Intramedial may send requests to other systems on its customers' behalf, such as gateway-forwarded agent calls and connector writes. If that traffic reaches you without your consent, or you see Intramedial used against the Acceptable Use Policy, tell us here. A person reads every report.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseFour kinds of report reach different teams. Choosing the right one gets yours read sooner.
The Acceptable Use Policy binds everyone who uses Intramedial, including in the demo workspace. In short: use the Service for lawful work on systems you are entitled to contact, do not abuse it, and do not misrepresent what a ledger record proves.
Good-faith security research that follows the responsible disclosure policy is not a breach of the Acceptable Use Policy. Responsible disclosure policy
Three Intramedial paths make requests to an address a customer chooses. If one of them points at your system, this is what the traffic looks like and what we need to find its source.
| Tool | What reaches you | Pattern |
|---|---|---|
| mcp.enforce | One POST per admitted agent call: a JSON-RPC tools/call with the tool and its arguments. | On demand, per agent call. Always POST, with a JSON body. |
| saas.admit | One request to a SaaS tool's API, as the customer's write map names it. | On demand. Writes are held for a person to approve first. |
| mcp.session | A request to the host an agent asked for. | On demand, one per agent call. The method is the one the agent chose; timing is not yet stated. |
| github.enforce | Commit statuses and check runs posted to api.github.com for a connected repository. | On each gated write. Goes to GitHub's API and nowhere else. |
Forwarded calls leave from Intramedial's gateway, so you see our address, not the customer's. We do not publish a fixed address range or user agent for this traffic, and the ledger entry names the agent.
A credential is the customer's own, leased from their connection at call time and sent only to the address they registered. We add no identity or signature headers of our own. The body is the agent's tool call.
Redirect handling, timeouts and reply size limits are not yet stated for the gateway; the ledger entry records what came back.
Which destinations a customer may register, and how each one is checked before a forwarded call is made, is not yet stated here, so ask us.
Your answers are part of the record. A forwarded call's ledger entry carries the status code you returned, and a high share of refusals from one host is a pattern our detection on forwarded calls looks for. You can refuse or rate-limit the traffic while we look.
The Acceptable Use Policy asks for four things. The more exact they are, the faster we can tie a report to a workspace.
A plain description: what happened, to which system or person, and why you believe it breaks the policy.
The time of the first and last event. If your logs use a local time, say which zone.
Any receipt id, URL or hostname involved. A receipt id is a 26-character code that starts with the time it was issued.
An email address we can write to if we need more. We use it only for this report.
Please do not send API keys, passwords or other people's personal data beyond what the report needs. The form refuses a report that contains a full Intramedial API key or access token.
Reports are reviewed and handled under section 3 of the Acceptable Use Policy. There is no automated decision, and we do not publish a turnaround time.
You get a reference of the form AR-20261026-XXXXXX on screen. Keep it for any follow-up.
We match the report to a workspace where we can. Automatic detection on forwarded calls can raise a flag, but a flag only asks a person to look.
We may warn the customer and ask for a fix; limit, revoke or suspend keys; suspend a workspace or account, immediately where there is harm or risk to others; or end access under the Terms.
We tell the customer why we acted, unless the law forbids it or telling them would put others at risk.
We may ask you questions. We may not be able to tell you the outcome, because it concerns another customer's account. If you report content you believe is illegal under EU law, we tell you our decision about it and how to challenge it.
Where we believe a serious crime is involved, such as child sexual exploitation, or where the law requires it, we preserve evidence and report to law enforcement or other authorities.
This is what our published terms say about requests from courts, regulators and law enforcement. It is a summary; the linked documents are binding.
We disclose personal data to courts, regulators and law enforcement where the law or a valid legal process requires it, and cooperate with valid legal process.
If a government asks for personal data we process for a customer, we tell the customer where the law permits, and disclose only what we are legally required to.
The agreement with customers is governed by the laws of the State of Delaware, USA. The contracting entity is the company below.
Use the form below and choose "Law enforcement or public authority", or write to abuse@intramedial.com. Address formal legal process to the company:
CompanyAvonao, Inc.A workspace has one of four states: clean, flagged, under review or suspended. Detection never suspends and never lowers a status on its own; a suspension is a decision a person took on evidence.
Safety desk
cleanNo concern recorded.flaggedA pattern asked a person to look. Your calls still run.under_reviewA person is looking at the evidence.suspendedAccess is suspended by a person's decision.We do not give a fixed turnaround time. Fees are not refunded for access suspended or ended because of a breach of the Acceptable Use Policy.
Everything in this form goes to abuse@intramedial.com and nowhere else. Fields marked optional can be left empty.
