One front door for internal MCP servers
Point bastn at an MCP server you already run. Agents connect to bastn with their own key instead of to the server, and bastn passes through only the calls their policy allows.
Name the tools each agent gets
allow_tools lists the tool globs a server will call. Each agent's policy then picks its slice, down to argument values. Two agents can use the same server and see different tools.
New and changed tools wait for review
new_tools: deny keeps a tool the upstream adds from being listed or called until you pin it. A server with neither new_tools: deny nor drift_mode: block gets a warning when you validate the policy, because tools the upstream adds would become callable without review.
The same controls as everything else
Approvals for the calls that matter, rate limits per agent or caller, one switch that disables an agent and its keys, and a keyed, hash-chained audit log you can verify offline.
When there is no MCP server yet
Most internal tools never get one. bastn can serve a CLI or an OpenAPI service as tools directly. See CLIs and scripts.