Gram is an AI Control Plane open-sourced by Speakeasy, positioned as a unified technology stack for securely using AI at scale within enterprise organizations. It serves both human users and AI agents, providing the ability to connect, protect, observe, and distribute agents, MCPs, and skills.
Main capabilities
-
Centralized management and distribution: Centrally manage company-wide accessible MCPs, Skills, and Assistants, and distribute them based on enterprise roles. Supports team-, server-, and tool-level permission control, enforced through RBAC and OAuth2.1, and can sync with enterprise identity providers (such as Okta, Azure AD, Google Workspace, etc.).
-
Security and policy enforcement: Performs real-time inspection and enforcement on every prompt, response, and agent action. Sensitive data can be blocked, redacted, or logged before leaving the environment. Supports creating and enforcing flexible policies to prevent prompt injection, log shadow use, and detect PII, secrets, and other sensitive data types.
-
Observability and cost management: Built on OpenTelemetry, it can track AI usage across teams and measure impact in tokens or cost. Supports in-depth analysis of high-cost sessions, creating budgets, and measuring tool effectiveness. Data can be exported and interacted with through the platform MCP and built-in assistant.
-
Connectivity and networking: Provides a single control layer for MCPs that connect agents to SaaS vendors, APIs, and internal systems, with built-in policy enforcement and fine-grained access control. Supports on-demand deployment of private networks and tunnels.
-
Audit and compliance: Every tool call, permission change, and access event is recorded and searchable. The project has obtained SOC 2 Type II and ISO 27001 certifications.
How to use
Users can choose to use Speakeasy's hosted platform by registering an account and referring to the quick start guide; they can also choose to run the open-source version locally. The main step for running locally is to execute the ./zero script, which installs dependencies, runs pending database migrations, and starts all services. The main dependencies are Mise and Docker; if not installed, the ./zero script will guide the installation. During local development, a seed script can populate a realistic and usable working environment for the local organization, including deployed APIs, agent sessions, telemetry data, risk findings, team members, and API keys;This script communicates directly with the database and can be run before services start; running it repeatedly will reset the seed data. If multiple branches need to be handled at the same time, each git worktree can run the full stack on its own port. More details about local development, authentication, worktrees, and the CLI can be found in CONTRIBUTING.md.
Technology stack
The dashboard uses TypeScript, the backend uses Golang, the API uses the design-first Goa framework, the workflow engine is Temporal, usage-based billing uses Polar, the LLM gateway is OpenRouter, and the SDK is generated by Speakeasy.
Use cases
Gram is suitable for organizations that need to uniformly manage AI usage within the enterprise, control the risk of sensitive data leakage, track AI costs and usage, and centrally distribute MCP and agent capabilities. It is especially suitable for enterprise teams with compliance requirements, needing integration with existing identity systems, and wanting complete audit capabilities.
Limitations and notes
Specific pricing, the specific plans of the hosted platform, the list of specific AI providers supported, and the detailed usage steps for each feature are not currently provided in the available information.
