AgentGate

AgentGate The authorization layer MCP doesn't have. A JIT (Just-in-Time) authorization proxy that intercepts AI agent requests in real time,analyzes intent, and enforces least-privilege policies — in under 5 ms of overhead.

If AgentGate is useful to you, please consider giving it a star! Your support helps the project grow and reach more developers.

---

The Problem

AI agents are getting powerful API access — but zero authorization guardrails.

• MCP has no enforcement layer. readOnlyHint and destructiveHint are advisory annotations. Nothing stops an agent from ignoring them.
• API keys grant full access. Most agent integrations use a single OAuth token or API key with no per-action scoping.
• No audit trail. When an agent deletes data or exceeds rate limits, there's no centralized log to investigate.

The Solution

AgentGate is a transparent proxy that sits between your AI agent and SaaS APIs. Every request is analyzed, authorized against YAML policies, rate-limited, and logged.

AI Agent (MCP Client)
    |
    v
+---------------------------+
|        AgentGate          |
|                           |
|  1. Request Validation    |   We built a full-LLM competitor to try to kill AgentGate. It couldn't.
> AgentGate: 100% accuracy, 0.16 ms. LLM competitor: 94% accuracy, 721 ms.
> See [`competitor/`](competitor/) for the full benchmark.

---

## Features

| Feature | Description |
|---------|-------------|
| **Policy Engine v2** | YAML-based rules with intent matching, AND/OR conditions, hot reload, schema validation |
| **10-Provider Proxy** | Google Calendar, Microsoft Graph, Slack, GitHub, Jira, Notion, Linear, HubSpot, Salesforce, AWS |
| **MCP Auth Proxy** | JSON-RPC `tools/call` interception with annotation-to-policy auto-conversion |
| **Intent Analysis (L1-L3)** | L1 HTTP method + L2 path pattern + L3 async escalation with human-in-the-loop |
| **Workflow Guard** | Cross-provider data exfiltration detection |
| **Natural Language Policies** | English-to-YAML instant generation and loading |
| **Rate Limiting** | Per-agent sliding window (minute/hour), configurable per policy |
| **Request Validation** | Path traversal protection, RFC 3986 path normalization, body size limits, header injection prevention |
| **Analytics** | 6 endpoints — time series, deny trends, anomaly detection, latency percentiles, heatmaps |
| **Audit Logging** | SQLite-backed, with stats aggregation, CSV/JSON export, auto-purge |
| **Webhook Alerts** | Deny/rate-limit notifications, threshold-based alerts with cooldown |
| **Agent Management** | SQLite store, API key rotation, per-agent usage statistics |
| **Self-Evolving Red Team** | GateBreaker attack suite (Obfuscator + LogicBomber + Sniper) with automatic patch generation |
| **Docker + CI** | Dockerfile, docker-compose, GitHub Actions (lint + test + build) |

---

## Demo

See AgentGate in action — no setup required:

### Security: Allow vs Block

An agent reads calendar events (200 OK), then tries to delete one — the policy engine blocks it instantly (403) with a structured reason and suggestion.

### Governance: Audit Trail & Export

Two agents with different policies generate mixed allow/deny traffic. Every decision is recorded in the audit log with agent name, intent, and latency — exportable as JSON or CSV.

### Builder: Rate Limiting & Policy Comparison

A rate-limited agent hits 429 after 5 requests. Two agents with different policies send the same POST — one is allowed, the other denied. A YAML policy is generated from plain English.

### Multi-Agent: Security Across Agent-to-Agent Communication

Three AI agents (Orchestrator, Executor, Reviewer) collaborate through AgentGate. Every inter-agent message is inspected — PII is auto-masked, SQL injection payloads are blocked, and unauthorized routing (Executor → Reviewer) is denied.

[](https://asciinema.org/a/ZZ7Y676fiDoZ4Bx4)

### Semantic Poka-yoke: Response-Level Business Rule Validation

AgentGate validates API responses *before* they reach the AI agent. Default rules block PII leakage (credit cards, SSN, My Number), credential exposure (API keys, passwords), and injection attacks — while audit-mode rules flag financial anomalies without blocking. Custom rules can be added at runtime via API.

[](https://asciinema.org/a/vqsz1GaY20Qp1gGc)

> Run these demos yourself: `TEST_MODE=true docker compose up --build && ./scripts/demo.sh`
> Semantic Poka-yoke demo: `./scripts/demo_semantic.sh`
> Multi-agent demo: `python3 demos/multi_agent/main.py`

---

## Quick Start (5 minutes)

### 1. Start the server

**Docker (recommended):**

```bash
git clone https://github.com/yoned0609/AgentGate.git
cd AgentGate
docker compose up --build

Local:

cd backend
pip install -r requirements.txt
cp .env.example .env   # Change MASTER_API_KEY before deploying!
python3 -m uvicorn app.main:app --reload --port 8100

2. Register an agent and make your first request

# Step 1: Register an agent (returns an api_key)
curl -s -X POST http://localhost:8100/agents \
  -H "X-Master-Key: ag_dev_change_me_in_production" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "policy": "default", "provider": "google"}' | jq .

# Step 2: Use the returned api_key as X-Agent-Key to proxy a request
# (allowed — GET is read-only under the "default" policy)
curl -s http://localhost:8100/proxy/google/calendars/primary/events \
  -H "X-Agent-Key: " \
  -H "Authorization: Bearer "

# Step 3: Try a denied request (DELETE is blocked by policy)
curl -s -X DELETE http://localhost:8100/proxy/google/calendars/primary/events/abc123 \
  -H "X-Agent-Key: " | jq .

# Step 4: View audit logs (human-readable with ?pretty=true)
curl -s "http://localhost:8100/audit/logs?pretty=true" \
  -H "X-Master-Key: ag_dev_change_me_in_production" | head -40

Test Mode (no real API tokens needed)

Set TEST_MODE=true to get mock responses without connecting to real APIs:

# Docker
TEST_MODE=true docker compose up --build

# Local
TEST_MODE=true python3 -m uvicorn app.main:app --reload --port 8100

Then all proxy requests return realistic mock data — perfect for verifying policies, rate limits, and audit logging.

# Works without a real Google OAuth token!
curl -s http://localhost:8100/proxy/google/calendars/primary/events \
  -H "X-Agent-Key: " | jq .

Authentication Headers

| Header | Purpose | When to use | |--------|---------|-------------| | X-Master-Key | Admin operations (register agents, view logs, manage policies) | Management endpoints | | X-Agent-Key | Per-agent proxy requests | /proxy/* and /mcp/* endpoints | | Authorization | Upstream API credentials (e.g., Bearer ) | Forwarded to the SaaS API |

Using with AI SDKs

AgentGate works as a drop-in proxy. Point your SDK's base URL at AgentGate instead of the upstream API.

LangChain (Python):

from langchain_google_calendar import GoogleCalendarAPIWrapper

# Instead of calling Google directly, proxy through AgentGate
wrapper = GoogleCalendarAPIWrapper(
    credentials=your_credentials,
    # Override the API endpoint to route through AgentGate
    api_resource_kwargs={
        "http": build_http_with_base_url("http://localhost:8100/proxy/google")
    }
)

OpenAI-compatible / httpx (Python):

import httpx

# Any HTTP client — just change the base URL and add X-Agent-Key
resp = httpx.get(
    "http://localhost:8100/proxy/google/calendars/primary/events",
    headers={
        "X-Agent-Key": "your_agent_api_key",
        "Authorization": "Bearer ",
    },
)

fetch / axios (TypeScript):

// Replace the API base URL with AgentGate's proxy URL
const response = await fetch(
  'http://localhost:8100/proxy/github/repos/owner/repo/issues',
  {
    headers: {
      'X-Agent-Key': 'your_agent_api_key',
      'Authorization': 'Bearer ',
    },
  }
);

MCP Auth Proxy

# Register an MCP server with tool annotations
curl -s -X POST http://localhost:8100/mcp/servers \
  -H "X-Master-Key: ag_dev_change_me_in_production" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-mcp",
    "url": "http://localhost:3001/mcp",
    "tools": [
      {"name": "read_calendar", "annotations": {"readOnlyHint": true}},
      {"name": "delete_event", "annotations": {"destructiveHint": true}}
    ]
  }'

# Send JSON-RPC request through AgentGate
curl -s -X POST http://localhost:8100/mcp/my-mcp \
  -H "X-Agent-Key: " \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"read_calendar","arguments":{}}}'

Build a Policy from Natural Language

curl -s -X POST http://localhost:8100/policies/build \
  -H "X-Master-Key: ag_dev_change_me_in_production" \
  -H "Content-Type: application/json" \
  -d '{"description": "Allow read-only access to GitHub repos and issues"}' | jq .

---

API Endpoints

Proxy

| Method | Path | Auth | Description | |--------|------|------|-------------| | * | /proxy/{provider}/{path} | Agent Key | Forward request through policy engine | | POST | /mcp/{server_name} | Agent Key | MCP JSON-RPC proxy with authorization |

Agent Management

| Method | Path | Auth | Description | |--------|------|------|-------------| | POST | /agents | Master Key | Register agent | | GET | /agents | Master Key | List agents | | DELETE | /agents/{id} | Master Key | Delete agent | | POST | /agents/{id}/rotate-key | Master Key | Rotate API key | | GET | /agents/{id}/stats | Master Key | Usage statistics |

Analytics

| Method | Path | Auth | Description | |--------|------|------|-------------| | GET | /analytics/timeseries | Master Key | Request volume over time | | GET | /analytics/deny-trends | Master Key | Denial pattern analysis | | GET | /analytics/anomalies | Master Key | Anomaly detection | | GET | /analytics/latency | Master Key | Latency percentiles | | GET | /analytics/heatmap | Master Key | Activity heatmap | | GET | /analytics/top-agents | Master Key | Top agents by volume |

Audit

| Method | Path | Auth | Description | |--------|------|------|-------------| | GET | /audit/logs | Master Key | Query logs (filter, paginate) | | GET | /audit/stats | Master Key | Aggregated statistics | | GET | /audit/export | Master Key | Export as JSON or CSV | | POST | /audit/purge | Master Key | Delete old logs |

Configuration

| Method | Path | Auth | Description | |--------|------|------|-------------| | GET | /policies | Master Key | List loaded policies | | POST | /policies/build | Master Key | Natural language policy builder | | POST | /webhooks | Master Key | Register webhook | | POST | /alerts/thresholds | Master Key | Register alert threshold | | POST | /mcp/servers | Master Key | Register MCP server |

Discovery

| Method | Path | Auth | Description | |--------|------|------|-------------| | GET | /health | — | Health check | | GET | /providers | — | Available providers | | GET | / | — | Service info |

---

Policy Example

name: default
description: "Read-only access"

rules:
  - resource: "/calendars/*/events"
    methods: ["GET"]
    effect: allow

  - resource: "/calendars/*/events"
    methods: ["POST", "DELETE"]
    effect: deny
    reason: "Write operations not permitted"

  # Intent-based rule (v2)
  - intent: ["read", "query"]
    effect: allow

  # Compound conditions (v2)
  - resource: "/sensitive/*"
    effect: allow
    conditions:
      and:
        - intent: read
        - methods: ["GET"]

default_effect: deny

rate_limit:
  enabled: true
  requests_per_minute: 30
  requests_per_hour: 500

Built-in policy templates are included for all supported providers:

| Policy | Description | Rate Limit | |--------|-------------|------------| | default | Read-only Google Calendar | 30/min, 500/hr | | readwrite | Read + create, no delete | 60/min, 1000/hr | | read_only | Strict read-only (GET/HEAD only, any provider) | 10/min, 100/hr | | rate_limited | Read + write with tight limits (sandbox/testing) | 5/min, 50/hr | | *_readonly | Per-provider read-only (github, slack, jira, etc.) | 30/min, 500/hr |

See [backend/policies/](backend/policies/) for all templates.

---

SDKs

Python

pip install agentgate-sdk

from agentgate_sdk import AgentGateClient

# Admin client (master key for management operations)
client = AgentGateClient(base_url="http://localhost:8100", master_key="your-master-key")

# Register an agent
agent = client.agents.create("my-agent", policy="default", provider="google")

# Proxy a request (agent key for proxy operations)
proxy_client = AgentGateClient(base_url="http://localhost:8100", agent_key=agent.api_key)
resp = proxy_client.proxy.request("google", "calendars/primary/events", method="GET")

# Query audit logs
logs = client.audit.logs(limit=10)

Async is also supported — see [Python SDK README](sdks/python/README.md).

TypeScript / Node.js

npm install agentgate-sdk

import { AgentGateClient } from 'agentgate-sdk';

const client = new AgentGateClient({
  baseUrl: 'http://localhost:8100',
  masterKey: 'your-master-key',
});

const agent = await client.agents.create({ name: 'my-agent', policy: 'default', provider: 'google' });

const proxyClient = new AgentGateClient({
  baseUrl: 'http://localhost:8100',
  agentKey: agent.apiKey,
});
const events = await proxyClient.proxy.request({ provider: 'google', path: 'calendars/primary/events', method: 'GET' });

See [TypeScript SDK README](sdks/typescript/README.md) for full documentation.

---

Security

AgentGate includes a self-evolving red team test suite ([test_gatebreaker.py](backend/tests/test_gatebreaker.py)) that attacks its own defenses:

• Obfuscator — Path obfuscation (double slashes, URL encoding, Unicode variants)
• LogicBomber — ReDoS patterns, policy priority conflicts, permission boundary bugs
• Sniper — Concurrency stress, long-path performance degradation

All discovered vulnerabilities are automatically patched and regression-tested. See [vulnerability_report.json](backend/vulnerability_report.json) for the latest results.

For vulnerability reporting, see [SECURITY.md](SECURITY.md).

---

Tech Stack

| Layer | Technology | |-------|-----------| | Backend | Python 3.12 + FastAPI (async) | | Proxy | httpx | | Policy | YAML + fnmatch + segment-aware matching + intent analysis | | Rate Limit | In-memory sliding window | | Audit DB | SQLite (aiosqlite) | | Analytics | Time series, anomaly detection, percentile analysis | | MCP | JSON-RPC 2.0 proxy | | Logging | loguru | | Config | Pydantic BaseSettings | | Lint | ruff | | CI | GitHub Actions | | Container | Docker + docker-compose |

Tests

277 tests passing — run with:

# Backend (201 tests)
cd backend && python3 -m pytest -v

# Python SDK (44 tests)
cd sdks/python && python3 -m pytest tests/ -v

# TypeScript SDK (32 tests)
cd sdks/typescript && npm test

---

Docs

| Document | Link | |----------|------| | Business Plan | [English](docs/businessplanen.md) / [Japanese](docs/businessplan.md) | | Dev Roadmap | [English](docs/mvpdevroadmapen.md) / [Japanese](docs/mvpdevroadmap.md) | | Red Team Report | [vulnerabilityreport.json](backend/vulnerabilityreport.json) | | Market Gap Analysis | [marketgapanalysis.md](competitor/marketgapanalysis.md) |

Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

License

[MIT](LICENSE)

---

AgentGate is free and open source. If this project helps secure your AI agents, please give it a star on GitHub. Stars help others discover the project and motivate continued development.

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: yoned0609
• Source: yoned0609/AgentGate
• License: MIT

Install and usage instructions live in the source repository linked above.