TRM Labs Builds a Secure Foundation for Company-Wide AI Adoption
TRM Labs needed to scale AI access without scaling operational risk
TRM Labs is the leading provider of proprietary threat intelligence and AI investigations used by governments and enterprises to detect, investigate, and disrupt criminal networks. With AI-enabled crime on the rise globally, TRM is transforming into an AI-native company to combat crime at an entirely new scale.
Driving that transformation is TRM’s agentic software factory — a system of skills, agents, and infrastructure that enables every team member at TRM Labs to build for customers. Backed by company-wide enablement, more than 90% of employees now regularly build with terminal agents, with most of that growth coming from non-technical teams.
The wins were clear, but adoption at this scale brought a new set of challenges.
Local MCP servers were fragile and had to be configured across individual developer laptops. When vendors did not offer hosted MCP servers, employees also needed local access to credentials.
TRM Labs needed a more secure way to make MCP servers available across the organization, without limiting employees to a single agent or model provider. The end goal of maximizing productivity through AI felt limited due to the governance capabilities of MCP in the organization.
Moving MCP servers off developer laptops
TRM Labs evaluated several open source and commercial MCP governance solutions. Self-hosting was non-negotiable for security. The company also needed the ability to remotely host MCP servers that would otherwise run locally. This allowed credentials to be managed server-side and eliminated local server reliability issues.
Stacklok gave TRM Labs a self-hosted runtime for both remote and local-only MCP servers. The team could deploy servers centrally, manage secrets server-side and give employees access without requiring them to maintain individual installations.
“Once we realized that we could get local MCP servers off developers’ laptops, that really became the main driver for building on Stacklok.”
One MCP foundation for every agent
Transforming TRM into a true AI-native organization also meant creating a great experience across multiple agent platforms. This required a configure-once, use-anywhere approach to MCP deployments that was portable across model providers.
With Stacklok, TRM Labs can manage MCP servers once and make them available to different agents. Employees can use the tools best suited to their workflows, while the company maintains a single governance layer for deployment, authentication, and logging.
This also gives TRM Labs greater flexibility as the AI ecosystem evolves. Its MCP investments remain separate from any individual model provider or agent harness, which keeps the company from being locked in to a single vendor. Stacklok provides a critical foundation for AI success as TRM Labs evolves.
See Stacklok in Action
Ready to govern your AI toolchain?
Get a personalized walkthrough of how Stacklok secures MCP servers, enforces policies, and gives your team full visibility.
Kubernetes-native and built for automation
TRM Labs has invested heavily in Kubernetes, making Stacklok’s Kubernetes-native architecture a natural fit.
MCP deployments can be managed through declarative configuration and incorporated into the company’s existing infrastructure workflows. This makes the environment easier to automate, version and operate at scale.
The configuration-driven approach is also well suited to agentic development. Because infrastructure is managed as code, agents can help create and update deployments without relying on manual interfaces.
“A configuration-driven product is a great fit for agents because they are much better at writing code than navigating click-ops. With Kubernetes managed as code, there’s basically nothing the agent can’t do. That is a major unlock.”
Enabling AI adoption with stronger control
Stacklok is helping TRM Labs replace fragmented local MCP installations with centrally managed infrastructure.
The company can now:
- Remotely host MCP servers that would otherwise run on employee laptops
- Manage credentials centrally
- Preserve user-level authentication to connected systems
- Improve logging across MCP activity
- Support multiple agents through a shared MCP foundation
- Maintain control of the infrastructure in its own environment
For an AI-native company, giving every employee the power to build is not just a perk. It is imperative to how the mission gets done. Stacklok is the control plane that lets TRM extend capabilities broadly without creating a free-for-all of local servers, secrets, and configurations. It eliminates the headaches associated with sprawl while improving security and reliability.
“Our goal isn’t to just govern MCP. It’s to make everyone at TRM a builder. That only works if the infrastructure underneath is secure and reliable at company scale. We’re excited to have Stacklok as a part of our vendor-agnostic agent runtime.”
Ready to see it live?
Get a demo of the Stacklok platform
See how leading teams govern MCP servers and enforce security across their AI toolchain.