Control what every AI agent can access.
Tier Two sits between your agents and the systems they call. Every tool call gets a policy decision and a record.
npx -y tiertwoOne command. It finds the systems your agents already use and opens the browser to sign in.
Works with
- Claude Code
- Cursor
- VS Code
- Codex
- Windsurf
- Gemini CLI
- Zed
- Cline
And any other MCP client that can point at a URL.
posthog__query_insights Allow
runs now · recorded
linear__create_issue Ask
paused · waiting for dana@acme.com
github__delete_repo Block
refused · not in the agent's tool list
Three tools, three modes. You choose the mode; Tier Two enforces it and keeps the record.
Connects to
A connection is a system your agents may reach, plus a mode for each of its tools. Sign in with your own account, or provision one workspace key and let Tier Two forward the calls server-side.
- PostHogOAuth · remote
- LinearOAuth · remote
- SentryOAuth · remote
- GitHubOAuth · remote
- NotionOAuth · remote
- AtlassianOAuth · remote
- StripeOAuth · remote
- CloudflareOAuth · remote
- SupabaseOAuth · remote
- NeonOAuth · remote
- FigmaOAuth · remote
- Metabaseself-hosted
Any MCP server. Paste a URL. A connection is any MCP server plus the mode you give each of its tools.
Allow, Ask, or Block. Per tool.
Every tool a connection offers gets one of three modes. Allow runs it. Ask pauses the call for a person. Block refuses it and hides it from the agent. This is the same screen your admins use after sign-up.
Connections / Linear
Allow, Ask, or Block, per tool
Recommended is applied when you add a connection: reads run, writes wait for a person. Change any tool afterwards, or switch the whole connection to Open or Locked.
Your agents already have credentials. You just didn't issue them.
Coding agents and MCP-connected assistants are calling your internal tools today, with API keys pasted into config files and OAuth tokens nobody tracks. No directory of agents, no policy on what they may do, and no record of what they did.
Every tool the key can reach is a tool the agent can call. No decision, no record, and nothing to revoke but the key itself.
Each tool has a mode you chose. Writes can wait for a person. Every call (allowed, asked, or blocked) lands in Activity.
Four steps to the first governed call.
- 1
Connect a system
Pick it from the catalog or paste any MCP server URL. Sign in to the vendor once, or drop in one workspace key the whole org shares.
- 2
Pick a posture
Open, Recommended, or Locked. Recommended is pre-selected: reads run, writes wait for a person. Change any single tool afterwards.
- 3
Connect your agent
One command registers the endpoint in every MCP host on the machine. The first tool call opens a browser and signs you in, no key to paste.
- 4
Make the first call
Allowed calls run and are recorded. A call on an Ask tool pauses, waits for an approval, and then completes on its own.
The controls your security review will ask about.
Three modes, per tool
Every (connection, tool) pair is Allow, Ask, or Block. Blocked tools never reach the agent's tool list, so there is nothing to try.
Approvals that finish the call
An Ask pauses the call and shows the person, the agent, the tool and its arguments. Approve once, or always for that person. The waiting call completes.
Two append-only ledgers
One for calls, including the refused ones; one for every change to the governance config itself. Both export to your SIEM.
An agent directory
Every agent that has signed in: the person it acts as, the host it connected from, its live sessions, and what it called.
Revoke in one click
An agent's access is a token bound to one member of your workspace. Revoke it and the next call it makes fails.
Managed devices, optional
Install the Tier Two Client and policy can additionally require an org-managed machine for the tools that warrant it. Managed is earned through enrollment, never self-declared.
One command. Every host.
The endpoint is plain streamable HTTP MCP with OAuth. Run npx -y tiertwo, register it with add-mcp, or paste the host's own config. All three come from one file, so they cannot drift.
npx -y tiertwoRegisters the endpoint in every MCP host, finds the systems your agents already use, and opens the browser so you can connect them.
Or paste this into your agent
It will register the endpoint itself, wait while you sign in, and report back what it can now do.
Add the Tier Two MCP server to this machine: run `npx -y add-mcp https://trytiertwo.com/mcp -g -y`. If that fails, add an HTTP MCP server named `trytiertwo` with URL `https://trytiertwo.com/mcp` using this host's own MCP config. Then reconnect MCP servers and call any `trytiertwo` tool once; a browser window will ask me to sign in. Tell me when it does and wait for me. After I sign in, list the available tools and summarize what you can do. Never try to work around a tool that is blocked or waiting for approval; report it to me instead.Questions, answered.
Which agents does this work with?
Anything that speaks MCP over HTTP. One command (npx -y tiertwo) registers the endpoint in every host add-mcp knows: Claude Code, Cursor, VS Code, Claude Desktop, Codex, Windsurf, Gemini CLI, Zed, Cline, OpenCode. We have walked the whole flow end to end in Claude Code and Cursor; for the others we publish each host's own documented config from the same source file. Any other MCP client can point at the URL directly.
Do I need to install anything?
No. Tier Two is a hosted MCP endpoint. One command registers it in your hosts, finds the systems your agents already use, and opens the browser to sign in. Nothing runs on your machine afterwards, and there is no key to paste. The Tier Two Client is an optional download for teams that want managed devices.
What happens when a tool is set to Ask?
The call pauses. An admin sees the person, the agent, the tool and its arguments in Approvals and picks Approve once or Always for that person. The paused call then completes on its own. The agent does not have to ask again. If it is denied, the agent is told to report the refusal rather than route around it.
What does it cost?
Free includes up to 3 people and 3 connections. Team is $30 per person per month, billed for every accepted member. Enterprise is available under an annual agreement. See /pricing for the full comparison.
Where do credentials for our systems live?
In an encrypted vault on the server. When a connection uses one shared workspace key, calls are forwarded server-side: the key is decrypted in process for that call and never reaches a laptop. When each person signs in with their own account, the token is brokered per person and revocable, and downstream permissions stay exactly theirs.
Can we stream the audit trail to our SIEM?
Yes, today. Both ledgers export to a destination you configure: an HMAC-signed webhook you verify like a Stripe signature, or Splunk HEC. Three versioned streams (decisions, governance changes, sessions) arrive in order, at least once, on a five-minute cadence. Test-send and secret rotation are built in.
Can people sign in with our identity provider?
Human sign-in runs on Clerk. If your org signs in through Okta, Entra, or Google Workspace, talk to us and we will configure your workspace for it.
Do you provision people from our directory?
Not yet. Directory sync (SCIM) is on the roadmap, not shipped. Today membership and roles are managed in Tier Two, and human sign-in already supports your identity provider at the auth layer.