Agentic Fabriq: Features, MCP Gateway, and Pricing (2026)

Agentic Fabriq is an identity and permissioning platform for AI agents. It sits between an agent and the tools it calls, carrying user identity into each request, enforcing access policies, managing credentials, and recording what happened.

That makes it different from an agent framework. Agentic Fabriq does not decide how an agent reasons or which task it should perform. It controls what the agent is allowed to access and do once it chooses an action.

The company was founded in 2025 and joined Y Combinator's Winter 2026 batch. This guide looks at the product as it exists in September 2026: how it works, where MCP fits, what it costs, and when adding it to an agent stack makes sense.

What Problem Does Agentic Fabriq Solve?

Imagine a support agent that reads a customer's record, checks an order in Stripe, and sends a follow-up through Gmail. Giving it the ability to call those tools creates several questions:

• Which agent made the request?
• Which user was it acting for?
• Does that user have permission to perform this specific action?
• Where are the user's OAuth tokens stored?
• Can access be revoked without redeploying the agent?
• Is there a reliable record of allowed, denied, and approval-gated calls?

A shared service account answers few of them. It gives every user the same authority, leaves credentials in application infrastructure, and makes actions difficult to attribute. Adding an OAuth library solves the login flow, but not agent-level policies or a unified audit trail.

Agentic Fabriq puts a gateway in the middle. According to its documentation, every request is associated with both an agent and an acting user. Fabriq checks that pair against live policy before passing the call to the destination tool.

How Agentic Fabriq Works

A typical developer flow has five parts:

1. Register the application or agent. Define its identity and the maximum tool scopes it can request.
2. Connect each user's accounts. The user completes a hosted OAuth consent flow for services such as Gmail, Slack, or GitHub. Fabriq stores the resulting credentials in its vault.
3. Mint a short-lived, user-scoped token. Your backend identifies the user with an ID from your own application; the Fabriq app secret remains server-side.
4. Call tools through the gateway. The agent uses the Python SDK or a single MCP endpoint to discover and invoke only the tools available to that user.
5. Enforce and record the call. Fabriq checks the requested action, injects the provider credential server-side, forwards an allowed call, and writes the result to the audit trail.

The important boundary is step five. A system prompt can ask an agent to respect a policy, but prompts are instructions rather than security controls. Fabriq evaluates permissions outside the model at the tool-call boundary.

Core Features

Agent and User Identity

Each request represents an agent acting for a particular user. The effective permission is the overlap between what the agent has been granted and what that user can already do. If the agent is allowed to issue refunds but the current user is not, the request remains blocked.

For shared internal agents, permissions can vary by organization, team, member, and individual action. The same deployed agent can therefore be read-only for one employee and have narrowly scoped write access for another.

Governed MCP Gateway

Agentic Fabriq exposes connected tools through one governed Model Context Protocol endpoint. The gateway builds the available tool list for the current user, so a prohibited tool can be hidden rather than merely rejected after the model selects it.

The integration catalog includes services across Google Workspace, Microsoft 365, messaging, developer tools, CRM, support, and data. Teams can also add an OpenAPI service, an existing MCP server, or a guarded Postgres connection.

Credential Vault and OAuth Brokering

Users authorize their own accounts, while access and refresh tokens stay in Fabriq's credential vault. Credentials are injected when a call is forwarded, rather than returned to the agent or stored in the product's database. The platform also handles refresh and revocation.

This is especially useful for customer-facing agent products. A developer can let every customer connect a separate Gmail or Slack account without building and maintaining a token store for every provider.

Policy Enforcement and Approvals

Fabriq uses default-deny grants and can apply permissions down to individual actions. Policy is read for every request, so changing a grant affects the next call without an agent redeploy. Sensitive actions can also be routed through approval flows in the enterprise product.

Audit Trail

Each call can be recorded with the acting user, agent, tool, action, and verdict. This creates one trail across tools instead of forcing a security team to reconstruct activity from separate provider logs.

An audit trail does not make an agent compliant by itself, but it gives teams the attribution and evidence needed for incident review and their own compliance controls.

Is Agentic Fabriq an MCP Server?

Yes, Agentic Fabriq provides an MCP endpoint, but describing it only as an MCP server misses the main value.

| Layer | Primary job | |---|---| | Agent framework | Plans tasks, runs models, and orchestrates agent behavior | | OAuth library | Completes authorization flows for an individual provider | | MCP server | Describes tools and gives an MCP client a standard way to call them | | Agentic Fabriq | Brokers identity and credentials, filters tools, enforces policy, and audits calls across integrations |

Fabriq can sit between any MCP-compatible runtime and many downstream tools. It can also bring an existing MCP server behind the same identity and policy boundary. In other words, MCP is the connection interface; governance is the product.

Developer and Enterprise Use Cases

Agentic Fabriq separates two common identity models:

Products Whose Agents Act for Customers

In the developer model, your application holds a Fabriq app ID and secret. Each customer connects their own external accounts through your product, and calls are scoped to the user ID you send. The customer does not need a separate Fabriq account.

This model fits an AI product that needs customer-authorized access to email, calendars, documents, messaging, or other SaaS tools.

Agents That Act for Employees

In the enterprise model, employees connect accounts through the Fabriq workspace. Admins manage permissions on shared agents, connect the organization's identity provider, and review activity in a centralized audit trail.

This model fits internal copilots, support or operations agents, and coding agents that must inherit the access boundary of the employee using them.

Agentic Fabriq Pricing

Agentic Fabriq publishes usage-based developer plans. These were the listed prices on September 11, 2026:

| Plan | Monthly price | Included calls | Notable additions | |---|---:|---:|---| | Free | $0 | 20,000 | Unlimited agents, integration hub, permissions, logs, Python SDK, CLI, and MCP endpoint | | Launch | $50 | 200,000 | Custom MCP and API tools, triggers, a dedicated realm, and email support | | Growth | $300 | 2,000,000 | Higher included usage and founder support | | Enterprise | Custom | Custom | Employee identity, SSO, organization-wide governance, and deployment options |

On paid developer plans, additional usage is listed at $2 per 10,000 calls. Fabriq counts more than downstream tool invocations: authentication, tool access, and credential requests can each count as calls. Model a complete workflow before estimating the monthly bill, and confirm the latest details on the official pricing page.

When Agentic Fabriq Is a Good Fit

Consider it when:

• Your agent acts on behalf of many different users.
• Users need to connect OAuth-based business tools.
• Shared API keys or broad service accounts are no longer acceptable.
• Permissions must differ by agent, user, and action.
• Security teams need centralized attribution, revocation, and audit records.
• Several agent runtimes should reuse the same governed integrations.

It may be unnecessary for a prototype that calls only public APIs or uses one tightly scoped, application-owned credential. It is also not a replacement for orchestration, evaluation, prompt security, or human review of genuinely high-impact decisions.

What to Evaluate Before Adopting It

Agentic Fabriq becomes part of the critical path for tool calls, so evaluate it like other identity infrastructure:

1. Connector coverage: Does the catalog expose the exact actions and scopes your workflow needs?
2. Policy model: Can you express resource and approval boundaries precisely enough for your risk level?
3. Failure behavior: What happens to the agent when the gateway, identity provider, or downstream service is unavailable?
4. Credential and data requirements: Does the managed cloud meet your security and residency needs, or do you need the custom self-hosted option?
5. Usage economics: How many Fabriq calls does one end-to-end user task generate?
6. Observability: Can you export the records your incident response and compliance processes require?

The Bottom Line

Agentic Fabriq addresses a problem that appears when an AI demo becomes a multi-user production system: the agent needs real capabilities, but it should never receive more authority than the person it represents.

Its strongest fit is not “make my agent smarter.” It is “let my agent use real tools without handing it raw credentials or relying on prompts as permission checks.” For teams facing that problem, the combination of per-user identity, a governed MCP gateway, credential brokering, and centralized audit logs is worth evaluating.

A

Agentic Fabriq

Agent orchestration platform with managed tool access and OAuth