01 What limits your agents?
Rules for every tool.
Allow or deny each MCP tool, by server and by key. Restrict a key to models, providers and IP ranges, with rate limits and USD budgets.
Agents act. People decide.
Rules and human approval for AI agent actions.
Route your agents' MCP servers through Tracelane. Set rules per tool and require human approval.
Apache-2.0 · Self-host · No credit card
Five questions supervisors are asking
Each one answered in the product.
02 Who approves their actions?
A person, one call at a time.
A matching call waits for a workspace owner. Each approval covers one call with those exact arguments, is used once, and expires.
03 Can you audit their decisions?
Every step on one trace.
Model calls through the gateway, and the agent and tool steps your SDK or OpenTelemetry sends, on one trace. Gateway calls and guardrail verdicts are hash-chained, signed, and verify offline with open-source tools.
tlane — verify
# verify any trace offline — no trust in us required
$ tlane verify ./audit.ndjson --tenant-pubkey <b64>
✓ tlane verify: PASS
✓ hash_chain_valid: true · signatures_valid: true
✓ anchors_included: 12 (Sigstore Rekor v2)
# anchoring is per-batch and best-effort; coverage is partial; an unanchored root still verifies SDK and OpenTelemetry spans are captured, not chained. How the ledger works
04 Is a person involved?
Named people, not keys.
On the hosted service only signed-in workspace owners approve, never an API key. Every control change is logged with who made it.
05 Can you shut them down?
One action stops everything.
Pause all model and MCP tool traffic for a workspace in one action. Keys revoked in the dashboard are refused on their next request.
Questions paraphrased from Reuters reporting of 13 Oct 2026 on the Federal Reserve, OCC and FDIC, as summarised by Bloomberg Government. What is in development for each question
Also in the gateway.
Guardrail verdicts, recorded.
Inline heuristic guardrails check requests at the gateway. Every verdict is recorded. What the guardrails cover
What each agent costs.
Spend by API key, model, provider and user, on your own provider keys with 0% markup.
205 providers
6 native adapters and 199 catalogued OpenAI-compatible providers, one endpoint.
Provider listQuestions.
What is Tracelane?
Apache 2.0 Rust gateway, OTel observability and audit ledger. Events are SHA-256 hash-chained; every 100 events per tenant, the Merkle root is Ed25519-signed. OTLP/SDK traces are not chained. Details
Is Tracelane really open source?
The core is Apache 2.0. The AFT-1 spec at /spec/aft-1 is CC0. Paid features are gated at the application layer. Details
Which providers are supported?
205 providers: 6 native adapters plus 199 catalogued OpenAI-compatible providers. Self-hosters can set their own base URL. Details
Does Tracelane support EU AI Act Article 12?
Ledger on every tier; the Article 12 export is in preview, not yet sold, and lacks per-record inclusion proofs and a signed completeness attestation. No per-tenant region enforcement, signed BAA or regulatory-conformance claim. Details
What's the latency overhead?
Measured added latency, excluding provider time: 2ms p50, 4ms p95, 5ms p99, capture on. Breakdown Method
Can I self-host?
Docker Compose runs gateway, ingest, NATS and ClickHouse on local disk; S3/R2 cold storage is a by-hand step. Helm is on the roadmap. Self-hosting guide
Start with one MCP server.
One email when something ships. Reply to any message and you are removed.
Tracelane is a member of NVIDIA Inception.
© 2026 NVIDIA, the NVIDIA logo, and NVIDIA Inception are trademarks and/or registered trademarks of NVIDIA Corporation in the U.S. and other countries.