DEV Community: Obot AI

What We Learned About Enterprise AI Governance at Ai4

Obot AI — Thu, 20 Aug 2026 18:03:01 +0000

Recently, the Obot team spent a few days in Vegas at Ai4 talking with CISOs, platform teams, developers, and AI leaders.

One thing became clear: AI governance is quickly becoming an infrastructure problem.

➡️ Full Article

AI tools are already inside the enterprise. Developers are using coding agents, MCP servers, Skills, and AI clients—often running directly on their machines.

The question we heard wasn’t “Should we allow AI?” It was: How do we give teams room to experiment while maintaining visibility and control?

That shift matters. Centralized gateways are part of the answer, but they can’t govern activity that never passes through them. As more of the AI stack moves to endpoints, organizations need a way to manage AI across both centralized infrastructure and developer devices.

We also saw how eager teams are to experiment. Several teams we met deployed Obot’s Community Edition during the conference, and came back the next day having already tested it.

Our biggest takeaway from Ai4? AI adoption isn’t waiting for governance to catch up.

The opportunity is to build infrastructure that lets teams move quickly without sacrificing security. Here’s more on what we learned at Ai4 from Obot AI President and Cofounder Shannon Williams:

➡️ Read the full blog post

Originally published on obot.ai

🚀 Free Live Workshop: Getting Started with Obot & MCP — From Zero to Production

Obot AI — Fri, 14 Aug 2026 16:49:51 +0000

We’re hosting our next free hands-on workshop Aug 26 @ 10am US PT. If you’ve been experimenting with the Model Context Protocol (MCP) but aren’t sure how to take it beyond a local demo, join us to walk through everything you need to deploy, secure, and manage AI agents at scale.

➡️ Register Now

What we'll cover:

✅ What MCP is (and why it’s becoming the standard for AI agent integrations)
✅ Installing and configuring the Obot MCP Gateway
✅ Connecting AI agents to tools, APIs, and data sources
✅ Authentication, OAuth, and access policies
✅ Monitoring and operating MCP in production
✅ Live Q&A with Obot expert Chris Urwin

This is an interactive session — we’ll be building and demonstrating everything live.

Who it’s for

AI/ML Engineers
Backend & Platform Engineers
DevOps / DevSecOps
Technical Architects
Anyone building agents with or evaluating MCP for enterprise use

The Details:

📅 Date: Wed. Aug 26, 2026
🕐 Time: 10am PT / 1pm ET
🎟️ Click here to register

If you’re trying to figure out how to move from “I have an MCP server running” to “I can actually operate this in production,” this session is designed for you.

Obot is an open-source MCP platform for hosting, securing, and managing MCP servers and AI agents at scale.

OWASP Has Mapped MCP Risk. Enterprises Still Have to Govern It.

Obot AI — Wed, 05 Aug 2026 13:18:16 +0000

By Bill Maxwell, Software Architect Obot AI

In April 2026, Microsoft disclosed a critical function in its hosted MCP service that required no authentication. OWASP had already named exactly this risk — MCP07:2025, Insufficient Authentication & Authorization — in its MCP Top 10. The risk was mapped. The control wasn't enforced.

That gap is the subject of this post.

OWASP now covers AI risk across three distinct layers: LLM applications, agentic systems, and MCP servers specifically. Together they give security teams a useful map. What they don't do is tell you where enforcement actually happens — because the MCP spec deliberately leaves that to implementers. The July 28 specification says so explicitly: MCP "cannot enforce these security principles at the protocol level."

So what does enforcing them actually require? Obot Software Architect Bill Maxwell breaks it down into four questions every enterprise running MCP needs to be able to answer at any moment: what MCP servers exist, who is acting through them, what are they authorized to do right now, and what can you prove after the fact.

The controls aren't new. What changed is the operating conditions they have to hold under.

⏱ 11-minute read · 📓 Full article

Originally published on Obot AI

Obot Platform v0.25.0: Tool Call Enforcement, MCP Tunnels & Agent Auth Scopes

Obot AI — Mon, 03 Aug 2026 13:13:36 +0000

By Craig Jellick, VP Engineering & Co-founder of Obot AI

v0.25.0 is out, and it closes the loop on something we've been working toward for a few releases: governing not just what flows through Obot, but what AI agents do on developer machines before a request ever reaches a gateway.

Device management in v0.22.0 gave admins inventory. v0.24.0 added audit logs via Obot Sentry. v0.25.0 adds enforcement: administrators can now define an allowlist of approved tools and MCP servers, and Obot Sentry checks every tool call against it through the coding agent's pre-tool hook before it runs. Fails closed. Every decision is logged.

But that's just the headline. This release also adds:

MCP Tunnels — reach MCP servers on private networks via an outbound WebSocket connection, no inbound firewall changes required
Agent Auth Scopes — scoped, expiring API keys for autonomous and headless agents that can't do a browser sign-in
Obot Community tier — all auth and model providers now available without a n enterprise license

Full breakdown in the release notes below.

📓 Full release notes · 🐙 GitHub v0.25.0

Originally published on Obot AI

Obot Platform v0.24.0: Obot Sentry, AI Audit Logs & MCP Improvements

Obot AI — Mon, 27 Jul 2026 12:39:00 +0000

By Craig Jellick, VP Engineering & Co-founder of Obot AI

v0.24.0 has shipped, and we're proud to highlight Obot Sentry — a lightweight companion agent that enrolls a workstation with Obot, runs scheduled device inventory scans, and installs managed audit hooks for Claude Code, Codex, VS Code, and Cursor.

Why Obot Sentry? Teams are trying to understand what AI is doing across their organizations, but activity is scattered. Some traffic goes through an LLM gateway. Some happens in local AI clients that never cross a centralized endpoint. Some is in MCP servers, some is direct model calls. No single capture point covers all of it.

v0.24.0 adds three pieces to address that:

→ Obot Sentry — device-level audit hooks for local AI clients; first MDM path is Microsoft Intune for Windows
→ Full LLM Gateway audit logs — every model request logged with user, provider, model, token usage, duration, and encrypted content; exportable to S3, GCS, or Azure
→ AWS Bedrock, Azure, and Generic Responses providers — broader model provider coverage without a different governance model for each

Plus: composite MCP servers through GitOps, a significantly smaller MCP proxy footprint, built-in local auth, and in-app getting started guides.

📓 Full release notes · 🐙 GitHub v0.24.0

Give Obot a try - no strings, no card needed, full enterprise edition, free for 2 weeks.

Originally published on Obot AI

MCP Is Growing Up: What the 2026 Roadmap Actually Changes

Obot AI — Fri, 24 Jul 2026 14:50:56 +0000

By Bill Maxwell, Obot AI

The MCP spec dropping July 28 is the largest revision since MCP launched — and as a team that's been building enterprise infrastructure on top of MCP since the beginning, we've been watching this roadmap closely.

The headline change is a stateless core. The initialize/initialized handshake is gone. Protocol metadata now travels with every request instead of being negotiated once at connection time. For teams running Obot, this is a direct win: no more sticky sessions, no shared session store, no extra routing complexity at the gateway layer.

But the stateless core is just one part of a larger shift. The 2026 roadmap also formalizes an extensions system, hardens OAuth/OIDC to match how it's actually deployed in production, and establishes a proper twelve-month deprecation lifecycle. MCP is replacing early protocol-specific machinery with proven infrastructure patterns.

What's equally telling is what the roadmap leaves deliberately undefined: audit trails, SSO-integrated authorization, gateway behavior, and configuration portability are explicitly called out as enterprise-readiness concerns — and described as an open invitation for the ecosystem to fill. That's exactly the space Obot is built for, and this release makes the foundation beneath us significantly stronger.

Obot Software Architect Bill Maxwell breaks down every major change and what it means for teams running MCP in production today.

📓 Full article

Originally published on Obot AI

What Is AI Governance? A Framework for Enterprise MCP Teams

Obot AI — Tue, 21 Jul 2026 16:10:08 +0000

From the Obot AI team

An organization can have its EU AI Act risk tiers mapped, ISO/IEC 42001 certification underway, and a model review board that meets every month — and still have no answer to a basic operational question: which of the MCP servers its agents can reach were ever vetted for anything?

The problem is structural. Most enterprise AI governance frameworks — the EU AI Act, NIST AI RMF, ISO/IEC 42001 — were built to govern models: their training data, outputs, and risk classification. None of them were designed to answer for an agent's runtime decision to call an MCP tool. The entire tool layer is effectively ungoverned even in organizations with mature AI governance programs.

This post maps exactly where general AI governance frameworks stop at the model boundary, and what an MCP-specific governance layer actually needs to include: policy, risk classification, registration-time vetting, runtime monitoring, audit trails, and a maturity model for managing the tool layer.

If your organization is running MCP in production and has a governance program that doesn't explicitly cover it — this is the framework you're missing.

⏱ 18-minute read · 📓 Full article

Originally published on Obot AI

[Boost]

Obot AI — Fri, 10 Jul 2026 12:58:45 +0000

Obot AI

Jul 9

Free Live Workshop: Getting Started with Obot & MCP — From Zero to Production

#agents #ai #mcp #tutorial

1 min read

Free Live Workshop: Getting Started with Obot & MCP — From Zero to Production

Obot AI — Thu, 09 Jul 2026 10:30:00 +0000

From the Obot Academy: If you’ve been experimenting with the Model Context Protocol (MCP) but aren’t sure how to take it beyond a local demo, we’re hosting a free hands-on workshop July 29 @ 10am US PT that walks through the entire journey.

Register Now

What we’ll cover:

This is an interactive session — we’ll be building and demonstrating everything live.

Who it’s for

AI/ML Engineers
Backend & Platform Engineers
DevOps / DevSecOps
Technical Architects
Anyone building agents with or evaluating MCP for enterprise use

The Details:

📅 Date: Wed. July 29, 2026
🕐 Time: 10am PT / 1pm ET
🎟️ Click here to register

If you’re trying to figure out how to move from “I have an MCP server running” to “I can actually operate this in production,” this session is designed for you. We hope you'll join us!

Obot is an open-source MCP platform for hosting, securing, and managing MCP servers and AI agents at scale.

Best MCP Gateways for Engineering Teams (2026)

Obot AI — Fri, 03 Jul 2026 10:30:00 +0000

From the Obot AI team

Every engineering team that wires AI agents into production using MCP eventually hits the same inflection point: the setup that worked for two agents and three tools doesn't hold up across twelve agents, nine MCP servers, and a security review.

Credentials are inline. Access policies are per-server and inconsistently applied. The audit trail doesn't exist. IT wants to know what the agents are doing. Nobody has a clean answer.

That's where MCP infrastructure stops being optional — and where choosing the wrong gateway means rebuilding infrastructure that was supposed to be durable.

The MCP gateway landscape in 2026 is genuinely hard to navigate: purpose-built enterprise governance platforms, high-performance open-source proxies, managed cloud services, and legacy API gateway vendors who retrofitted MCP support into existing products. They are not interchangeable.

This guide covers what actually differentiates the leading options — with a feature comparison table, pricing overview, and a framework for making the right call based on your team's security, compliance, and operational requirements.

📓 Full guide · ⏱ 23-minute read

Originally published on Obot AI

Enterprise-Managed Authorization: How MCP Is Growing Up

Obot AI — Tue, 30 Jun 2026 20:02:37 +0000

By Bill Maxwell, Obot AI

MCP grew fast because it was easy to stand up and see immediate results. That ease of use is exactly what enterprises struggle with at scale.

OAuth — MCP's recommended authorization mechanism — works well for individual users granting consent to their own tools. It breaks down when an enterprise needs to manage access centrally: provisioning thousands of users, enforcing policy across departments, revoking access instantly when someone leaves.

Enterprise-Managed Authorization (EMA) is the MCP spec's answer to that problem. Now stable, EMA shifts control from individual OAuth consent flows to centralized, admin-managed authorization — the model enterprises already use for every other critical system.

This post covers how EMA works, what it still leaves to the gateway and governance layer, and where tools like Obot fit into the picture.

📓 Full article

Originally published on Obot AI

AI Governance Trends 2026: What Enterprise Teams Need to Know

Obot AI — Tue, 23 Jun 2026 15:38:09 +0000

By Shannon Williams, President & Co-founder of Obot AI

56% of CEOs say AI has delivered no measurable cost or revenue benefit. Only 1 in 8 sees improvement on both dimensions.

That's not a technology problem. It's a governance problem. AI is being deployed faster than the controls to manage it — and the gap between deployment speed and governance readiness is where the real risk lives.

Over the past several months the Obot team has had countless conversations with enterprise leaders across industries, and the same themes keep surfacing: shadow AI running unchecked on employee machines, agentic workflows that nobody has full visibility into, boards asking hard questions that "we have a policy document" can no longer answer.

This post maps where AI governance actually stands heading into the second half of 2026 — the regulatory shifts, the operational gaps, and what teams that are getting it right are doing differently.

Originally published on Obot AI