Compliance & human-in-the-loop for MCP servers
tokyn.trail sits in front of your existing or new MCP server: every tool call is recorded gap-free, and critical actions - say a refund above €100 - wait until the right human approves them. Via signed email link or straight from Slack. Integrated in 10 minutes without changing a line of code.
Free plan · no credit card · live in 10 minutes
The problem
MCP
Scalable Capital, ElevenLabs and more are opening their products as MCP servers - customers talk to the interface directly through ChatGPT and Claude. The standard is here, the wave is rolling.
modelcontextprotocol.ioBlind spot
The MCP specification itself recommends human approval only as a "SHOULD" - none of it is mandatory. What an agent triggers through your MCP, nobody sees today before it happens. And afterwards, the evidence is missing.
MCP specification ("SHOULD")Art. 14
The EU AI Act demands effective human oversight - logs prove something happened. Not that a human answered for it.
EU AI Act Art. 14tokyn.trail turns “the agent can do anything” into “the agent can do exactly this - and asks a human for the rest”.
Use cases
Four typical use cases - each with the MCP rule tokyn.trail enforces. The section below answers which norm stands behind it.
The support agent issues refunds
Your AI agent resolves complaints on its own - until money moves. Above your threshold, tokyn.trail holds the call and the team lead decides via email approval in seconds.
refund_order · amount > €100 → approve: teamlead
Customers talk to your product through ChatGPT
Your MCP server is public - you see live which agent triggers what. Destructive tools like cancellation or data export stay approval-gated, new tools automatically.
cancel_subscription → approve: account-owner
Payouts only with four eyes
The accounting agent prepares payment runs; execution waits for two independent approvals - with a deadline, provable forever in the hash chain.
create_payout → approve ×2: cfo, controlling
The agent never deletes alone
Maintaining the CRM, deactivating accounts, cleaning up records: runs automatically - unless it is irreversible. Then the call waits for a human, and without an approval it expires.
delete_record → hold · Freigabe: on-call
Compliance
What auditors, internal control and data protection officers ask - and what tokyn.trail answers:
EU AI Act Art. 14
“How do you ensure effective human oversight?”
Enforcement instead of convention: critical tool calls are physically held until an authorized human decides - no matter which agent or model hits your MCP.
ISO 42001 · internal audit
“Can you evidence every decision, gap-free?”
Every approval, rejection and rule change lands in a SHA-256 hash chain. Oversight report as PDF/CSV with the verification result - attach it to the audit as-is.
GDPR Art. 28
“Where does the data live, is there a DPA?”
Hosted exclusively in Frankfurt, encrypted at rest, DPA included, data export and deletion at any time. Never shared with third parties.
Internal control practice
“Do critical operations follow the four-eyes principle?”
Configurable per rule: two independent approvals, deadlines with a defined outcome, role-based responsibility - all documented in the evidence.
No fantasy badges: we show what the product technically enforces - your audit produces the certificate list, not our marketing. And to stay honest: Art. 14 obligates you as the operator. tokyn.trail provides the technical control and the evidence - risk management, documentation of the overall system and the competence of your oversight staff remain your job.
How it works
Connect - or create
Point your existing MCP server through the tokyn.trail proxy URL - or generate a new MCP server from your API description in minutes. Monitor mode: nothing is blocked, but for the first time you see what runs through your MCP.
Set MCP rules - one click per tool
Allow, Approve or Deny - auto-generated from your tools, refined with conditions: “refunds above €100 need approval”, “deletions never run automatically”, “deletions always need approval”.
Approve wherever you are
Approve or reject with one click via the signed email link or the Slack buttons. Decided in seconds, provable forever in the hash chain. The auditor report is one click.
Monitor mode blocks nothing and costs nothing - it just shows what already runs through your MCP server today. Most teams have no idea.
Invest 10 minutes nowThe toolkit
Complete tracking of your MCP
Every tool call with arguments, agent, result and timestamp - visible live and chained tamper-evident. You see what ChatGPT, Claude and friends actually do on your interface.
Human-in-the-loop rules your team maintains itself
A triple switch per tool plus a visual condition builder from your tools’ schemas. New or changed tools require approval automatically - rug-pull protection included.
Approvals on the decision-maker’s channel
Signed email links to verified addresses, plus Slack buttons and the in-app inbox. Every decision is recorded with channel and recipient in the evidence. More channels to follow.
The report that passes the review
Oversight report with hash-chain verification on the cover, activity report with your enforce-readiness rate. PDF and CSV, one click or API.
Your API description becomes an MCP server in minutes - one your customers talk to through ChatGPT or Claude, with tracking, rules and human approvals from the very first call. What Scalable Capital and ElevenLabs are demonstrating, any company with a public API can do.
Pricing
Monitor mode free and unlimited, Pro per MCP connection, Enterprise per organization - no quotas, cancel monthly, prices in euros.
monitor
0 €
observe without limits
pro
129 €
/month per MCP connection
enterprise
590 €
/month per organization
FAQ
get started
Connect or generate, watch monitor mode, toggle rules - no risk, no credit card, no code changes.
Free plan · no credit card · live in 10 minutes