Steward
A secure bridge between Microsoft Copilot and other remote AI clients and the MCP servers you already run — keeping access bound to the actual user identity all the way to protected enterprise resources, without substituting another identity.
Make existing MCP servers usable by enterprise AI without changing who the user is
Remote AI clients create a deceptively simple integration problem. The AI can authenticate at the front door, but the useful work often happens somewhere else: a file share, a server, a database using integrated authentication, an internal application, or an MCP server that was built for local STDIO use.
Steward provides the controlled connection between those worlds. It accepts authenticated remote MCP access from approved AI clients, makes existing tool-oriented STDIO MCP servers available without requiring them to be rewritten, and keeps access to configured protected enterprise resources bound to the actual requesting user identity — without substituting a shared service account or another backend identity. The permissions your organisation already trusts remain authoritative.
- Built for Microsoft Copilot and compatible Streamable HTTP MCP clients.
- Microsoft Entra ID authentication at the enterprise boundary.
- Use existing tool-oriented STDIO MCP servers without modifying their code.
- Keep protected-resource access bound to the identity of the user who made the request, without substituting a shared backend account or another identity.
- Carry the user’s existing permissions to configured file shares, servers and databases using integrated OS authentication.
The user should remain the user
One identity, end to end
A request that starts with Alice stays bound to Alice when it reaches the protected resource. Her identity is not silently replaced by a generic service or gateway identity.
Files, servers and databases
Existing file, server and database permissions remain authoritative. Where a database uses integrated OS authentication, it can be accessed as the user who made the AI request — not through a substituted shared identity.
No shadow authorisation model
Avoid recreating years of enterprise access decisions in a second set of MCP-specific roles simply because the client happens to be AI.
Keep the MCP servers you already have
Many useful MCP servers are ordinary local processes built around STDIO. Replacing them with custom remote services just to satisfy a new AI client adds development, deployment and security work without adding business value.
Steward lets existing tool-oriented STDIO MCP servers remain focused on the job they were written to do while placing them behind a secure enterprise boundary. They do not need to become remotely exposed services or take on a new authentication model; Steward keeps protected-resource access bound to the actual user identity while the MCP server remains the MCP server.
The result is more than reuse. A local STDIO server can become safely usable from approved remote AI without being turned into a new public-facing service, without inheriting a broad shared identity, and without forcing its own code to reproduce the organisation’s access model.
Compatibility: Steward is designed for MCP tool servers. Existing tool-oriented STDIO MCP servers can normally run unchanged. Servers that depend on client-side sampling, elicitation, subscriptions or other server-initiated MCP interactions may require adaptation.
Copilot asks. Alice accesses.
If Alice asks Copilot to read a file, Alice reads the file. The access is made under Alice’s identity and Alice’s existing permissions. Copilot is the interface through which she asks; it does not become a new all-powerful reader of the file estate.
That distinction extends well beyond files. If Alice asks Copilot to query a database that uses integrated OS authentication, the database access occurs as Alice — not as Copilot, not as Steward, and not as a shared service account. The same principle applies to other configured enterprise resources that use the organisation’s existing Windows identity.
The protected resource authorises Alice first. Copilot receives only the information returned by the MCP operation that Alice was authorised to perform; it is not independently granted a broader file, server or database identity.
Designed for the awkward part of enterprise AI
The hard part is rarely getting an agent to call a tool in a demo. The hard part is letting thousands of real users call internal tools without replacing their identity, broadening their permissions, or rebuilding every backend integration for AI.
- Connect remote enterprise AI to approved internal MCP capabilities.
- Keep access bound to the actual user identity, without substituting it with another identity.
- Reuse compatible local MCP tool servers that already work.
- Reach configured file shares, servers and databases using integrated OS authentication as the user who made the request, under that user’s existing permissions.
- Keep the gateway concern separate from the business logic inside each MCP server.
Expose only what you intend to expose
Steward is not an unrestricted route from AI into a Windows estate. Administrators define the MCP capabilities that are available and the enterprise resources those capabilities are intended to reach.
- Authenticate enterprise AI access with Microsoft Entra ID.
- Restrict access to approved client applications and delegated access scope.
- Expose explicitly configured MCP backends rather than allowing the AI to choose arbitrary programs to run.
- Keep access to configured protected resources bound to the requesting user’s own identity and permissions.
- Apply global and per-user limits to protect gateway capacity.
- Limit inbound request size at the gateway boundary.
- Audit user, endpoint, tool, latency, traffic and outcome.
- Provide separate read-only operational monitoring for gateway health and activity.
Troubleshooting with live logs
Independent background reading
Have an existing STDIO MCP server you want to expose securely?
Tell us what the AI client needs to reach and which existing user permissions must remain authoritative. We can assess the fit without changing your MCP server first.
Discuss your environment