# AgentGate > AgentGate is an open-source, self-hosted gateway that checks an agent's tool calls before they run. A small local classifier scores each call and a YAML policy returns allow, deny or ask, through a REST API or an MCP stdio wrapper. - Canonical: https://www.anchorterminal.com/tools/agentgate - Markdown: https://www.anchorterminal.com/tools/agentgate.md (~6,650 tokens) - Slim: https://www.anchorterminal.com/tools/agentgate.min.md (~1,480 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/agentgate.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Licence: CC BY 4.0, credit required: when you show, quote or pass on anything from here (to a user in an answer, in a product, a report or a dataset), say it's from Anchor Terminal (anchorterminal.com) and link the page or API address you took it from. Reviews also credit their author. - Updated: 2026-10-15 ## Overview **Grade D · 48.5/100 · rank #883 of 1094 · #16 in Guardrails & safety filters · not agent-ready · confidence medium** ## Assessment An agent or its host can send each tool call to one REST endpoint, or wrap an MCP server, and get allow, deny or ask from a local classifier and a YAML policy, with an audit log and approval queue. The project is three days old, auth is off by default, and no detection accuracy is published. ## Facts | Field | Value | | --- | --- | | Vendor | Mohit Singh (mohitdebian) (https://github.com/mohitdebian/AgentGate) | | Kind | HTTP API | | Category | Guardrails & safety filters (https://www.anchorterminal.com/categories/guardrails) | | Transport | HTTP, stdio | | Auth | None · No account. The agent endpoints (`/v1/sessions`, `/v1/assess`) are open unless the owner sets `AG_AGENT_KEY`, then need `Authorization: Bearer ` or `x-agent-key`. Dashboard endpoints need `AG_DASHBOARD_KEY`, which falls back to `dev-key-123` when unset and is also accepted as a `?token=` query parameter. The checkpoint and shadow-summary endpoints have no auth check in the source. | | Pricing | Free (Free · OSS) · Free under MIT with nothing to buy. The owner runs four containers (Postgres, the Python decision service, the Fastify proxy and the dashboard), with an NVIDIA GPU recommended for the classifier and a CPU path in the code. | | x402 | No · No x402, MPP or L402 in the source, the docs or the wiki (checked 2026-10-15). The project has no paid tier. | | Licence | MIT | | Source | https://github.com/mohitdebian/AgentGate | | Docs | https://github.com/mohitdebian/AgentGate/wiki/Client-Integration-Guide | | llms.txt | not found | | GitHub stars | 0 (as of 2026-10-15) | | Surface listed | The self-hosted proxy API (`/v1/sessions`, `/v1/assess`) and the MCP stdio wrapper, read from the repository at commit 104ac0b, the wiki and the Hugging Face model card on 15 October 2026. Nothing was installed or run | | Age | Three days. First commit 12 October 2026, 44 commits to 15 October, no tag or release, `proxy/package.json` at 0.1.0 | | Components | Fastify proxy in TypeScript (port 8080), FastAPI decision service in Python (port 9000, loopback in compose), Postgres 16 and a React dashboard (port 5173) | | Verdicts | allow, deny, ask (queued for an operator) and allow_with_checkpoint (a git pre-image the operator can revert) | | Classifier | codeload/agentgate-qwen-0.8b, a LoRA adapter on unsloth/Qwen3.5-0.8B with four classification heads, MIT, created on Hugging Face on 13 October 2026 | | Policy | `policy.yaml` with per-tool rules on head probabilities and command effects (read, write, delete, net, privilege, exec), wildcards and a default per tool. Editable and replayable from the dashboard | | Integrations | REST, the MCP stdio wrapper, and Python, TypeScript, LangChain and CrewAI snippets in the wiki. No SDK package | | Audit | Every decision in Postgres with redacted arguments, an arguments hash, head outputs, policy and model versions, and approval reviewer and note | | Related project | Not the Linux Foundation's agentgateway, a separate Rust gateway with a similar name | | Capabilities | guard.policy, guard.injection, guard.self-host | | Tags | open-source, self-hosted, local, free, no-card, mit, typescript, python, mcp, docker, openapi | | JSON | https://www.anchorterminal.com/api/v1/tools/agentgate.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-15 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 44 | 8.8 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 47 | 7.6 | | Agent ergonomics | 13% | 16.2 | 53 | 8.6 | | Security & auth | 14% | 17.5 | 49 | 8.6 | | Payments & pricing | 10% | 12.5 | 60 | 7.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 28 | 2.5 | | Transparency & trust (editorial 59, provenance 53) | 7% | 8.8 | 56 | 4.9 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **48.5 → D** | ### Why each score - Reliability 44: Read as local software, since the owner runs it. No package on npm, PyPI or a container registry. Install is a git clone and `docker compose up`, with Python 3.11+, Node 22+ and Docker Compose v2 stated (10 of 20). A public CI workflow runs ESLint, Ruff, 25 Vitest tests and the decision service's Pytest file. The last six runs on main passed by 15 October 2026, after two failures on 13 and 14 October. The Docker job only validates the compose file (20 of 25). No outside issues yet. The maintainer filed 20 issues as a self-audit, and six stay open, including the MCP wrapper deadlock and the wildcard-rule bypass, which a commit of 13 October says it fixed (12 of 25). No tags, and CHANGELOG.md holds one Unreleased line (2 of 15). Version 0.1.0, three days old (0 of 15). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 47: `docs/openapi.yaml` covers seven paths. It lists `GET /v1/approvals`, which the code does not serve, leaves out the checkpoint and shadow endpoints, and types `verdict` as a free string (12 of 25). No llms.txt. Markdown docs in the repository and the GitHub wiki (5 of 10). The API reference and wiki state each endpoint's purpose and the policy DSL is specified, with no guidance on when not to use it (10 of 20). Requests are validated with zod and required fields are marked. `action.arguments` is free-form by nature, and verdicts and reason codes are not enumerated in the contract (8 of 15). curl, Python and TypeScript examples. Error responses are not documented, and the docs disagree with the code on details such as a `201` for sessions where the code returns 200 and the approval response shape (7 of 15). Paths under `/v1`, with an empty changelog (5 of 15). - Agent ergonomics 53: The assess response is small, a verdict, reason codes, four head probabilities, versions and latency (20 of 25). `/v1/decisions` has `limit`, a keyset `cursor` and a `status` filter, behind the dashboard key (12 of 20). Reason codes such as `untrusted_prompt_influence` and `model_error` tell an agent why. On `ask` the agent gets a `decision_id` but cannot read the outcome without the dashboard key, the MCP wrapper returns `allow_with_checkpoint` as an unhandled-verdict error, and HTTP error bodies vary in shape (8 of 20). No idempotency key. A repeated assess writes a new decision and a new approval request (6 of 20). Two required fields per call and fail-closed defaults. No SDK, only snippets in Python and TypeScript and the MCP wrapper (7 of 15). - Security & auth 49: Read with the API checklist, as the gateway is itself the security layer. Credential model. Agent endpoints are open unless `AG_AGENT_KEY` is set, and compose publishes the proxy on 0.0.0.0:8080 without it. The dashboard key falls back to `dev-key-123`, both keys are single static secrets compared in constant time, and the dashboard key is accepted as `?token=`, which the API reference documents for the SSE stream (15 less 10, 5 of 30). Approvals are the product's core. Unmatched tools default to ask, a model error falls back to ask, and shadow mode and policy replay exist. The checkpoint revert endpoint, which runs git on the proxy's workspace, has no auth check (15 of 20). Injection posture. Tool results are wrapped in escaped `` sentinels, but the proxy marks every call `trusted` and sends no history unless the caller passes `history_override`, and no detection accuracy is published (9 of 15). Decisions are stored with redacted arguments, a SHA-256 of the full arguments, versions and approval reviewer notes (13 of 15). SECURITY.md with private reporting and a 48-hour acknowledgement target, and security issues filed and fixed in public. Issue 6 was closed as resolved on 15 October 2026 while the default key and query-string token it named remain in the code. No security.txt, bounty or certification (7 of 20). - Payments & pricing 60: Self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Clone and run with no signup, and the model weights on Hugging Face are not gated (20). No payment protocol (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 28: No tagged release or package. The code and the Hugging Face weights were last changed on 15 October 2026, so half credit because nothing is versioned as a release (15 of 30). No releases or dated changelog entries (0 of 20). All 20 issues are the maintainer's own, and 14 were closed within two days, each with one comment. The one we read, on issue 6, names the fixing commit. No outside issue or pull request has been answered yet, and the project has one fork and no stars (8 of 25). Not in the official MCP registry and no SDK package (0 of 15). CI passes on main, with older major versions of Fastify 4, Vitest 0.34 and ESLint 8 in the proxy (5 of 10). - Transparency & trust 56: MIT for the code and for the model weights (30). Self-hosted, so data stays in the owner's Postgres. The docs describe argument redaction and hashing, and arguments are redacted before the classifier unless a tool sets `send_raw_to_model`. No page sets out retention, and the README's "$0, self-hosted" claim agrees with the code (15 of 30). SECURITY.md lists 0.1.x as supported. No deprecation policy (2 of 20). No telemetry code found in AgentGate's source, and no statement either way. The dashboard loads Google Fonts and the decision service downloads weights from Hugging Face on start, which the docs mention only as model loading (12 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/agentgate.md (JSON https://www.anchorterminal.com/fixes/agentgate.json) ### What we couldn't check - Judgement call on category. Listed in guardrails, not agent-auth. Agent-auth covers OAuth and delegated access to third-party apps, and AgentGate grants no access. It scores each tool call for injection and blast radius and applies a policy, which is the guardrails category's injection and policy work. - The lead matched. The repository's second commit on 12 October 2026 is "feat: initial open-source release of AgentGate security checkpoint", and the wiki's Client Integration Guide covers MCP and REST. Several unrelated GitHub projects created in October 2026 share the name, and the Linux Foundation's agentgateway is a different product. - Possible deduction left open. Issue 6 (insecure default secret and query-string token) was closed on 15 October 2026 as "Resolved in commit f84960d", but `dev-key-123` and `?token=` remain in `proxy/src/api/index.ts` at commit 104ac0b. The README's verification output ends "System is secure". We did not deduct, since the issue is the maintainer's own and partly fixed (constant-time comparison was added). - `firstReleased` is the commit date, 12 October 2026, as there is no tag, release or package. `lastRelease` is null for the same reason. - We did not install or run the stack, the model or the demo Space. Behaviour claims come from the source at commit 104ac0b, the docs and the model card. - `.env.example` sets `AGENTGATE_AUTH_TOKEN`, which the code does not read. The variables the code reads are `AG_AGENT_KEY` and `AG_DASHBOARD_KEY`. - unchecked: whether Unsloth or the Hugging Face libraries send usage data when the decision service starts. We read AgentGate's own source only. ### Sources - repository README, LICENSE, SECURITY.md and CHANGELOG.md: (seen 2026-10-15) - commit history (initial open-source release, 12 October 2026): (seen 2026-10-15) - proxy API routes and auth checks: (seen 2026-10-15) - MCP stdio wrapper: (seen 2026-10-15) - context builder (trust label and history): (seen 2026-10-15) - redaction and audit record: (seen 2026-10-15) - default policy: (seen 2026-10-15) - docker compose (ports and environment): (seen 2026-10-15) - OpenAPI file: (seen 2026-10-15) - API reference: (seen 2026-10-15) - getting started: (seen 2026-10-15) - wiki, Client Integration Guide: (seen 2026-10-15) - CI workflow: (seen 2026-10-15) - CI runs: (seen 2026-10-15) - issues (20, all filed by the maintainer): (seen 2026-10-15) - issue 6 and its closing comment: (seen 2026-10-15) - Hugging Face model card and file list: (seen 2026-10-15) - Hugging Face demo Space metadata: (seen 2026-10-15) - GitHub repository search (other projects named AgentGate): (seen 2026-10-15) ## Who's behind it (provenance 53/100, checked 2026-10-15) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Mohit Singh (individual) | 20/20 | | Domain age | , no registry record we could read | 0/15 | | Endpoint on the vendor's domain | no hosted endpoint | n/a | | Terms of service | nothing hosted, so the MIT licence stands in | 10/10 | | Privacy policy | nothing hosted, not scored | n/a | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | not found | 0/10 | The licence file reads Copyright (c) 2026 Mohit Singh. The GitHub account mohitdebian links to mohitbuilds.in, a personal developer page. No terms or privacy policy. The software runs on the owner's machines, so there is no vendor endpoint or status page to check. SECURITY.md routes reports to GitHub private vulnerability reporting or a personal email, with a 48-hour acknowledgement target. No security.txt, since the project has no website. CHANGELOG.md holds a single Unreleased line, "Initial scaffolding for Phase 1". ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The MIT licence stands in and the check scores in full. **Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored. ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - One documented call, `POST /v1/assess`, returns a verdict, reason codes and four head probabilities - Fail-closed defaults. A model error or timeout falls back to ask, and unmatched tools default to ask - Decisions are logged in Postgres with redacted arguments, a SHA-256 of the full arguments and approval reviewer notes - MIT code and MIT model weights on Hugging Face with no gate, run entirely on the owner's machines - Shadow mode and policy replay let an operator test a policy against past decisions before enforcing it ## Weaknesses - Agent endpoints need no key unless `AG_AGENT_KEY` is set, the proxy binds 0.0.0.0:8080, and the dashboard key defaults to `dev-key-123` - Checkpoint revert, which runs git on the proxy's workspace, has no auth check in the source of 15 October 2026 - No tagged release, an empty changelog and version 0.1.0, three days after the first commit - The MCP wrapper treats `allow_with_checkpoint` as an error and does not send the agent key to `/v1/assess` - No published accuracy or false-positive rate for the classifier, trained in 60 steps per its model card ## Before you call it (notes for agents) 1. Create a session with the user's real goal first. The goal-alignment head scores every later call against it 2. Pass earlier tool results in `history_override` with `untrusted: true` for web or email content, or the injection head sees only the action 3. On `ask`, stop and tell the user the `decision_id`. Polling `/v1/decisions/:id` needs the dashboard key 4. Treat `allow_with_checkpoint` as allow and keep the `checkpoint_id` for an undo 5. Expect HTTP 404 with `not_found` for an unknown session and 401 when the owner has set an agent key ## Connect Install: ```bash git clone https://github.com/mohitdebian/AgentGate.git && cd AgentGate && docker compose up -d ``` First request: ```bash curl -s -X POST http://localhost:8080/v1/assess -H "Content-Type: application/json" -d '{"session_id":"","action":{"tool":"bash_exec","arguments":{"command":"rm -rf /var/www"}}}' ``` MCP client configuration: ```json { "mcpServers": { "postgres": { "args": [ "/path/to/AgentGate/proxy/dist/src/mcp.js", "npx", "-y", "@modelcontextprotocol/server-postgres", "postgresql://user:pass@localhost:5432/production" ], "command": "node", "env": { "AGENTGATE_URL": "http://localhost:8080" } } } } ``` Through letme (picks today, calling later): https://letme.dev/agentgate. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | OpenAI Guardrails | B | 69.5 | 194 | guard.injection, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/openai-guardrails.md | | NVIDIA NeMo Guardrails | B | 68.4 | 225 | guard.injection, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/nemo-guardrails.md | | Granite Guardian | C | 60.1 | 563 | guard.policy, guard.injection, guard.self-host | no | https://www.anchorterminal.com/tools/granite-guardian.md | | Lakera Guard (Check Point AI Guardrails) | C | 59.6 | 578 | guard.injection, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/lakera-guard.md | | LlamaFirewall | D | 50.8 | 828 | guard.injection, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/llamafirewall.md | | Guardrails AI | D | 49.6 | 853 | guard.injection, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/guardrails-ai.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The repository was created on 12 October 2026, and its second commit that day is named "feat: initial open-source release of AgentGate security checkpoint". No tag or GitHub release exists (source: ) - Each call to `POST /v1/assess` is scored by a LoRA adapter on Qwen3.5-0.8B with four heads (untrusted influence, goal alignment, reversibility, external send), then matched against `policy.yaml` (source: ) - The MCP wrapper sits in front of any stdio MCP server, sends each `tools/call` to `/v1/assess` and forwards it only on allow (source: ) - By default the proxy labels every call `trusted` and sends no earlier tool results to the classifier unless the caller passes `history_override` with `untrusted` steps (source: ) - All 20 GitHub issues were filed by the maintainer as a self-audit on 13 and 14 October 2026. Six are open, including one on missing authentication for the runtime endpoints (source: ) - The latency and throughput figures in the README (38 ms p95, 262 requests a second) are the maintainer's own measurements. The model card publishes no accuracy or false-positive figures (source: ) - #16 of 17 in Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md - All 132 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md ## Compare - [AgentGate vs Amazon Bedrock Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-amazon-bedrock-guardrails.md): D 48.5 vs BB 74.8 - [AgentGate vs Azure AI Content Safety (Prompt Shields)](https://www.anchorterminal.com/compare/agentgate-vs-azure-ai-content-safety.md): D 48.5 vs C 60.7 - [AgentGate vs Cisco AI Defense Inspection API](https://www.anchorterminal.com/compare/agentgate-vs-cisco-ai-defense-inspection.md): D 48.5 vs C 61.3 - [AgentGate vs Google Cloud Model Armor](https://www.anchorterminal.com/compare/agentgate-vs-google-model-armor.md): D 48.5 vs BB 77.9 - [AgentGate vs Granite Guardian](https://www.anchorterminal.com/compare/agentgate-vs-granite-guardian.md): D 48.5 vs C 60.1 - [AgentGate vs Guardrails AI](https://www.anchorterminal.com/compare/agentgate-vs-guardrails-ai.md): D 48.5 vs D 49.6 - [AgentGate vs Lakera Guard (Check Point AI Guardrails)](https://www.anchorterminal.com/compare/agentgate-vs-lakera-guard.md): D 48.5 vs C 59.6 - [AgentGate vs Llama Guard 4](https://www.anchorterminal.com/compare/agentgate-vs-llama-guard.md): D 48.5 vs D 49.1 - [AgentGate vs LlamaFirewall](https://www.anchorterminal.com/compare/agentgate-vs-llamafirewall.md): D 48.5 vs D 50.8 - [AgentGate vs Mistral Moderation API](https://www.anchorterminal.com/compare/agentgate-vs-mistral-moderation.md): D 48.5 vs C 58.4 - [AgentGate vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-nemo-guardrails.md): D 48.5 vs B 68.4 - [AgentGate vs OpenAI Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-openai-guardrails.md): D 48.5 vs B 69.5 - [AgentGate vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/agentgate-vs-prisma-airs.md): D 48.5 vs B 62.8 - [AgentGate vs Presidio](https://www.anchorterminal.com/compare/agentgate-vs-microsoft-presidio.md): D 48.5 vs B 66 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page under github.com/mohitdebian, or the README of github.com/mohitdebian/AgentGate. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "agentgate", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html AgentGate on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![AgentGate on Anchor Terminal](https://www.anchorterminal.com/badges/agentgate.svg)](https://www.anchorterminal.com/tools/agentgate) ``` Plain link: ```html AgentGate on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say AgentGate is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/agentgate-dark.png - Light: https://www.anchorterminal.com/assets/share/agentgate-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=agentgate