formal.ai valid

Formal

Formal is a protocol-aware reverse proxy that enforces least privilege on every query. It secures access to databases, APIs, AI agents, and infrastructure by parsing wire protocols natively and evaluating policies inline with sub-10ms p50 overhead.

For agents: Protocol-aware reverse proxy enforcing least-privilege access to databases, APIs, AI agents and infrastructure, with docs, OpenAPI specs and agent git-push bloc

least privilege accessdatabase securityai agent securityprotocol-aware proxyzero trust

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T23:22:10.299Z. Cached copy · Source on formal.ai

# Formal

> Formal is a protocol-aware reverse proxy that enforces least privilege on every query. It secures access to databases, APIs, AI agents, and infrastructure by parsing wire protocols natively and evaluating policies inline with sub-10ms p50 overhead.

Formal is a single stateless binary deployed in your VPC. It supports 15+ protocols including Postgres, MySQL, MongoDB, Snowflake, SSH, Kubernetes, HTTP, MCP, S3, Redis, RDP, gRPC, BigQuery, ClickHouse, and DynamoDB. Every identity (engineer, BI tool, CI/CD pipeline, AI agent) connects through the proxy, where policies are evaluated in real-time. No application changes, no SDK, no agents.

Key capabilities:
- 9 policy actions: Allow, Block, Mask, Filter, Rewrite, Quarantine, Suspend, MFA, Impersonate
- Multi-stage policy pipeline evaluated at session, request, and response stages
- Wire-protocol-level query rewriting, column masking, and data filtering
- Policy impact reports with up to 31 days of backtesting before enforcement
- Full session auditing and forensic-grade logging across every protocol
- Real-time LLM-powered anomaly detection for live sessions
- AI agent and MCP server security: strip PII, block unauthorized tool calls, audit agent actions
- API-first with Terraform provider, Pulumi provider, and REST/gRPC API
- SOC 2 Type II, HIPAA, GDPR, and PCI DSS compliance support

## Documentation

- [Formal Docs](https://docs.formal.ai): Full product documentation, setup guides, and API reference
- [Security](https://security.formal.ai): Security posture and compliance information
- [Status](https://status.formal.ai): Service status and uptime

## Customer Stories

- [Cursor](https://www.formal.ai/customers/cursor/index.md): How Cursor gives engineers and AI agents secure access to model weights, training data, and infrastructure with Formal
- [Notion](https://www.formal.ai/customers/notion.html): How Notion uses Formal for database access governance
- [Gusto](https://www.formal.ai/customers/gusto.html): How Gusto uses Formal for automated data protection
- [Modern Health](https://www.formal.ai/customers/modern-health.html): How Modern Health scales cybersecurity with Formal
- [ManoMano](https://www.formal.ai/customers/manomano.html): How ManoMano secures data access with Formal

## Blog

- [The Permission Pitfall of MCP](https://www.formal.ai/blog/permission-pitfall-mcp.html): Why MCP servers need granular permission enforcement
- [Using Proxies with Claude Code](https://www.formal.ai/blog/using-proxies-claude-code.html): How to secure AI coding agents with protocol-aware proxies
- [Fine-Grained Connector Logs](https://www.formal.ai/blog/fine-grained-connector-logs.html): Deep observability into every proxied connection
- [Allowlisting Bash Commands](https://www.formal.ai/blog/allowlisting-bash-commands): Controlling command execution through SSH proxies
- [SSH Port Forwarding and SSM](https://www.formal.ai/blog/ssh-port-forwarding-ssm.html): Secure SSH access patterns with Formal
-
…

Related sites

Other listed sites in AI and machine learning. See the whole category →

Machine-readable: GET /v1/resolve?q=formal.ai · GET /v1/domain/formal.ai · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for formal.ai:
1. POST https://agentwebmap.com/v1/sites/formal.ai/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://formal.ai/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/formal.ai/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/formal.ai).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.