# AgentGate (slim)

> AgentGate is an open-source, self-hosted gateway that checks an agent's tool calls before they run. A small local classifier scores each call and a YAML policy returns allow, deny or ask, through a REST API or an MCP stdio wrapper.

- Full: https://www.anchorterminal.com/tools/agentgate.md (~6,650 tokens) · this version ~1,480 tokens · JSON https://www.anchorterminal.com/tools/agentgate.json · canonical https://www.anchorterminal.com/tools/agentgate
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-15
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

**D · 48.5/100 · rank #883 of 1094 · #16 in Guardrails & safety filters · not agent-ready · confidence medium**


Assessment: An agent or its host can send each tool call to one REST endpoint, or wrap an MCP server, and get allow, deny or ask from a local classifier and a YAML policy, with an audit log and approval queue. The project is three days old, auth is off by default, and no detection accuracy is published.

## Facts

- Kind: HTTP API · vendor: Mohit Singh (mohitdebian) · category: Guardrails & safety filters · legal entity: Mohit Singh (individual) · provenance 53/100
- Local only (HTTP, stdio)
- Auth: None · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The self-hosted proxy API (`/v1/sessions`, `/v1/assess`) and the MCP stdio wrapper, read from the repository at commit 104ac0b, the wiki and the Hugging Face model card on 15 October 2026. Nothing was installed or run
- Age: Three days. First commit 12 October 2026, 44 commits to 15 October, no tag or release, `proxy/package.json` at 0.1.0
- Components: Fastify proxy in TypeScript (port 8080), FastAPI decision service in Python (port 9000, loopback in compose), Postgres 16 and a React dashboard (port 5173)
- Verdicts: allow, deny, ask (queued for an operator) and allow_with_checkpoint (a git pre-image the operator can revert)
- Classifier: codeload/agentgate-qwen-0.8b, a LoRA adapter on unsloth/Qwen3.5-0.8B with four classification heads, MIT, created on Hugging Face on 13 October 2026
- Policy: `policy.yaml` with per-tool rules on head probabilities and command effects (read, write, delete, net, privilege, exec), wildcards and a default per tool. Editable and replayable from the dashboard
- Integrations: REST, the MCP stdio wrapper, and Python, TypeScript, LangChain and CrewAI snippets in the wiki. No SDK package
- Audit: Every decision in Postgres with redacted arguments, an arguments hash, head outputs, policy and model versions, and approval reviewer and note
- Related project: Not the Linux Foundation's agentgateway, a separate Rust gateway with a similar name

- Scores: Reliability 44, Performance pending, Schema & documentation 47, Agent ergonomics 53, Security & auth 49, Payments & pricing 60, Task success pending, Maintenance & community 28, Transparency & trust 56 · total over the 7 assessed categories
- Why: Reliability, Read as local software, since the owner runs it. · Schema & documentation, `docs/openapi.yaml` covers seven paths. · Agent ergonomics, The assess response is small, a verdict, reason codes, four head probabilities, versions and latency (20 of 25). · Security & auth, Read with the API checklist, as the gateway is itself the security layer. · Payments & pricing, Self-hosted rule. · Maintenance & community, No tagged release or package. · Transparency & trust, MIT for the code and for the model weights (30).
- Sources: 19, open questions: 7, both in the full twin
- Capabilities: guard.policy, guard.injection, guard.self-host
- JSON: https://www.anchorterminal.com/api/v1/tools/agentgate.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/agentgate.svg` or a link to https://www.anchorterminal.com/tools/agentgate from a page under github.com/mohitdebian, or the README of github.com/mohitdebian/AgentGate, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Create a session with the user's real goal first. The goal-alignment head scores every later call against it
2. Pass earlier tool results in `history_override` with `untrusted: true` for web or email content, or the injection head sees only the action
3. On `ask`, stop and tell the user the `decision_id`. Polling `/v1/decisions/:id` needs the dashboard key
4. Treat `allow_with_checkpoint` as allow and keep the `checkpoint_id` for an undo
5. Expect HTTP 404 with `not_found` for an unknown session and 401 when the owner has set an agent key

## Connect

```bash
git clone https://github.com/mohitdebian/AgentGate.git && cd AgentGate && docker compose up -d
```

```bash
curl -s -X POST http://localhost:8080/v1/assess -H "Content-Type: application/json" -d '{"session_id":"<id from POST /v1/sessions>","action":{"tool":"bash_exec","arguments":{"command":"rm -rf /var/www"}}}'
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/agentgate

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| OpenAI Guardrails | B | 69.5 | guard.injection, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/openai-guardrails.min.md |
| NVIDIA NeMo Guardrails | B | 68.4 | guard.injection, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/nemo-guardrails.min.md |
| Granite Guardian | C | 60.1 | guard.policy, guard.injection, guard.self-host | https://www.anchorterminal.com/tools/granite-guardian.min.md |
| Lakera Guard (Check Point AI Guardrails) | C | 59.6 | guard.injection, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/lakera-guard.min.md |
| LlamaFirewall | D | 50.8 | guard.injection, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/llamafirewall.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)