Make it an organizational guarantee.
Central policy, retained audit, org budgets, and approval routing for every agent, pipeline, and service that brokers a credential.
| Question a platform team asks | Free CLI on each machine | With the hosted plane |
|---|---|---|
| Is every agent under the policy I wrote? | A local mayfly.yaml per repo | One versioned policy, pushed to every workload |
| What did the injected agent reach? | A local log file per machine | Retained, searchable audit across the fleet |
| Which agent burned the model budget? | Per-task caps | Org budgets per team and provider, with alerts |
| Does production need a human? | One Slack webhook | Approval routing, escalation, every decision audited |
| Can we prove it for SOC 2? | Export what you have | Fleet-wide evidence from all of the above |
How it connects
Workloads running the open-source CLI opt in with a cloud: block in mayfly.yaml. They pull policy and push audit over authenticated HTTPS. The plane never reaches into your network.
cloud:
base_url: https://cloud.mayflykeys.dev
project: <project id>
token: env://MAYFLY_CLOUD_TOKENPricing
Priced per active workload per month: an agent, a pipeline, or a service identity that brokered a credential that month. Not seats, because one engineer runs fifty agents. The free CLI stays complete for a single machine, forever.
API base: https://cloud.mayflykeys.dev · Design partners today; self-serve later.