MuleSoft has gone after the most ordinary problem in enterprise API management. In How Open Policies in Omni Gateway Secure Federated API Gateways in Minutes, the post describes the estate everyone has: “MuleSoft manages the experience APIs, Kong handles one department. Apigee came with an acquisition. Azure APIM is locked in because the cloud team owns it. AWS arrived with the microservices migration.” When security says finance APIs must accept traffic only from defined IPs, someone translates that by hand into each vendor’s console. “The result: a one-sentence security requirement becomes a month-long coordination project.”
The figure is MuleSoft’s own demonstration: applying an IP allowlist across 8 APIs on three gateways “takes under two minutes, the manual path would have taken over a week.” The mechanism is what makes it plausible. Scanners discover gateways and bring their APIs and existing policies into Agent Fabric’s registry; a team picks a protection type, an IP allowlist, JWT validation or rate limiting, selects APIs across vendors, and Agent Fabric “auto-translates to the correct configuration for each gateway.” The same intent can be stated from an AI coding tool in plain language. The useful restraint is the read-only path: scanners can start with read-only credentials, giving “a single view” of what is enforced where before anyone grants write access. “Applying a policy is an action, governance is a posture.”
The catalog holds the platform this sits on, and it is a mixed record for an agent story. The MuleSoft provider page lists API pages including the MuleSoft Anypoint Exchange API, where discovered assets are catalogued, the MuleSoft Environments API and the MuleSoft Organizations API. On the Agent Readiness score, a well-known catalog and an agent card are lit, two dimensions most of the catalog lacks, along with delegated identity and protected resource metadata.
The Kin Score is 56.2, strong band, with discoverability at 67.9 and contract quality at 65.2 against access clarity at 40.8. The Agent Readiness score is 44.2, agent-ready. The MCP server dimension is unlit, on the record of a company that sells MCP support and offers this workflow from an AI coding tool. So are dry-run mode and reversibility, and the post explains why they matter: one prompt applies a policy across three vendors’ gateways at once. A cross-vendor write needs a preview and an undo more than a single-console one does. MuleSoft has turned a one-sentence requirement into a two-minute action. The contract should make the same action rehearsable before it runs.