Ultra

Overview

Ultra is a runtime security platform for AI agents using the Model Context Protocol (MCP). It places a proxy between agents and their connected tools, applying governance rules and security guardrails before requests reach upstream connectors. Ultra combines local enforcement with centralized policy management, activity monitoring, and audit visibility through Ultra Hub, supporting employee devices and internal agent environments.

Classification

Coverage surface

MCPEndpointCloudSaaS

Stage

Launched

Type

Commercial

Target audience

EnterpriseMid-marketSMBDevelopersPublic Sector

Deployment

SaaSHybrid

Technical profile

Spec-grounded axes, verified by the TWG.

Interception architecture (R1)

Protocol Gateway

Policy model (R3)

Hybrid

Authorization decisions (R4)

ALLOWDENYMODIFYSTEP_UPDEFER

Conformance review

Platform capabilities

• Discovery and inventory of agents and connectors.
• Pre-execution interception of MCP tool calls through a local proxy.
• Connector, tool, and agent allow/deny rules, including a configurable default-deny posture.
• Built-in and custom guardrails with block, monitor, and request/response redaction modes.
• Centralized policies scoped to organizations, workspaces, and devices.
• Audit events recording actions, outcomes, agent identity, and user attribution.
• Asynchronous detection of suspicious activity across recorded MCP traffic.
• OpenTelemetry Protocol export of traces and metrics to external observability platforms.
• MCP configuration drift detection and remediation to bring connectors under management.
• MCP server security analysis and cryptographically signed trust signals through Ultra Ledger.

Architecture

Ultra’s documented design maps to AARM’s Protocol Gateway architecture. A local binary presents a unified MCP interface to the agent and routes requests to upstream connectors through governance, guardrail, and observability interceptors. Ultra Hub distributes policy and receives telemetry, while local storage supports operation during connectivity interruptions. This establishes an enforcement point for traffic routed through Ultra; coverage of every agent action, including shell, filesystem, and direct API activity outside MCP, requires separate evidence. Ultra architecture, AARM specification For R1, Ultra documents blocking before upstream execution and request-time fail-closed behavior for guardrail evaluation errors, with deployment-specific exceptions. Review must verify complete interception and failure behavior in the assessed configuration. New organizations start with guardrails in Monitor mode, so enforcement settings materially affect the result. Guardrail behavior For R2–R4, the reviewed documentation describes request-level checks and historical traffic analysis, but does not establish that accumulated task history and original user intent inform each authorization decision. Allow, block, and redaction provide mechanisms relevant to ALLOW, DENY, and MODIFY; STEP_UP and DEFER workflows, including their timeout behavior, remain unverified. Guardrails, AARM requirements For R5–R6, Ultra documents audit records with identity attribution. The reviewed materials do not establish signed, tamper-evident action receipts cryptographically bound to agent identity. Ultra Ledger’s signed server trust signals concern a separate evidence object and do not establish action-receipt conformance. Audit documentation, Ultra Ledger For R7–R9, scheduled anomaly detection does not establish semantic-distance tracking against the original task intent. OTLP export provides a documented basis for R8, subject to validation of required event coverage and schema. Tool-level access restrictions support least privilege, but action-specific credential scoping under R9 remains unverified. Anomaly detection, OTLP export, Governance The public evidence supports architectural alignment with AARM. Extended conformance requires an implementation evidence package and successful testing across R1–R9, together with verification of AARM’s organizational eligibility requirements. Undocumented capabilities remain unverified in this review. Conformance requirements