Palma.ai Raises $1.8 Million to Police Agent Tool Calls

Palma.ai has raised $1.8 million in pre-seed funding to police what enterprise AI agents do once they can touch company systems. The remote-first company sits in front of Model Context Protocol connections and applies rules at the moment of each tool call.

MCP already lets those agents reach internal data and software. It still does not decide which person may use which tool, hold a risky call for a human, or keep the record an auditor later asks for. That leftover job is the product.

D11Z Leads a $1.8 Million Pre-Seed

D11Z led the round. Plug and Play Ventures, Deel, and Scale Now Ventures joined, along with angels who include executives from Cisco and Deel. Palma.ai will put the money into go-to-market and engineering as it tries to reach more companies that are already putting agents on live systems.

Patrick Eden is chief executive and co-founder. He previously co-founded an infrastructure monitoring company that exited to Cisco in 2021, with Fortune 100 customers, and he lists a volunteer board role at the World Economic Forum. Julian Kolbe is chief technology officer. He has spent more than a decade on secure systems for European fintech and automotive firms, including financial platforms that process billions in transaction value.

Palma lists a San Francisco address at 2261 Market Street and describes itself as remote-first, with open roles in marketing, product design, sales, and platform engineering. The pitch to buyers is blunt.

Every company is about to give AI agents the keys to its systems. The question is whether anyone is watching the door.

Patrick Eden, CEO and co-founder, Palma.ai

He said the company built the product so firms can hand agents real permissions and still know who did what, with which tool, under which policy, across the platforms an enterprise already runs.

The Protocol That Outran Permission Checks

Anthropic released MCP in late 2024 as a common way for models to call tools and read company data. By 9 December 2025 it had been donated into the new Agentic AI Foundation under the Linux Foundation, alongside Block’s goose and OpenAI’s AGENTS.md. Platinum members at launch included Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. The launch note put published MCP servers above 10,000.

Palma joined that foundation as a Silver-tier member on 1 February 2026. Eden’s line then was that MCP makes agents faster and more capable, and that Palma makes MCP usable inside a company. The second half of that sentence is the whole business.

HOW MCP REACHED THE ENTERPRISE DOOR

1. Late 2024: Anthropic open-sources MCP so models can call tools and read internal data through one handshake.
2. March 2025: The spec adds OAuth 2.1. Wiz later finds almost every exposed server still speaking the original 2024-11-05 version.
3. 9 December 2025: MCP moves into the Agentic AI Foundation, with more than 10,000 published servers at the handoff.
4. 1 February 2026: Palma.ai joins AAIF as a Silver member and starts feeding enterprise feedback into the standards talk.
5. 2 August 2026: The European Commission begins enforcing AI Act rules and new transparency duties, with company fines up to €15 million or 3% of global annual turnover.
6. 23 September 2026: Palma closes the $1.8 million pre-seed to sell runtime control of those same tool calls.

The protocol did what it was written to do. It made a file server, a CRM, a mailbox, and a database look the same to an agent. Each assistant then kept its own permission model. IT lost the single door it had for human users.

Wiz Found MCP Servers in 80% of Clouds

Wiz Research, in a 28 July 2026 note that cites its State of AI in the Cloud 2026 work, says MCP can be found across 80% of cloud environments. About 1 in 6 of those environments expose at least one MCP server to the internet, often with no login. The researchers found unauthenticated servers at Fortune 500 firms. Some handed back employee records. Some advertised write and delete tools against production systems. A few could run code or reach cloud credentials.

WIZ RESEARCH ON EXPOSED MCP SERVERS

One server returned a named person’s retirement-account balance with no login at all. Another proxied an internal issue tracker that held security cases and hardcoded credentials. A BI platform listed query_sql next to tools that enumerated every connected database. An IAM backend advertised add_application, update_application, and delete_application. Wiz did not fire the write tools, so it cannot say each one would have executed. The catalog still offered them to anyone who connected.

A malicious call on these boxes looks like a normal one. The server uses the same stored credential it always uses. The backend sees an authorized request. There is no failed login to trip an alert. That is the second-order cost of a protocol that describes itself by default: reconnaissance is built in, and one generic client can speak to any server on the public internet.

What MCP Still Leaves to the Operator?

MCP says how a client authenticates to a server and how a tool is described and called. Palma’s own definition of the leftover work is specific, and it matches what security teams keep running into after a pilot works in a single IDE.

WHAT THE PROTOCOL DOES NOT DECIDE

• Who may call what: MCP does not bind a named employee to a named tool, or to the arguments inside that call.
• Human hold: Nothing in the handshake pauses a high-risk action for a named approver mid-flight.
• The audit file: The spec does not keep the record that ties a person, an agent, and a host app to a denied or allowed call.
• Secret handling: Servers still ship with backend tokens baked into the deployment, which is how Wiz pulled live data from anonymous callers.
• Shadow installs: A personal API key in a laptop IDE never touches the approved path, so the protocol cannot see it.

Identity vendors have started to put the company directory back into the first connection, so staff are not clicking through a consent screen per server. That still answers a different question. It decides whether a client may talk to a server. It does not read the amount in a payment call, the channel in a message, or the table in a query after the token is minted. Runtime remains an operator problem.

On 2 August 2026 the Commission began enforcing the Artificial Intelligence Act and new transparency rules. Chatbots and other interactive systems have to tell people they are dealing with AI. Deepfakes need labels. Company fines run up to €15 million or 3% of global annual turnover. Palma sells its tamper-evident trail into that window. The Act’s August duties are mostly about disclosure, not a mandate to buy an MCP gateway. Buyers who need a sign-off for write access will still ask for a log.

A Catalog Already Full of Gateways

$1.8 million is a small cheque for a job that Docker, Microsoft, Kong, Amazon, and a long list of startups are already pitching. Dedicated control products such as MintMCP, Runlayer, and Willow sit next to open-source boxes such as Docker MCP Gateway and Microsoft’s Kubernetes gateway. API vendors have bolted MCP onto the gear enterprises already pay for. Open-source proxies promise the same allow-and-deny story for a team that will self-host.

The honest read of that shelf is not that Palma invented the category. It is that MCP’s success created a control-plane market the spec authors did not productise. Developers want the agent to update the CRM. Security wants to know which CRM row, under which policy, in which client, and they want the denied calls in the same file as the allowed ones. Until that fight is settled, pilots stall at review, which is why a pre-seed company can raise at all.

D11Z is not only writing a cheque. A D11Z investor named Patrick, quoted on Palma’s site as both backer and user, said the product gave their agents “governed superpowers” and called agent control at scale one of the hardest problems in AI right now. That dual role is the tell. The people closest to the round already needed the door watched on their own stack.

One Connector Follows Staff Across Claude and Copilot

Palma’s design is one governed connector per person, handed out from Entra or Okta group membership, carrying every approved MCP server and every Skill that person is allowed to use. A joiner gets it on day one. A leaver loses it when the group changes. The same connector is meant to follow the employee into Claude, ChatGPT, Microsoft Copilot, Cursor, Gemini, or a custom workflow, so a team can swap assistants without re-approving the tools.

ROUND AND PRODUCT SNAPSHOT

• The raise: $1.8 million pre-seed, led by D11Z, with Plug and Play Ventures, Deel, Scale Now Ventures, and Cisco and Deel executive angels.
• The unit of control: One connector per person, not one integration per assistant.
• The three names: Every call stores the user, the agent acting for them, and the host client, including denials and holds.
• Where it runs: Typically VPC or on-prem, including air-gapped, on Docker, Kubernetes, or bare metal, with a hosted option if a buyer wants one.

A tool, in Palma’s vocabulary, is a verb such as send an email. A Skill is the playbook that says when and how to use that verb, versioned as a content-hashed snapshot and scanned before it is served. Policies can allow, deny, or flag on the actual arguments of a call, which channel, which amount, which fields, not only on the tool name. High-risk calls pause for a named person. PII and secrets are supposed to be redacted on the wire. Outbound access can use RFC 8693 token exchange and vault-held credentials so the agent never holds the downstream secret. The audit trail is described as tamper-evident, checkable offline with the customer’s own key, and streamable to the SIEM already in place.

We see almost every company building in this space. Most are building MCP gateways for engineering teams of five or ten. Palma is a governance layer designed for enterprise scale and enterprise processes, which is why we did not just invest, we run it ourselves.

Caro, Plug and Play, on Palma.ai

That five-to-ten-person jab is the competitive line. Whether a $1.8 million company can out-distribute Microsoft’s own gateway, or Docker’s, is a later round’s problem. This round only has to put salespeople in front of security teams who have already been asked to bless write access.

The Gap Palma Does Not Close

Palma is explicit about the hole in its own coverage. It governs traffic that passes through its connector and notices when a connected server changes its tools. It does not find every unmanaged server on every device. A laptop still running a community MCP with a personal key is a network and endpoint problem, not a gateway problem. Any vendor that skips that sentence is selling a complete inventory they do not have.

The raise does not change the physics of that bypass. It funds more engineers and more sales capacity while agents keep getting keys, often through the same protocol Wiz still finds speaking a 2024 dialect on the public internet. The second-order story is already in production. The control plane for it is still, in this case, a pre-seed.

Frequently Asked Questions

Does Palma.ai replace Okta or Microsoft Entra?

No. Palma is not an identity provider and says it does not want to be one. It reads groups the directory already maintains, supports OIDC and SAML single sign-on with SCIM provisioning and just-in-time user creation, and enforces those group decisions at the agent-to-tool call. Where a company already runs a policy decision point, that box stays the authority.

What is a Palma Skill compared with an MCP tool?

A tool is the verb, send an email, update a CRM row, query a ledger. A Skill is the versioned playbook that tells an agent when and how to use those verbs, how that company actually closes the books, runs an incident review, or qualifies a lead. Only scanner-passed, content-hashed versions are served, so a process is treated like other internal software rather than a prompt someone pasted into a chat.

Can Palma.ai see MCP servers staff install on their own laptops?

No. Shadow MCP, in Palma’s terms, is any integration outside the approved inventory, a community server nobody reviewed, or a personal key in an IDE. Reducing that risk starts with an inventory of clients, servers, and owners, plus endpoint and network controls on the bypass paths. The gateway only sees the route it sits on.

How does Palma.ai run inside a locked-down network?

The MCP layer and the control plane are designed to run on the customer’s own iron, Docker, Kubernetes, or bare metal, inside the network and in front of the customer’s MCP servers, including fully air-gapped setups. There is no shared tenancy in that mode, and Palma says it does not aggregate customer data on its side. It will host the stack if a buyer prefers that.