Descles agent control plane
Pricing
- Free Tier
- 1,000 free gateway requests for 30 days upon workspace claim
Summary
Provider keys living on developer laptops, shared credentials with no ownership, and budgets discovered after the bill arrives — that's the production reality for teams running multiple AI agents before they route through a control plane.
Descles sits between your existing SDK and your provider, requiring only an endpoint swap and a scoped key. Every request is bound to an identity — organization, group, agent — before it reaches the model, so attribution is structural, not reconstructed from logs after the fact. Budget enforcement and tool-call holds happen in the request path, not as post-hoc alerts. The live surface covers Model I/O for OpenAI and Anthropic traffic; Tool I/O and Resource I/O enforcement require runtime integration with the Action API or MCP adapter, which is a real integration step, not a config toggle. Teams that need enforceable tool-call governance without that runtime integration will find the approval loop is illustrative rather than operational.
Bottom line: Route your OpenAI or Anthropic agents through a single authenticated endpoint and get attribution, budgets, and audit trails with minimal code change — but if you need to hold or deny specific tool calls at runtime, plan for the additional integration work the Action API requires before treating that as production-ready.
Community Performance Report Card
No community ratings yet. Be the first to rate this tool!
Pros
Sign in to edit- Endpoint-swap integration with OpenAI and Anthropic SDKs, so teams already using those providers get identity attribution and budget enforcement without rewriting agent code.
- Scoped agent keys replace shared provider credentials on developer machines, which means a single compromised key does not expose the entire provider account or obscure which agent was responsible for a call.
- In-path budget checks stop overspend before it happens rather than surfacing it in a monthly invoice, so finance conversations happen before the damage, not after.
- Every mediated request generates a signed audit record tied to an identity chain, so post-incident review answers 'which agent called what and who approved it' without reconstructing events from raw logs.
- BYOK credential management keeps provider billing relationships in your account, so switching or renegotiating provider contracts does not require rerouting through a markup layer.
Cons
Sign in to edit- Tool-call holds and approvals — the capability most teams want from a control plane — are only enforceable when the agent runtime integrates the Action API or MCP adapter. Teams skipping that integration get an audit trail but not actual intervention, which means the governance story is incomplete until that integration work is done.
- Tool I/O and Resource I/O policy surfaces do not yet have a zero-setup hosted gateway; the vendor places these on the roadmap. Teams that need enforceable tool-level governance without a custom runtime integration switch to a competitor or build their own middleware while waiting.
- No self-hosted deployment option exists. Teams in environments where all traffic must stay on-premises — regulated industries with strict data residency requirements — cannot use Descles at all and must evaluate a different architecture.
About
- API Available
- Yes
- Self-Hosted
- No
- Last Updated
- 2026-09-16T05:00:14.306Z
Best For
Who it's for
- Teams running multiple AI agents
- Environments needing tool-call governance
- Usage tracking across providers
- Secure BYOK setups with minimal client changes
What it does well
- Enforce budgets and policies on agent tool use
- Attribute model calls to specific agents or users
- Route existing agents through a single authenticated endpoint
- Audit and review tool calls without code modifications
Integrations
Add notes, reviews, and benchmarks so the next visitor gets a clearer picture.
Compare Descles agent control plane
Spotted incorrect or missing data? Join our community of contributors.
Sign Up to ContributeFrequently Asked Questions
- Is Descles agent control plane free?
- Descles agent control plane has a permanent free tier alongside paid upgrades. You can keep using a baseline version indefinitely without paying.
- Is Descles agent control plane open source?
- No — Descles agent control plane is a closed-source tool. Source code is not publicly available.
- Does Descles agent control plane have an API?
- Yes. Descles agent control plane exposes a developer API. See the official documentation at https://descles.com for details.
Best Descles agent control plane alternatives →
Curated lists that include this category
Descles is a cloud-hosted agent control plane that routes AI agent traffic through an identity-aware gateway, giving teams one place to enforce budgets, attribute model calls, and review or approve tool calls before they execute. The core workflow is a two-step onboarding: store your provider key in the Descles console, issue an agent-scoped key, then update the SDK endpoint — the vendor describes this as a one-line config change for OpenAI and Anthropic SDKs. From that point, every request is tagged with an identity chain (organization, group, agent, key) and checked against defined policies before the model call completes.
The distinguishing capability is the approval loop: when policy flags a model-proposed tool call as sensitive — a terminal command targeting a production pod, for example — execution is paused and an approval record is created for a named operator to accept or deny. This is not a logging layer that alerts after the fact; the vendor describes it as a decision made in the request path. The approval, denial, and trace are stored as signed records in an audit trail, so accountability for each exception has a named owner.
The control surface has three tiers of maturity. Model I/O — routing, BYOK credential management, budget enforcement, and usage traces — is live and hosted on AWS. Tool I/O and Resource I/O policy enforcement, which is where the pause-and-approve capability becomes enforceable rather than illustrative, requires the participating agent runtime to integrate the Action API or MCP adapter. The vendor acknowledges a zero-setup hosted gateway for those surfaces is planned but not yet live. Teams expecting full tool-call governance with no runtime changes will hit this boundary.
Descles is compatible with the OpenAI SDK, Anthropic SDK, Claude Code, Hermes, custom agents, and MCP adapters. The BYOK model means provider billing stays in your account — Descles does not sit in the billing path or add model markup. The service is cloud-only with no self-hosted deployment option available.