PrivacyFence
AI agents
An AI client reaches your services only through PrivacyFence's /mcp endpoint. Whichever client asks, PrivacyFence's own gate decides: reads are reviewed before release, and changes wait for your approval. These are the clients we test with, one page each.
Tested clients
Each page says how the client connects, what it asks you before PrivacyFence's own card, how it is named on that card, and links its setup steps in the docs.
Your own computer and organization mode. On your own computer, with the Docker image and your passkey, or in the deprecated desktop mode through PrivacyFence's extension, PrivacyFence.mcpb. With an organization deployment, as a custom connector with your organization sign-in.
Your own computer and organization mode. On your own computer, straight to /mcp: with your passkey on the Docker image, or with your own token in the deprecated desktop mode. With an organization deployment, it registers itself and you sign in with your organization account.
Organization mode only. claude.ai connects from Anthropic's servers, so it needs a PrivacyFence it can reach over public HTTPS. It is added as a custom connector, and you sign in with your organization account.
Desktop mode (deprecated) and organization mode. On your own computer, ChatGPT desktop connects straight to /mcp with your own token; checked on macOS. With an organization deployment, ChatGPT on the web connects as a Developer Mode app, and you sign in with your organization account.
Organization mode only. Gemini Enterprise connects from Google's servers, so it needs a PrivacyFence it can reach over public HTTPS. An administrator registers it once and adds it as a custom MCP server data store, and each person signs in with their organization account.
Any client that speaks MCP over Streamable HTTP connects the way Claude Code does: on your own computer with the /mcp URL and your bearer token, and to an organization deployment with OAuth 2.1 and dynamic client registration. Clients not listed here have not been tested.
Whichever client
PrivacyFence tells every client truthfully what each tool does: reads are read-only, writes are writes, and the tools that delete something (calendar_delete_event, drive_sheets_delete_dimensions and peek_delete_page) are marked destructive. A client may use that to ask you before a write, and may let you always allow a tool. Either way, a gated call still waits for PrivacyFence's approval card, and that card is the confirmation that decides.
On your own computer every client uses the same credential, so the card names the requester Undetected. In an organization deployment the card shows the name the client sends as a claim, marked Not verified, until an administrator pins that client's registration.
Which AI system is asking · PrivacyFence compared with the alternatives
Next
See what each connector lets an AI client read, what is reviewed, and which writes need your approval.