Weldon Web

Azure Marketplace · Cloud Solution Provider

AI governance your customers can deploy in minutes

MCP Audit & Compliance Gateway is an Azure Managed Application that intercepts every AI agent tool call - validating identity, enforcing policy, logging a full audit trail, and reporting metered usage. Your customers keep their data. You add a high-margin compliance layer to your AI portfolio.

Get it on Azure Marketplace →Talk to a partner specialist

The problem

Your enterprise customers are deploying AI agents. Their security teams have no idea what those agents are doing.

Model Context Protocol (MCP) connects AI agents - Claude, ChatGPT, custom LLMs - to real enterprise systems: databases, file stores, APIs, internal tools. The problem is that MCP servers have no built-in authentication, no access control, and no audit trail. Agents call whatever tools they can reach.

In regulated industries - financial services, healthcare, government, legal - that is not acceptable. Compliance teams need to know exactly what every AI agent accessed, when, and why. Security teams need to block sensitive data from leaving the perimeter. Engineering teams need this without rewriting their MCP servers.

The solution

MCP Audit & Compliance Gateway deploys as an Azure Managed Application into your customer's own subscription. It sits in front of their existing MCP servers as a transparent reverse proxy. No changes required to their AI agents. No changes to their MCP servers. Every tool call flows through a five-stage pipeline:

  1. 1.JWT identity resolution - The calling agent presents a bearer token. The gateway extracts the agent identity without any round-trip to an external IdP.
  2. 2.Policy evaluation - Per-route allow-lists and per-tool deny-pattern rules are evaluated in-process. Non-matching requests are rejected before any upstream call is made - sensitive prompts never reach the MCP server.
  3. 3.YARP reverse proxy - Approved requests are forwarded to the target MCP server. YARP handles SSE streaming, HTTP/2, and keep-alive transparently - no custom relay code.
  4. 4.Structured audit emission - The full request and response payload is written to Azure Log Analytics and the OpenTelemetry exporter with identity, tool name, and timestamp attached.
  5. 5.Marketplace metering - Successful invocations are counted and reported to Azure Marketplace Metering Service for commercial billing. Monthly caps are enforced per tier.

Because it is deployed as an Azure Managed Application, your customer owns the resources. All data - audit logs, request payloads, policy config - stays in their subscription. You never have access to their environment unless they grant it.

What your customers get

Granular access control without touching MCP servers

Define exactly which agent identities can call which tools on which routes. Allow-lists are evaluated per route. Deny patterns use regex and are matched against tool names before any upstream call - your customer defines what is off-limits and those rules are enforced at the proxy layer.

A complete, queryable audit trail

Every tool call is logged: agent identity, tool name, full request payload, full response payload, and timestamps. Logs stream to Azure Log Analytics. Security teams can query with KQL. Retention, alerting, and workbooks can be layered on with standard Azure tooling - no new platforms to learn.

Azure-native observability via OpenTelemetry

Audit events are emitted through the OpenTelemetry SDK. On Azure Monitor the connection string is all that is needed. In hybrid environments the same events can be routed to any OTLP-compatible backend - Jaeger, Grafana, Datadog - without changing the gateway code.

Commercial billing through Azure Marketplace

Invocation counts are reported to the Azure Marketplace Metering Service automatically. Your customer sees usage on their Azure invoice alongside their other Azure spend. No separate billing relationship, no credit card forms, no invoice reconciliation.

Data sovereignty by design

The Managed Application deploys entirely into the customer's subscription. Weldon Web holds no publisher authorization into customer environments. Audit logs, request payloads, and policy configuration never leave the customer's Azure tenant.

Zero-friction deployment

The marketplace wizard collects route configuration and backend URLs through a standard Azure portal flow. The Bicep template provisions a Container App, Log Analytics workspace, and managed identity in one operation. Time from marketplace click to first proxied request is under ten minutes.

Why CSP partners choose this

AI governance is the fastest-growing compliance conversation in enterprise accounts. MCP Audit & Compliance Gateway gives you a credible, deployable answer - not a roadmap slide.

Add to Azure invoices immediately

The offer is available through the Azure Marketplace CSP channel. Your customers pay on their Azure bill. You earn your standard CSP margin on Marketplace transactions.

No operational overhead

Weldon Web publishes and maintains the container image. Updates ship as new image tags - customers redeploy via a Container App revision. You are not running infrastructure.

Differentiator in regulated verticals

Financial services, healthcare, and government customers face real regulatory pressure on AI audit trails. This is a named, demonstrable control - not a general assurance statement.

Complements your existing AI practice

If you are already deploying Azure OpenAI, Copilot Studio, or custom LLM workloads, this slots in as the governance layer. It does not compete with your AI architecture work - it makes it safer to sell.

Use cases

  • -

    Financial services AI agent governance

    A wealth management firm deploys an AI agent that can query client portfolios and execute trade instructions via MCP tools. The gateway enforces that only the portfolio-management agent identity can call the execute-trade tool, logs every call with full payload for the audit committee, and caps monthly invocations at the contracted tier.

  • -

    Healthcare data access control

    A hospital network grants AI agents read access to patient records via an MCP server. The gateway allows the clinical-summary agent to call read-patient-record but denies write-medication-order for all agent identities. Every access is logged with identity and timestamp for HIPAA audit readiness.

  • -

    Internal developer platform security

    An enterprise engineering organisation exposes internal APIs as MCP tools so developers can use AI coding assistants against live data. The gateway ensures that only CI pipeline agent identities can call deploy-to-production, while individual developer agents are restricted to non-destructive read operations.

  • -

    Multi-tenant SaaS AI features

    A SaaS provider adds AI agent features backed by MCP servers. The gateway provides per-tenant isolation: each tenant's agent identity is scoped to their own route prefix, and cross-tenant tool calls are denied at the proxy layer before reaching shared MCP infrastructure.

Plans

Free

No charge

10,000 included per month

  • ✓Full policy enforcement
  • ✓Structured audit logging to Log Analytics
  • ✓OpenTelemetry export
  • ✓JWT identity resolution
  • ✓Monthly invocation cap enforced in-process

No Marketplace billing configuration required. Suitable for evaluation and low-volume internal deployments.

Pro

$499 / month

500,000 included · $0.001 per additional invocation

  • ✓Everything in Free
  • ✓Full Azure Marketplace metering integration
  • ✓Higher monthly invocation allowance
  • ✓Suitable for production AI agent workloads

Billed through Azure Marketplace. CSP partners earn standard Marketplace margin.

Enterprise

Private offer

Unlimited

  • ✓Everything in Pro
  • ✓OPA (Open Policy Agent) integration for Rego-based policy
  • ✓Redis-backed invocation counters for multi-instance deployments
  • ✓Azure Sentinel workbook support
  • ✓mTLS between gateway and MCP backends
  • ✓Admin API for hot-reload route config
  • ✓Multi-region deployment support

Contact Weldon Web to discuss private offer pricing and partner arrangements.

Technical requirements

  • -Azure subscription (any tier) in the customer's own tenant
  • -AI agents that issue JWT bearer tokens - any standard OAuth 2.0 / OIDC-compatible token works
  • -MCP servers reachable from within the customer's Azure Container App environment
  • -Azure Log Analytics workspace (provisioned automatically by the Managed Application)
  • -No changes required to existing MCP server implementations
  • -No changes required to AI agent code beyond pointing at the gateway endpoint

Who it's for

  • -Azure CSP partners building an AI governance practice
  • -Enterprise security and compliance teams in regulated industries - financial services, healthcare, government, legal
  • -Engineering organisations deploying AI agents (Claude, ChatGPT, custom LLMs) against internal MCP servers
  • -SaaS vendors adding AI features and needing per-tenant access isolation
  • -Azure-native teams that want observability without modifying upstream MCP infrastructure

Ready to add AI governance to your portfolio?

MCP Audit & Compliance Gateway is available now on Azure Marketplace. CSP partners can list it alongside existing Azure services. Enterprise enquiries and private offer discussions go through Weldon Web directly.

Get it on Azure Marketplace →Contact Weldon Web →