM, Cursor hooks, and a device agent for macOS, Windows, and Linux) extend enforcement into the session itself, covering prompts, shell commands, and file edits a gateway alone cannot see.
The vendor holds SOC 2 Type II and ISO 27001 certifications and publishes GDPR, CCPA, and HIPAA BAA postures for the hosted platform.
Status #
Active and vendor-backed: 277 stars, 36 forks, and 322 open issues as of 2026-11-05, created 2025-08-06, pushed 2026-11-05, with the npm release train moving in the same week ([email protected] and 0.3.42 on 2026-10-29, 0.3.43 on 2026-11-04). The gateway shipped as a pivot: Hacker News saw Gram launch on 2025-09-09 as an open-source platform to create, curate, and host MCP servers (20 points, 2 comments), and a third-party governance wiki places the gateway’s general availability in March 2026 with the control-plane framing, after Speakeasy concluded building servers was not the hardest problem. MoonPay is the named production customer, with the vendor claiming 60,000 agent sessions governed per week, though the same third-party profile cautions that homepage logos may date from the SDK-generation business rather than the control plane. The community footprint is thin in discussion (the launch thread’s two comments and a 23-point, zero-comment Show HN for Gram Functions in November 2025) but present in coverage: independent directory profiles from a governance wiki, Toolglade, and FollowAgents exist, and the governance wiki’s entry is openly skeptical.
Strengths #
- The credential-brokering identity layer is the strongest in this category’s gateway half: agents authenticate to the gateway, the gateway strips their credentials and applies upstream ones, so no agent ever holds a vendor API key.
- Policy runs in flight on every prompt, response, and tool call, with quarantine and an admin-selected fail-open or fail-closed default, and the agent hooks close the gap a pure gateway leaves open inside the session.
- The compliance surface is enterprise-grade and unusual for an open-source-stack product here: SOC 2 Type II, ISO 27001, HIPAA BAA, self-host with customer-managed keys, and Tailscale-only gateway nodes for closed-network deployments.
- OpenTelemetry-based token and cost attribution per team turns usage into budgets and tool-effectiveness data instead of an end-of-month invoice surprise.
Cautions #
- AGPL-3.0 means the self-hosted stack is free to run but modifications offered over a network trigger source-disclosure obligations, which some shops treat as a blocker.
- It is a mid-pivot product: the governance offering is about a year old, the roadmap still lists agent identities as early access and MCP catalog and spec-version support as planned, and the third-party profile warns that most capability detail comes from Speakeasy-authored comparison posts, so verify claims in a pilot.
- Self-hosting the stack is genuine infrastructure work (Mise, Docker, Temporal, database migrations, multiple services), not a quickstart; the hosted path is the low-effort form.
- On the hosted platform your prompt and tool-call content transits and is stored by Speakeasy, and the third-party profile records retention periods and training-use terms as unverified.
- The pricing FAQ and plan cards disagree at the edges (the FAQ says both tiers carry the same logs while the Enterprise card lists “full audit trail”), so read the billing page carefully before budgeting.
Pricing #
The open-source stack is AGPL-3.0 and free to run yourself. The hosted control plane is usage-based with no platform fee, as of 2026-11-05: $0.35 per million tokens of agent session storage, $0.99 per million tokens scanned for risk, and $20 per GiB of MCP gateway egress, with model-provider inference passed through at cost; a trial precedes pay-as-you-go billing. Enterprise is tailored annual pricing on tokens under management, adding SSO, a full audit trail, SLA-backed support with a forward-deployed engineer, and legal and security reviews.
Price history #
| Date | Plan | Change | Source |
|---|---|---|---|
| 2026-11-05 | Pay as you go | First recorded: $0.35 per million session-storage tokens, $0.99 per million risk-scanned tokens, $20 per GiB gateway egress, no platform fee | |
| 2026-11-05 | Enterprise | First recorded: tailored annual pricing on tokens under management |
Compared to #
- IBM ContextForge: the Apache-2.0 self-hosted gateway federating MCP, A2A, and REST behind one door, with guardrails delegated to plugins; Gram is the AGPL stack with in-flight policy, identity brokering, and a hosted tier built in, so choose ContextForge for an OSI license and full control, Gram when identity and policy must ship in the door.
- Microsoft Agent Governance Toolkit: governance wired into application code across five languages; Gram requires no code change because agents point at the gateway, so choose the toolkit when your agents are in-house code and Gram when they are off-the-shelf tools you cannot modify.
- Cordum: holds a job at dispatch until a human approves; Gram governs tool traffic continuously at the request boundary, so they answer different questions (may this job run at all versus may this tool call flow).
Bottom line #
Recommended for platform teams standardizing one governed door for MCP tool traffic, with enterprise identity, in-flight policy, and per-team cost attribution, who accept either the AGPL self-hosted stack or a usage-priced hosted plane. Not for teams that need an OSI-approved license, a lightweight local gate on one machine, or independently verified enforcement claims, because the technical detail is largely vendor-authored and the skeptical coverage says so.
Changes #
- 2026-11-05 - Created from the coordinator’s cross-category handoff, resolving the candidate into the category per the vendor-sibling-and-full-bar run duties: the admission supersedes the 2026-10-10 closed-tier reading of Speakeasy’s control plane, which predates this run’s check of the public AGPL-3.0 stack behind it, and supersedes the 2026-10-28 MCP-platform-kind deferral with a full citation bar.
See also #
- Control Planes Feature Matrix - the category comparison this note joins
- IBM ContextForge - the Apache-2.0 self-hosted gateway this most directly parallels
- Microsoft Agent Governance Toolkit - the in-code governance alternative when the agents are your own code
- Cordum - the dispatch-time approval gate at a different enforcement point
- Model Context Protocol (MCP) - the protocol whose traffic this gateway governs
References #
https://github.com/speakeasy-api/gram - README: the open-source stack, the four-product framing, the ./zero local path, the tech stack, and the license
https://api.github.com/repos/speakeasy-api/gram - stars, forks, issues, creation and push dates as of 2026-11-05
https://www.speakeasy.com/pricing - the usage-based rates, the Enterprise tier, and the billing FAQ
https://hn.algolia.com/api/v1/items/45183612 - the September 2025 launch thread (20 points, 2 comments) with the pre-pivot MCP-hosting framing
https://druce.ai/governance/wiki/vendors/speakeasy - the critical third-party profile: the pivot history, gateway GA in March 2026, the logo-attribution gotcha, AGPL network-service disclosure, and unverified retention terms