01
Who can do what?
Every team connects AI its own way. Without one central point there is no consistent permission model, and credentials end up scattered across scripts and tools.
Scariv ONE
The AI layer you own.
Scariv ONE connects AI assistants, agents and language models securely to your systems via MCP gateway, LLM gateway and agent runtime in one platform, with permissions down to the individual action, a complete audit log and full cost control.
No subscription. You get the complete SDK with source code, for a one-time payment and with a lifetime license.
- One-time payment, no subscription
- Full source code
- On-premises or cloud
- No license fees per user or call
Dashboard
Live
Connections
- SAP ECC
- Microsoft Dynamics
- Power BI
- Zendesk
- Shopify
Daily model budgetForecast €18.40 of €50
Today
2,204 checked
37 denied
1 stopped
Latest
ALLOW
zendesk.tickets.read
€0.002
Why an AI layer
AI needs access. Your company needs control.
Once assistants stop just answering and start looking things up in SAP, replying to tickets or pulling reports, three questions come up.
02
What happened?
When an agent changes an order, you need to be able to trace who instructed it, which tool ran and what the result was.
03
What does it cost?
Token costs are spread across many models and accounts. Without budgets and limits, you only see the bill once it arrives.
Scariv ONE is the one place all AI access runs through: checked, logged and with its cost attached.
Architecture
One layer between AI and your systems.
Interfaces and agents only talk to Scariv ONE. Every request is checked, executed with stored credentials and logged. Your systems see exactly one properly authorized client.
Without Scariv ONE
- Every assistant is connected to every system separately
- Credentials are scattered across scripts and tools
- Each system handles permissions its own way
- Model costs are spread across many accounts
- Logs are missing or scattered across many places
With Scariv ONE
- All assistants and agents run through one shared system
- Credentials are stored encrypted in the credential vault
- Permissions are managed centrally, down to the individual action
- Budgets and limits per team, model and system
- Every access lands in the audit log, with result and cost
How it works
The path of a request. Checked before anything happens.
- RequestAn agent calls a tool, for example “open tickets for customer 4711”.
- IdentityScariv ONE recognizes the user and the agent through your SSO, for example Entra ID.
- PolicyIs this user allowed to perform this action in this system? Is there room in the limit and budget?
- ExecutionThe connector calls the system. Credentials stay in the vault, the agent never sees them.
- LogResult, duration and cost land in the audit log and on the dashboard.
audit.log
Sample data
Sample audit stream with allowed, denied and rate-limited requests.
In detail
Full control. Down to the individual action.
Permissions, credentials, costs and models: what Scariv ONE governs between AI and your systems.
Permissions
Every agent does only
what it’s allowed to.
You define once, centrally, who may read, write or delete. The rule applies to every connected system, down to the individual action.
Included
- Roles for organization, team and user
- Per-action rules
- SSO via Entra ID, OIDC or SAML
- Kill switch per connection
Sample rules
Support agent
Zendesk
tickets.readallowedtickets.replyApprovalallowedtickets.deleteblocked
Shopify
orders.listallowedorders.refundblocked
Credential vault
Agents never see a password.
OAuth tokens and service accounts are stored encrypted in one place. The agent gets the result, never the key. What it has never seen, it cannot leak, not even through prompt injection.
Costs
Budgets before the bill arrives.
Budgets per team, project and model, warnings before a limit is reached and the cost of every single request. You see who is spending what while you can still adjust course.
LLM gateway
Use the LLM gateway
you trust.
Our LLM gateway makes it easy to connect a router: the Scariv Router comes preconfigured, alternatively OpenRouter, Amazon Bedrock or another service. Which model a request gets is governed in Scariv ONE by cost, quality or data classification.
Router
Fallbacks and availability are handled by the connected router.
Free choice
New assistant, same tools.
Connections, permissions and rules live in Scariv ONE, not in the assistant. Switching or adding an assistant requires no new integration.
Platform
Everything an AI layer needs. In one package.
Three gateways at the core, surrounded by everything you need to run it securely across your company.
MCP gateway
One endpoint for all MCP servers, your own and third-party. Central tool registry, routing and versioning. Agents only see the tools they are allowed to use.
LLM gateway
One interface for all language models, whether OpenAI, Anthropic, Mistral or local, provided through a router service of your choice: the Scariv Router preconfigured, billed by tokens, or a third-party service such as Amazon Bedrock or OpenRouter, connected in a few steps.
Agent runtime
Agents with tools, sub-agents and streaming run directly on the platform, under the same rules as every other access.
Permissions & SSO
Roles for organization, team and user, down to the individual action. Integration with Entra ID, OIDC or SAML.
Credential vault
OAuth tokens and service accounts are stored centrally and encrypted. No agent ever gets to see a key.
Audit log
Who, which tool, which action, when and with what result. Exportable for audits and SIEM.
Cost control
Budgets per team, project and model, with warnings before it gets expensive. Cost per request at a glance.
Rate limiting
Limits per user, agent and system protect SAP and other systems from load spikes caused by overeager agents.
Kill switch
Any connection can be stopped with one click. Effective immediately, no deployment needed.
Admin dashboard
Connections, costs and logs at a glance.
MCP, API & documentation
Every function available via MCP and REST API, fully documented with an OpenAPI specification and examples.
Connector SDK
Connect new systems in a few lines of Python. Permissions, audit and limits apply automatically.
Comparison
The platform is yours. Code included.
Gateway platforms usually come as a cloud service on a subscription. At its core, Scariv ONE does the same, but ships as a complete SDK. You buy the platform, not access to it.
Criterion
Typical subscription gateway
Scariv ONE
Cost
Recurring fee, often per user or per call
One-time payment & lifetime license, models billed by usage
Source code
Not accessible
Complete, readable and auditable
Customization
Feature request to the vendor
Extend or change it yourself, anytime
Data
Usually flows through the vendor’s cloud
Stays in your infrastructure
Operations
Vendor cloud, self-hosting often only on the enterprise plan
On-premises, your own cloud or operated by Scariv
Dependency
The vendor sets prices and roadmap
You decide if and when to update
SDK
Built to be changed.
Scariv ONE is not a closed product but a cleanly structured SDK. A new connector is a Python class, a new tool is a method. Permissions, audit log, limits and costs attach automatically.
What’s included
- Complete source code (Python, FastAPI) in your own Git repository
- Admin dashboard as a standalone frontend
- Connector templates for SAP, Microsoft Dynamics, Power BI, Zendesk, Shopify, Google Workspace and more
- Container setup for running on Docker
- MCP and API documentation, architecture documentation and examples
connectors/zendesk.py
Example
from scariv_one import connector, tool, Access
@connector("zendesk", auth="oauth2")
class Zendesk:
"""Expose support tickets to agents."""
@tool(access=Access.READ, rate_limit="60/min")
async def open_tickets(self, customer: str) -> list[Ticket]:
return await self.api.tickets(customer, status="open")
@tool(access=Access.WRITE, approval=True)
async def reply(self, ticket: int, text: str) -> Ticket:
return await self.api.reply(ticket, text)Deployment
Runs where your data lives.
One codebase, three ways to run it. You can move later at any time, because code and license stay with you.
On your premises
On-premises in your own data center, right next to SAP and your other systems. Data only leaves your network if you use a cloud model.
In your cloud
As containers in your environment, whether Azure, AWS, Google Cloud or Hetzner. With your own network and security rules.
Operated by Scariv
We run your instance on servers in the EU and take care of updates and monitoring. Code and license still remain yours.
License
Pay once.
Use it forever.
- Perpetual usage rights for your company
- Complete source code, free to modify and extend
- No license fees per user, agent or call
- Run it wherever you want
- Your version keeps running, even without a maintenance contract
Optional add-ons
- Maintenance contract with new versions, security patches and support
- Setup and integration of your systems by Scariv
- Custom connectors and agents for your processes
- Scariv Router as cost-optimized model access, billed by tokens
Price
on request
Request a quote
The language models themselves are not part of the license: through the Scariv Router you pay by tokens.
FAQ
Frequently asked questions. Answered briefly.
What is MCP, anyway?
The Model Context Protocol is an open standard that lets AI assistants and agents use tools and data. Without a gateway, every agent talks directly to every system. Scariv ONE brings these connections together in one place and adds permissions, limits and logging on top.
What exactly does lifetime license mean?
You pay once and may use, run and modify Scariv ONE in your company indefinitely. There is no subscription and no shutdown. The details are set out in the license agreement.
Do we need our own developers?
No. Scariv sets up the platform and builds the connectors for your systems. If your team wants to develop on its own, it can step in at any time: the code is built for exactly that.
Which language models are supported?
All common cloud models, for example from OpenAI, Anthropic, Google and Mistral, through one shared access point. Plus local models in your own network. Which model is used for what is controlled by rules based on cost, quality or data classification.
What about updates?
With a maintenance contract you receive new versions, security patches and support. Without one, your version keeps running unchanged. Your own connectors live in clearly separated modules, so updates don’t overwrite them.
How is Scariv ONE different from subscription gateways?
Functionally, much is comparable: gateway, permissions, audit and monitoring. The difference is ownership. You buy the platform including its source code instead of paying for access indefinitely, and you decide how it evolves.
What does model usage cost?
The license covers the platform, including the LLM gateway. The models themselves are not included: the Scariv Router is preconfigured, and you pay for the tokens you use. Switching to other gateways such as OpenRouter or Amazon Bedrock is possible at any time, without rework.
Let’s build your AI layer.
We’ll show you Scariv ONE live: gateway, permissions, dashboard and audit log, ideally with your system landscape in mind.
Or write directly to founders@scariv.com.
Scariv