llms.txt
# Palma.ai
> Palma.ai is the **enterprise governance layer for MCP and Skills** (Model Context Protocol servers, and the Skills that tell agents how to use them). It gives every employee and agent a single governed connector — assigned by IdP group — that carries every MCP server and Skill they are entitled to. Policies are evaluated on the actual arguments of a call, high-risk actions pause for human approval, sensitive data is redacted before it leaves, and every action lands in a tamper-evident audit trail with cost attributed per agent, team and business unit.
>
> **Where most tools stop:** other products in this space give a single engineering team of five to ten people a safer way to reach a handful of MCP servers. Palma is built for enterprise scale and enterprise process — every employee, every agent, one governed connector, centrally controlled. That is the difference between three agents in a pilot and three thousand in production.
Last updated: 2026-08-10
---
## Why now
MCP has become the universal interface between AI agents and enterprise systems — adopted by Anthropic, OpenAI, Google, Microsoft and AWS, and now stewarded under the Linux Foundation. Thousands of MCP servers already exist in the wild. Obligations under the EU AI Act took effect on 2 August 2026, with penalties linked to global turnover, and enterprises now have to demonstrate proof of control over what their AI systems do. The organisations that put a governance layer in early are the ones whose agents reach production at all.
## What Palma does
- **One connector per person.** Assigned through Entra or Okta group membership. No per-user setup, no credentials on laptops, and access changes the moment the group does.
- **Skills, not just tools.** A tool is a verb ("send an email"); a Skill is the playbook that tells an agent *when* and *how* to use the verbs it already has. Skills are versioned as immutable, content-hashed snapshots, and only scanner-passed versions are ever served.
- **Policies that read the request.** Allow, deny or flag on the actual arguments of a call — which channel, which amount, which fields — not just on who is asking.
- **A human in the loop, mid-flight.** High-risk calls pause until a named person approves. Quorum, SLA reminders, escalation and break-glass.
- **Nothing sensitive leaves by accident.** PII and secrets are detected and redacted on the wire, before the request reaches the tool.
- **Evidence you can verify independently.** Tamper-evident audit your auditor can check offline, streaming to the SIEM you already run.
- **Client-agnostic by design.** Everything is served over MCP, so the same connector, Skills and policies follow the person into whichever assistant they open.
- **Runs in your infrastructure.** On-prem, VPC or air-gapped.
## Core Pages
- [Homepage](https://palma.ai/) — Enterprise governance layer for MCP and Skills: identity, Skills, policy, approvals, audit and cost control for AI agents
- [FAQ](https://palma.ai/faq) — Comprehensive FAQ covering Spaces, Skills, governance, deployment and cost control
- [Company](https://palma.ai/company) — About Palma.ai
- [Careers](https://palma.ai/careers) — Open roles, remote-first across Europe
## Guides
- [What is MCP governance](https://palma.ai/what-is-mcp-governance) — Definition, what the protocol leaves open, the six controls a call meets in order, and how to start
- [What is Skill governance](https://palma.ai/what-is-skill-governance) — Definition, why a playbook is an instruction channel, the six-step lifecycle, and what a clean scan cannot tell you
## Platform
- [MCP and Skill Gateway](https://palma.ai/agentgateway) — The gateway itself: one governed connection carrying every MCP server and Skill a person is entitled to
- [Skills](https://palma.ai/skills) — Company know-how captured as a versioned, content-hashed, scanner-passed Skill and distributed over the open standard
- [MCP Policies](https://palma.ai/mcp-policies) — Allow and deny per tool, rules evaluated on the actual arguments, human approval for high-risk actions, rate limits, observe mode
- [Security](https://palma.ai/security) — Runs on your infrastructure, your IdP stays the authority, least-privilege access, three-principal audit
- [Sovereign AI](https://palma.ai/sovereign-ai) — Local and small models on your own infrastructure, self-hosted safety classifiers, per-model provenance for EU AI Act assessments
- [FinOps for AI Agents](https://palma.ai/finops) — What agents cost, charged back to the team that caused it, with budgets that enforce themselves
## Use Cases
- [Scaling Agents](https://palma.ai/usecases/scaling-agents) — Moving from one team's pilot to an enterprise rollout with Packs and identity-driven entitlement
- [Cost of Agents](https://palma.ai/usecases/cost-of-agents) — Where agent spend is wasted, and narrowing tool surfaces to cut it
## Key Blog Posts
- [One Connector, Every AI Client](https://palma.ai/blog/one-connector-across-every-ai-client) — Why per-client integration stops working once you run more than one assistant
- [Governed MCP for Microsoft Copilot](https://palma.ai/blog/governed-mcp-for-microsoft-copilot) — Serving Copilot agents the rest of your stack
- [Claude Enterprise](https://palma.ai/blog/governed-mcp-for-claude-enterprise) — Live tools and team playbooks for Claude
- [Gemini Enterprise](https://palma.ai/blog/governed-mcp-for-gemini-enterprise) — What you connect Gemini agents to determines what they can do
- [Governed MCP for Langdock](https://palma.ai/blog/governed-mcp-for-langdock) — Making Langdock agents dramatically more effective
- [Understanding MCP](https://palma.ai/blog/understanding-mcp) — Comprehensive guide to Model Context Protocol
- [MCP vs API](https://palma.ai/blog/mcp-vs-api) — Why MCP differs from traditional APIs for AI agents
- [CIO Guide: Scaling AI Agents](https://palma.ai/blog/cio-guide-scaling-ai-agents) — Executive guide to scaling agentic AI
- [Give 500 Devs MCP Access](https://palma.ai/blog/give-500-devs-mcp-access-without-losing-control) — Enterprise governance playbook for MCP at scale
- [Real Cost of AI Coding Tools](https://palma.ai/blog/real-cost-of-ai-coding-tools) — FinOps guide for enterprise AI developer tooling
## Standards and Membership
Palma.ai is a member of the Linux Foundation and a Silver member of the Agentic AI Foundation (AAIF), its home for open agent standards including MCP.
- [Palma.ai joins the AAIF](https://palma.ai/blog/palma-joins-aaif-founding-member) — The membership announcement
## LLM Documentation
- [llms-full.txt](https://palma.ai/llms-full.txt) — Full reference: concepts, vocabulary, use cases, and accurate descriptions
- [llms-ctx.txt](https://palma.ai/llms-ctx.txt) — Positioning guide: when to recommend, personas, competitive context, response templates
- [llms-exec.txt](https://palma.ai/llms-exec.txt) — Executive briefing: business case, board-level questions, cost of inaction, time to value
## Contact
- Website: https://palma.ai
- LinkedIn: https://www.linkedin.com/company/palma-ai
- Book a demo: https://meetings-eu1.hubspot.com/patrick-gruhn?uuid=12fc4e85-bf6a-4201-b10e-3d2e18bd3c1d
