Integrations
Connect MAQPNA to identity providers, SPIRE, OpenTelemetry, SIEMs, secret vaults, sandboxes and policy engines.
Integrations overviewEvery system MAQPNA connects to, from identity providers and SPIRE to OpenTelemetry, SIEMs, secret vaults, chat notifications, sandboxes, model providers, policy engines and clouds, and where each one plugs in.Keycloak and OIDC single sign-onSign in to the MAQPNA console and CLI with Keycloak or any OIDC identity provider, map groups to admin roles, and use the same identity provider for approvals, user approval (CIBA) and external MCP clients.Workload identity with SPIFFE and SPIREGive each sandbox an X.509-SVID whose SPIFFE ID equals its session token subject, and make the gateway reject calls whose client certificate does not match.OpenTelemetry traces and metricsExport gateway spans over OTLP/HTTP to an OpenTelemetry Collector, Jaeger or any GenAI-aware backend, link traces to audit records, and scrape the gateway's Prometheus metrics.SIEM and audit forwardingStream audit ledger records to syslog, HTTP, Splunk HEC, Microsoft Sentinel, Google SecOps and CloudWatch Logs, keep a write-once copy in object storage, and import provider audit logs into the ledger.Secret vaults and per-user tokensKeep MCP and model credentials out of sandboxes, connect users' SaaS accounts to the gateway's per-user token vault, and source MAQPNA's own secrets and keys from HashiCorp Vault, OpenBao, cloud KMS and cloud secret managers.Approval and alert notificationsSend approval requests, decisions, revocations and budget alerts to a signed webhook, Slack, Microsoft Teams or Matrix, and let approvers approve or deny from chat.Anchor the ledger in a transparency logPublish signed ledger heads to Sigstore Rekor or a private Rekor, so a third party can prove the audit ledger existed at a time and was not rewritten, without trusting your keys.Sender-constrained tokens with DPoPBind session tokens to a key the agent holds in memory (OAuth DPoP, RFC 9449), so a copied token is useless, with the Go SDK or your own client.Sandbox driversChoose where agent sessions run (gVisor, Kata microVMs, confidential VMs, kosa8 or E2B) and configure trust tiers and sandbox drivers so every substrate keeps gateway-only egress.Signed configuration bundlesShip policies, models, MCP servers, budgets and revocations to a gateway without Kubernetes as one signed archive that the gateway verifies before it applies it.Hyperscaler interopPush MAQPNA policies into AWS Bedrock AgentCore Policy, and pull AWS CloudTrail, OpenAI and Anthropic audit events into a ledger as evidence of what ran outside the gateway.Identity checksMake the identity broker verify where a session runs (a sandbox, a pod, a cloud VM or a confidential VM) before it mints the session token, and use the result in policy.Offline edge gatewaysRun a MAQPNA gateway at a disconnected site, keep its audit ledger in a bounded signed spool, and forward it to a central collector over the network or on removable media.Export policies to Cedar, CEL, Rego and AgentCoreCompile MAQPNA policies to Cedar, CEL, Rego (OPA) or AWS Bedrock AgentCore Policy with maqpna policy compile, so other platforms enforce the same decisions.Policy engines, Cedar, Rego and WasmChoose how MAQPNA policies are evaluated - native rules, Cedar in a ToolPolicy, an OPA sidecar for Rego, or the native engine compiled to a WebAssembly module you embed elsewhere.