You connect Supabase to Cursor, ask for a small change, and a few minutes later your database is gone. Nobody meant for it to happen. The agent had access, the model is non-deterministic, and nothing stood between the two.
Early generative AI was mostly about thinking. You asked ChatGPT for a script, pasted it into VS Code and ran it yourself. Things changed once agents were plugged straight into the SaaS tools we run our work on, tools that were never designed for them.
In this episode of Build with AI, Tanguy Goretti (CTO at Hexa) talks with Timothé Husson (co-founder and CTO of Hodor). Before Hodor, Timothé spent seven years at early-stage startups in New York working on encryption and authentication, then moved into cybersecurity consulting. What struck him there was that most breaches start with a human error. Agents are now a new kind of player on the team.
A year ago he founded Hodor with Karim Boussetta. Hodor is an MCP gateway that sits between a company’s agents and its applications, and it won Innovation of the Year at VivaTech.
Agents don’t have an identity, they borrow yours
Timothé says the core issue is authorization, not authentication. Most agents have no identity of their own. They sign in with your Google account and act in your name. The goal is to keep the permissions an agent is allowed as close as possible to the behavior you expect, so a mistake or a hack has no room for side effects.
“It’s the non-deterministic side of AI that’s both the most beautiful thing about it and the most terrifying.”
One gateway in front of every app
MCP is great once a connection is up. The model discovers the tools, reads their schemas and knows right away how to use them. Getting connected is the hard part. There are API keys, usernames and passwords, and several flavors of OAuth, and many companies simply put an MCP layer on top of their existing OpenAPI endpoints without changing how sign-in works.
“It’s a plumbing exercise. You’re trying to fit square pegs into round holes.”
Hodor gives agents a single entry point. Claude, Codex or Dust connect to Hodor once, and Hodor connects to Slack, Jira, the database and everything else. Because every request and response passes through the gateway, Hodor can log all of them and strip personal data out of tool responses before the agent ever sees it.
Contracts: one use case, a handful of tools
Hodor syncs users and groups from the company’s identity provider (Okta, Google Workspace, Azure). Access is then handed out through contracts, which are sets of permissions assigned to a group. For each tool, an admin picks what’s exposed, rewrites tool descriptions to add company context, and adds rules such as “this SQL tool can run SELECT, never DROP.” The recommendation is one contract per use case, with only a few tools each.
The reasoning is what Timothé calls least agency, a term he credits to Anthropic. It’s not only about privileges. It’s about limiting what’s possible at all. He told the story of a private equity fund whose internal chatbot was asked about one person’s carried interest, then a few more questions, and ended up revealing every partner’s.
“You’re legitimate having all the rights you have, because of everything you’ve accomplished. An agent you created two or three days ago? You’re not handing it the keys to the truck.”
Code mode: two tools instead of 200
A typical production agent touches Sentry, Linear, PostHog, GitHub and a database, with 20 to 30 tools each. That adds up to almost 200 tool definitions sent to the model on every turn, eating the context window and the token budget. Exposing fewer tools already helps. Code mode goes further: the agent gets one search tool and one execute tool, and writes a script on the fly instead of chaining tool calls.
That’s faster and much cheaper, but it raises new questions: where credentials live, and how you audit a script compared with a single tool call.
“When you have to approve something that says DROP DATABASE, fine. When it’s a fifteen-line script, people click approve a lot faster.”
What pushes enterprises to act
The stories come out during sales calls, often reluctantly. In one, a large French company had just signed a customer worth more than €20B in annual revenue. An automated pipeline synced Gong call notes into Salesforce and picked up the detail that one contact worked on a team of about ten. The sync rewrote the company’s size in the CRM, routing sent the account to the mass-market support team, and a summer intern ended up onboarding the customer on a video call in front of 30 people.
Large companies don’t have the luxury of “move fast and see what breaks.” The usual buyers are a newly hired head of AI and the security team, and the two tend to pass the topic back and forth. Rollout takes three to four days on site. The hardest cases are companies where every department has already approved its own MCPs. Hodor’s largest customer has 100,000 employees, with a target of 70,000 to 80,000 users.
Where MCP is heading
Timothé is a fan of the protocol. The July release made it stateless, moved it closer to plain HTTP, and strengthened OAuth 2.1, including delegated, short-lived tokens issued by the identity provider. But some things shouldn’t live inside a communication protocol: a model can’t be judge and jury of its own permissions. Hodor is also expanding to CLIs and to locally run MCP servers.
“The idea isn’t to stay an MCP gateway. We’re the layer that protects your applications, which weren’t built for AI, from AI, while still letting you use them.”
From floaties to an intent model
Timothé compares today’s agents to a child, or an intern. The worst mistakes happen early in an agent’s life, when the prompt is weak and someone grants every permission “just to test.” Because Hodor sees all of an agent’s traffic, it is building models to spot unusual behavior and drift. Hodor can be fully self-hosted, and it doesn’t use that data commercially. The long-term goal is to adjust permissions dynamically: take the floaties off once the agent has earned trust, and keep a lightweight runtime check on whether each action is legitimate. The constraint is latency, which so far matters less than you’d think because MCP is already slow.
Takeaways
Give agents their own identity. An agent acting under your account inherits years of accumulated privileges it never earned. Give it a separate, narrow identity.
Scope by use case, not by tool. One contract per job, with a few tools, explicit rules and clear descriptions, beats one agent with access to everything.
Centralize the plumbing. A single gateway gives you one way to sign in, one audit trail and one place to redact data, whichever agent platform each team uses.
Lock it down at the proof-of-concept stage. That’s when prompts are weakest. Decide on purpose when a test becomes a real project, then define its architecture, connections and audit trail properly.
The bottom line
Agents become valuable when they can act, and that’s also what makes them dangerous. Hodor’s bet is that the answer isn’t better prompts or more approval clicks. It’s an access layer that treats each agent as a new hire with a narrow job description.
The long-term picture is permissions that grow with trust: strict at first, then loosened as the system learns how an agent actually behaves. And if HBO’s lawyers allow it, the gateway holding the door will still be called Hodor.
Subscribe to get future episodes of Build with AI.
