Willow builds an identity and access layer for AI agents used at work. It gives security and platform teams one place to see which agents, MCP servers and AI tools employees are using, and to control what each agent can reach in internal systems.
The problem it targets is familiar to anyone rolling out agents: personal API keys, over-permissioned shared service accounts and ad hoc OAuth tokens that nobody can revoke centrally. Willow replaces these with one governed gateway that every agent call passes through.
At A Glance
| Vendor | Willow |
|---|---|
| Category | Agentic AI identity and access, MCP gateway |
| Identities covered | AI agents, MCP servers and tools, employees acting through agents |
| Deployment | SaaS (US and EU regions), hybrid, or on-premises including air-gapped |
| Agentic AI | MCP gateway, scoped agent credentials, shadow AI detection, runtime guards |
| Customers | Wix, Riskified, Papaya Global, Freetrade, Lansweeper |
| Funding | Seed round led by Hetz Ventures (2026) |
| Market classification | Agentic AI Identity; also Identity Governance & Administration |
What Willow Does
Willow starts from the idea that every agent needs an identity and should get exactly the access its task needs, no more. In practice one gateway sits between AI clients and the tools they call. The gateway decides who is asking, what they are allowed to touch, and whether a call goes through, is redacted, is blocked or waits for a human to approve it. Because the same gateway serves every client, a policy written once covers Claude, Cursor or an internal agent alike, and access ends for all of them when an employee leaves. The goal is to let teams adopt agents quickly without handing out standing credentials.
Products
MCP Gateway
AI clients such as Claude, Cursor, ChatGPT and Copilot connect to a Willow MCP endpoint rather than calling tools directly. Each request passes six ordered checks: identify the user or agent, scope the tools it can see, enforce policy, inspect for prompt injection, secrets and personal data, broker the credential and clean the response. If any policy check fails the call is blocked by default. Teams can also set rate limits for each user, group or server, and each server carries a risk score from 0 to 10.
Identity And Access
This module solves the over-permissioned service account problem. Each agent receives a credential that is scoped, time bound and tied to a real user, so it inherits what its operator is entitled to and nothing more. Permissions work at the level of individual actions, such as read, create or delete in a specific project, and every interaction is authenticated at runtime with no persistent session.
Shadow AI Detection
Security teams rarely know how many AI tools employees have installed. Shadow AI detection watches the browser and endpoint layer continuously and finds AI agents, IDE agents, MCP servers, models, skills, plugins, browser extensions and personal account usage. Each unmanaged MCP server, skill or plugin can then be approved, governed or blocked.
Marketplace And Background Agents
For teams that want to enable AI rather than only restrict it, Willow runs a marketplace of connectors, skills and plugins, with over 1,000 connectors, over 100 skills and over 100 plugins. Background Agents fire on a trigger, do the job and log every step.
How It Works
Willow offers three deployment models and installs its components with Helm on EKS, GKE, AKS, OpenShift or any conformant Kubernetes cluster.
| Component | What it does |
|---|---|
| SaaS | Willow runs the gateway, in US and EU regions. |
| Hybrid | The runtime runs in the customer’s Kubernetes cluster, so tool calls never leave the customer network. |
| On-premises | All components run in the customer cluster with no external call home, and the setup can be air-gapped. |
| Credential vault | Credentials sit in an AES-256-GCM vault, with keys held in AWS KMS or on-premises. |
| Audit log | Every tool call is tied to a person and records the policy that allowed or blocked it. Logs stream to SIEM and observability tools or any webhook. |
Identities And Systems Covered
| AI agents | Each agent can be provisioned, suspended and audited individually. |
|---|---|
| Employees | Agents act under an employee identity rather than a separate service account, and SCIM updates agent access when people join, move or leave. |
| MCP servers and tools | Discovery and policy cover every agent, tool and MCP server, including internal MCP servers, which receive the real user identity through JWT passthrough. |
| AI clients | Claude, Cursor, ChatGPT, Copilot and Gemini. |
| Authentication methods | OAuth 2.0 with PKCE and token exchange, OIDC, SAML, API keys, mTLS and cloud IAM roles. |
Agentic AI Capabilities
Runtime Guards
Guards can block, warn, require approval or redact content. Approval for critical actions happens in Slack, and personal data and secrets are redacted at the moment of action.
Claude Compliance API Integration
Willow regularly queries Claude’s Compliance API for new sessions and messages, links each one to a user through the identity provider, runs its guardrails for personal data, secrets and prompt injection, and logs every session. No proxy or endpoint software is needed. This applies to Anthropic hosted deployments, and conversation content is available on Claude Enterprise plans.
Kill Switch
A kill switch revokes any agent or tool across the organisation in one step.
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Okta, Microsoft Entra ID, JumpCloud, Keycloak, OneLogin, Auth0 |
| SIEM and logging | Splunk, CrowdStrike, Grafana Loki, Coralogix, Amazon S3, OTLP intake |
| Business tools | Jira, Salesforce, Google, Figma, Notion, HubSpot, GitHub |
| Cloud and data | AWS, Snowflake, Wiz, Sentry, Grafana, Datadog |
Company Background
| Headquarters | Herzliya, Israel, with an office in New York. |
|---|---|
| Leadership | Eyal Ben Ezra (co-founder and CEO), Shalev Shalit (co-founder and CTO) and Idan Chetrit (co-founder). |
| Funding | $7 million seed round in 2026 led by Hetz Ventures, with angel investment from Avishai Abrahami and Nir Zohar of Wix. |
| Compliance | SOC 2 and GDPR, with a public trust centre. |
| Open source | MCP-S OAuth and Secure MCP Gateway projects on GitHub. |
Note: This overview is compiled from Willow’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.