A proxy on the host, and the protocol it can see.
Ultra is one of the most architecturally honest products in this category, and the scored table reflects that: six ties out of sixteen, and a row they win outright. The distinction worth a buyer's time is not enforcement. It is what the enforcement is anchored to.
One binary, on the machine
Ultra runs locally on each user's machine as a single binary. MCP clients launch it as a subprocess, and all processing happens on-device — the documentation is explicit that there are no cloud components in the data path. The client sees Ultra as one MCP server; Ultra connects to the real servers behind it and presents their combined tools as a single interface.
Every request crosses an interceptor chain on the way out and the same chain in reverse on the way back: trace, logging, audit, metrics, governance, guardrails. Policy is configured centrally and synced down to every gateway, so a fleet shares one policy surface without a cloud hop on the request path. For a security team that cannot send agent traffic to a vendor, this is a genuinely strong property, and it is why the deployment and data-residency row comes out level.
Enforcement is real, and it is pre-execution
There are four enforcement modes: block, alert, monitor and redact. Block returns a structured error and the call never reaches its server. Redact masks matched content in both the request and the response and lets the call proceed. Guardrails are fail-closed — if an evaluation errors or an evaluator is unavailable, the request is blocked regardless of the configured mode. That is a deliberate and defensible design, and it is why the masking row is a tie.
The built-in set is substantial: parameter validation against path traversal and shell injection, credential-file and cloud-metadata blocking, PII detection with Luhn and IBAN validation, rate limiting, and a circuit breaker. One control deserves particular credit — tool and server isolation tracks the values a session has read from one server and blocks them from being written to a different one, which stops the read-here-send-there exfiltration pattern that most policy engines cannot express at all.
The protocol is the boundary
Everything above applies to MCP. That is a large and fast-growing surface — it is how coding agents and desktop assistants reach GitHub, Postgres, Slack and Salesforce today — and governing it completely is a real accomplishment. It is also a boundary with a definite edge.
- Same machine, different path.Ultra is on the endpoint, deployable zero-touch across a fleet. It sees what crosses the proxy. A process on that same laptop calling a REST API directly, or running a CLI against production, is not on that path.
- The browser.The documented clients are desktop applications and IDEs. An agent acting inside a browser session is not making MCP calls through a local proxy, and no browser enforcement point is described.
- Agents you do not run.Every documented deployment path is an employee machine, an MDM-managed fleet or a cloud development environment. A customer-facing agent lives outside all three.
None of these are shortcomings in what Ultra built. They are the shape of a product that chose one protocol and governs it thoroughly. The question for a buyer is whether the agents they are accountable for stay inside that shape.
Who the record names
This is the row that decides the page, and it is closer than the category usually is. Ultra does resolve a human. Its identity model is documented as covering every person, service account and device making MCP tool calls, and members arrive through SSO and SCIM from the organisation's own directory.
Attribution then resolves through three tiers, in order. Authenticated: the event carries a real session user, and that is genuine per-action human attribution. Gateway-attributed: no session user, so the gateway's owner is credited instead — accountability lands on whoever owns the machine rather than on whoever acted. Unattributed: neither is available, and the traffic is grouped under a client principal such as claude-desktop with a version number.
Ultra surfaces the lower two tiers as work to be done, with an assurance badge on every identity and an unattributed-activity view to work through. That is the honest way to build it. It also means the record's answer to who is answerable for this action is a confidence level rather than a name — and the agent itself is a fingerprinted client, not an identity object with a lifecycle of its own.
Agen inverts the order. The agent is a first-class identity carrying a named accountable owner before it does anything, and every individual action is attributed to that person at the moment it happens, judged in context in under 30ms. There is no fallback tier, because attribution is a precondition of acting rather than a property recovered afterwards.
What is inline and what is scheduled
Ultra's guardrails are inline and deterministic. Its behavioural layer is not, and the documentation is refreshingly direct about it: anomaly detection runs as a scheduled background process in the cloud console on a cadence between fifteen minutes and twenty-four hours, and individual gateways do not evaluate calls inline. An LLM scores traffic across seven threat categories using full session history rather than isolated calls, which is a better analysis than a real-time check could do — arriving after the actions it describes.
Both designs are defensible and they answer different questions. It is worth knowing which layer catches what, because the deterministic rules are the ones standing between an agent and a destructive call.
What it costs to run
Ultra publishes no pricing page. The site commits to free to start, scaling with usage, and no per-seat, per-host or SSO charge — a buyer-friendly answer, and not per-seat, which is the failure mode this row usually catches. Enterprise SSO sits on the Enterprise plan. Time to a first governed call is short: one binary, point the clients at it, or push it zero-touch through Jamf with SCIM resolving each gateway to an employee.
Where Ultra is strongest
- Ecosystem reach, and the row they win.Their server registry scores every MCP server on a 0–100 composite across eleven signals, scans each version for injection, secrets, CVEs and obfuscation, and signs the results into a public transparency log — across every major public registry. We are a focused platform rather than a marketplace, and this is the row where that shows.
- On-host deployment, scored level.All processing on the device, storage local by default, offline operation, optional sync. For a team that cannot route agent traffic through a vendor, that is decisive, and we score level on it.
- The audit guarantee, scored level.Their audit layer blocks a successful operation if it cannot be recorded, while every other layer in the pipeline absorbs errors silently. Choosing completeness over convenience in exactly one place is the right place to choose it.
- MCP governance and data protection, scored level.Per-call allow and deny, masking in both directions, and cross-server exfiltration tracking. On the protocol they chose, they are as deep as we are.
Ultra Security
