# AgentGate vs ShieldGemma (slim)

> ShieldGemma scores 54 (C) to AgentGate's 47.6 (D) for policy enforcement. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md (~5,350 tokens) · this version ~3,230 tokens · JSON https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json · canonical https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

ShieldGemma scores 54 (C) on agent readiness against AgentGate's 47.6 (D), and leads in 4 of 7 scored categories. AgentGate leads on payments & pricing and transparency & trust. Both do policy enforcement.

- AgentGate: D 47.6, rank #1138 of 1486 · https://www.anchorterminal.com/tools/agentgate.min.md
- ShieldGemma: C 54, rank #921 of 1486 · https://www.anchorterminal.com/tools/shieldgemma.min.md
- AgentGate, good for A team that wants a self-hosted check between an agent and its shell, database or webhook tools, with a human approval queue. Ahead on Payments & pricing, 60 against 52; Transparency & trust, 60 against 54. Also Runs on your own machine; Free to start without a card; Open source.
- ShieldGemma, good for Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold. Ahead on Reliability, 46 against 39; Schema & documentation, 56 against 47; Agent ergonomics, 72 against 53; Maintenance & community, 40 against 13.

| Category | AgentGate | ShieldGemma |
| --- | --- | --- |
| Reliability (16%) | 39 | 46 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 47 | 56 |
| Agent ergonomics (13%) | 53 | 72 |
| Security & auth (14%) | 55 | 53 |
| Payments & pricing (10%) | 60 | 52 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 13 | 40 |
| Transparency & trust (7%) | 60 | 54 |

| Fact (where they differ) | AgentGate | ShieldGemma |
| --- | --- | --- |
| Kind | HTTP API | Model API |
| Vendor | Mohit Singh (mohitdebian) | Google DeepMind |
| Transports | HTTP, stdio |  |
| Licence | MIT | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| llms.txt | no | yes |
| Last release | none | 2025-04-04 |
| Terms last updated | no document linked | 2026-04-01 |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 0 stars | none |

Why the edge:
- Maintenance & community, ShieldGemma +27: AgentGate 13 (No tag, GitHub release, package or changelog entry has ever been published, and the version is still 0.1.0. Commits to main, the latest on 31 October 2026, aren't releases (this run's reading for untagged commits with no version or changelog entry), so the recency line is 0 of 30, where the 15 October check gave half credit for commits. No releases or dated changelog entries in the 90 days from 6 August (0 of 20). All 20 issues were the maintainer's own at the 15 October check, and 14 were closed within two days with one comment each. No outside issue or pull request had been answered, and issues were not re-read on 4 November (8 of 25, per the 15 October check). Not in the official MCP registry and no SDK package (0 of 15). CI runs the tests on every push, with the latest results unread, and the proxy still pins older major versions of Fastify 4, Vitest 0.34 and ESLint 8 (5 of 10). 0 + 0 + 8 + 0 + 5 = 13.); ShieldGemma 40 (Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.)
- Agent ergonomics, ShieldGemma +19: AgentGate 53 (The assess response is small, a verdict, reason codes, four head probabilities, versions and latency (20 of 25). `/v1/decisions` has `limit`, a keyset `cursor` and a `status` filter, behind the dashboard key (12 of 20). Reason codes such as `untrusted_prompt_influence` and `model_error` tell an agent why. Since commit 74d78e0 (15 October 2026) the MCP wrapper forwards `allow_with_checkpoint` calls instead of returning an error. On `ask` the agent gets a `decision_id` but cannot read the outcome without the dashboard key, and HTTP error bodies vary in shape. The line is still partly met, so it keeps its earlier 8 of 20 (this run's rule for in-between values on fixed lines). No idempotency key. A repeated assess writes a new decision and a new approval request (6 of 20). Two required fields per call and fail-closed defaults. No SDK, only snippets in Python and TypeScript and the MCP wrapper (7 of 15). 20 + 12 + 8 + 6 + 7 = 53.); ShieldGemma 72 (Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.)
- Schema & documentation, ShieldGemma +9: AgentGate 47 (`docs/openapi.yaml`, linked from docs/INDEX.md, covers six paths and seven operations and was last changed on 12 October 2026. It lists `GET /v1/approvals`, which the code does not serve, leaves out the checkpoint and shadow endpoints, and types `verdict` as a free string (12 of 25). No llms.txt. Markdown docs in the repository and the GitHub wiki (5 of 10). The API reference and wiki state each endpoint's purpose and the policy DSL is specified, with no guidance on when not to use it (10 of 20). Requests are validated with zod and required fields are marked. `action.arguments` is free-form by nature, and verdicts and reason codes are not enumerated in the contract (8 of 15). curl, Python and TypeScript examples. Error responses are not documented, and the docs disagree with the code on details such as a `201` for sessions where the code returns 200 and the approval response shape (7 of 15). Paths under `/v1`, with an empty changelog (5 of 15). 12 + 5 + 10 + 8 + 7 + 5 = 47.); ShieldGemma 56 (Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.)
- Payments & pricing, AgentGate +8: AgentGate 60 (Self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Clone and run with no signup, and the model weights on Hugging Face are not gated (20). No payment protocol (0). 20 + 20 + 20 + 0 = 60.); ShieldGemma 52 (Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.)
- Reliability, ShieldGemma +7: AgentGate 39 (Read as local software, since the owner runs it. No package on npm, PyPI or a container registry. Install is a git clone and `docker compose up`, with Python 3.11+, Node 22+ and Docker Compose v2 stated (10 of 20). A public CI workflow runs `make lint`, `make build` and `make test` (ESLint, Ruff, Vitest and Pytest) on every push to main, and the Docker job only validates the compose file. On 15 October 2026 the last six runs on main had passed. Run results for the 31 October commits could not be read on 4 November 2026, so the line takes 15 for public CI that runs the tests with an unread result (15 of 25). No outside issues at the 15 October check. The maintainer filed 20 issues as a self-audit and six stayed open. Issues were not re-read on 4 November (12 of 25, per the 15 October check). No tags, and CHANGELOG.md still holds one Unreleased line (2 of 15). Version 0.1.0 (0 of 15). 10 + 15 + 12 + 2 + 0 = 39.); ShieldGemma 46 (Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.)
- Transparency & trust, AgentGate +6: AgentGate 60 (MIT for the code and for the model weights (30). Self-hosted, so data stays in the owner's Postgres. The docs describe argument redaction and hashing, and arguments are redacted before the classifier unless a tool sets `send_raw_to_model`. No page sets out retention, and the README's "$0, self-hosted" claim agrees with the code (15 of 30). SECURITY.md lists 0.1.x as supported. No deprecation policy (2 of 20). No telemetry code found in AgentGate's source, and no statement either way. The dashboard loads Google Fonts and the decision service downloads weights from Hugging Face on start, which the docs mention only as model loading (12 of 20). 30 + 15 + 2 + 12 = 59.); ShieldGemma 54 (The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.)