Skip to main content
    Reign OpsAI substrateMCP and tool operations

    Every tool an agent can reach, and the proof of what it did.

    MCP servers, tool registries, third-party integrations and in-house tool servers, operated as one governed supply chain. Policy is evaluated before an agent binds a tool, and every binding is recorded.

    Delivered as a single-tenant dedicated instance, in infrastructure iTmethods operates or in your own cloud account on AWS or Azure. Both are available today. Air-gapped and sovereign are in development.

    The decision you are actually making

    Every model that can call a tool is a new way into your systems.

    MCP is spreading through the enterprise faster than anyone is governing it. Most organizations cannot say which agents are calling which tools, with whose permissions, against which data.

    01Reach is the thing being decided
    An agent's reach should be something you define and can show, not something you discover after the fact.

    As MCP becomes the default way models act on the world, that operational control is what separates a useful agent from an ungoverned one.

    02The tool layer is a supply chain
    Third-party MCP servers are software you did not write, running with permissions you granted, against data you are accountable for.

    Treating it as a supply chain rather than a feature is what makes signature, provenance and drift detection obvious rather than optional.

    03Policy has to apply before the binding
    Evaluated at the moment an agent asks to bind a tool, not reviewed in a report afterwards.

    Afterwards is a description of what happened. Before is a control.

    04Power without the operational burden
    The hardening, the access control, the logging, the availability and the incident path all land on somebody.

    That is the part Reign Ops takes. Your engineers keep the tools and the agents.

    Scope

    Seven capabilities, one governance contract.

    The full tool-operations surface, and the same contract whether the server is one of ours, a third party's, or one your team wrote.

    CapabilityWhat it means in operation
    MCP server hostingManaged runtime with policy enforcement applied at the call boundary, operated inside your authorization boundary.
    Tool inventory and registryEvery tool an agent can bind, with its version, owner, classification and risk tier. The inventory is the thing most estates do not have.
    Third-party integrationsVetted and sandboxed onboarding with supply-chain review before anything is bindable.
    In-house tool serversFirst-party tools under the same governance contract as third-party. No private route around it.
    Supply-chain controlsSoftware bill of materials, signature and provenance checks, and drift detection across the catalog.
    Tool-call governancePolicy evaluated before an agent binds. Every binding logged, including the ones that were refused.
    Lifecycle operationsDeprecation, rotation and incident isolation across the tool surface, so removing a tool is an operation rather than an archaeology project.
    What it runs against

    The systems agents actually ask for.

    CategoryServers we operate
    EngineeringAtlassian GitHub GitLab Jenkins JFrog Artifactory SonarQube
    DataPostgreSQL MySQL MongoDB Redis
    CloudAWS Azure GCP
    CommunicationSlack Microsoft Teams
    YoursInternal systems Custom MCP servers Proprietary APIs

    Not seeing your system? Custom MCP servers for internal or third-party systems are part of the same contract. Tell us what it is →

    What Reign Ops applies on day one

    Hardened before anything can bind to it.

    Applied at deployment rather than negotiated per server, and the same for a server we host as for one you wrote.

    Every call is authenticated and scoped.

    Bound to an identity from your provider. There is no anonymous tool call and no shared service account standing in for one.

    Sandboxed at the tool-call boundary.

    What a server can reach is set before it is bindable, rather than inferred later from what it reached.

    Provenance on every tool definition.

    Bill of materials, signature and provenance checked on the way in, and drift detected across the catalog afterwards.

    Refusals are recorded too.

    A binding that policy declined is as much a part of the record as one it allowed, and it is usually the more interesting half.

    Attestation status and the standard pack for procurement are released on request under non-disclosure rather than asserted here. Security and trust → · Regulatory alignment →

    Better together

    Operating the tool layer is one job. Governing what crosses it is another.

    Reign Ops runs the servers, the registry and the supply chain. Reign Gateway is what sits on the call path and applies the policy. The two were designed to meet at the tool boundary, and the record is written once rather than assembled from both.

    What the record carries
    For each binding: what the agent asked to bind, the identity it asked as, the policy that applied, whether it was allowed, and what it did once bound. For each refusal: the same, plus the rule that refused it. Written at the moment of the call rather than reconstructed from logs afterwards.
    The part worth being precise about. This is a record of tool activity, prepared so a reviewer can follow it. It is not a verdict on whether a tool is safe, and it does not make an unvetted server vetted. iTmethods makes no compliance, certification or accreditation claim under any framework. How the boundary works → · Regulatory alignment →
    Shared responsibility

    What we run, what you run.

    Written down before anything is deployed, so the boundary is a document rather than a discovery.

    WhoWhat they hold
    Reign Ops, automatedOperate the MCP servers, the registry and the supply-chain controls inside your authorization boundary. Authenticate and scope every call. Sandbox at the tool-call boundary. Check signature and provenance on the way in and detect drift after. Record every binding and every refusal. Handle deprecation, rotation and incident isolation.
    Customer authoredWhich tools are sanctioned and which agents may bind them. The classification of the data each tool reaches. Risk tier and owner for each entry in the registry. What a policy exception means and who may grant one.
    Operating partner engagementOnboarding servers in scoped waves rather than all at once. Supply-chain review on third-party servers before they are bindable. Authoring the first policy set with your team. The periodic review of the catalog, including what should be removed.
    Before the scoping call

    The questions that arrive every time.

    Can you run a server we wrote ourselves?
    Yes, under the same governance contract as a third-party one. First-party tools do not get a private route around policy, which is the point of having one contract rather than two.
    How long does it take to get a server running?
    You tell us which systems need tool access, we assess the requirements and the controls that apply, we provision and harden, and your agents connect. The variable is almost always the access review on your side rather than the provisioning on ours.
    What happens when a tool has to be pulled?
    Deprecation, rotation and incident isolation are part of the operating contract. A tool can be made unbindable across the estate without hunting for who was using it, because the registry already knows.
    Which deployment shapes can we have?
    A single-tenant dedicated instance, in infrastructure iTmethods operates or in your own cloud account on AWS or Azure. Both are available today and both are single-tenant. Google Cloud is planned for 2027. Air-gapped and sovereign are in development. There is no multi-tenant or shared option at any tier. Deployment options states which is which without softening any of them.
    What does it cost?
    Scoped per engagement. This site publishes no price list and no tiers, because what we would operate for you is the thing being priced and it is different every time. The scoping call is where that gets answered, and it commits you to nothing.
    FINOS Agentic AI Foundation, Silver member
    Member and contributor in the open standards behind governed AI, including the work on how agents and tools are governed.
    Next step

    Tell us what your agents are already reaching.

    Which tools, which agents, and whether anyone can currently say which is calling which. We will come back with what we would take on first and what we would leave alone.