SatGate

☁️ Don't want to self-host? Try SatGate Cloud

Managed SaaS — zero setup, multi-tenant isolation, enterprise dashboard.
Free Observe tier. No credit card required.

AI agents are making API calls autonomously. They spawn sub-agents, call MCP tools, and run overnight while you sleep.

Your existing stack answers:"Is this request authenticated?"

Nobody answers:"Should this agent have authority to spend, delegate, or invoke this paid resource?"

✓ Network Firewall → "Can this packet enter?" ✓ Application Firewall → "Is this request safe?" ? Economic Firewall → "Should this agent act, spend, or pay?"

SatGate is anEconomic Firewallfor AI agent requests. Drop it in front of your APIs and MCP tools to enforce scoped authority, budgets, paid-rail context, and Evidence Pack receipts before agents act.

Not another routing layer.Routing gateways (Bifrost, LiteLLM, Portkey) optimizewhich providerhandles a call. SatGate governswhether the call should happen at allbased on authority, policy, budget, and paid-rail context.

Agent → SatGate (economic governance) → Routing Gateway → LLM Providers

- 🛡️Capability Tokens (Macaroons)— Cryptographic credentials with built-in caveats, delegation, and next-request revocation. Not API keys — tokens that agents can safely sub-delegate.
- 🎯MCP-Aware— Parses MCP JSON-RPC tool calls. Know that Agent X spent $47 onsearch_databaseand $12 onsend_email— not just "1,000 requests."
- 💰Budget Enforcement— Hard stops per agent, team, or API. When the budget hits zero, requests areblocked. Not logged. Not alerted. Blocked.
- ⚡Paid-Rail Governance— Govern paid API access across L402, x402, API-key billing, and enterprise ledgers without making any one rail the control plane.
- 🔒Default-Deny— All routes require valid credentials unless explicitly public. Zero Trust by design.
- 🚀<50ms Overhead— Lightweight Go proxy. Adds governance without adding latency.
- 📦Self-Hosted— Your infrastructure, your rules. Single binary, Docker, or Kubernetes.
- 🔌Drop-in— Works with any HTTP backend. REST, GraphQL, MCP servers. No code changes.

# Download the binary (macOS Apple Silicon — see Releases for other platforms) curl -L https://github.com/satgate-io/satgate/releases/latest/download/satgate-darwin-arm64 -o satgate chmod +x satgate # Start with example config (mock Lightning, auto-generated keys) export ADMIN_TOKEN=my-secret-token export LIGHTNING_BACKEND=mock ./satgate --config examples/gateway.yaml

# 1. Public — no auth needed curl http://localhost:8080/health # 2. Protected — mint a capability token, then use it curl -X POST http://localhost:8080/api/capability/mint \ -H "X-Admin-Token: my-secret-token" \ -H "Content-Type: application/json" \ -d '{"scope": "api:read", "duration": "1h"}' # Use the token: curl -H "Authorization: Bearer YOUR_CAPABILITY_TOKEN" \ http://localhost:8080/api/capability/ping # 3. Paid — get a payment challenge (L402 today; x402/other rails as governed context) curl http://localhost:8080/api/micro

Public → Protected → Paid. Three policies, one gateway; paid rails are governed context, not the product boundary.

# Docker docker run -v $(pwd)/gateway.yaml:/etc/satgate/gateway.yaml \ -e ADMIN_TOKEN=my-secret-token -e LIGHTNING_BACKEND=mock \ -p 8080:8080 ghcr.io/satgate-io/satgate:latest # Build from source git clone https://github.com/satgate-io/satgate.git cd satgate && go build -o satgate ./cmd/satgate

version: 1 server: listen: ":8080" admin: capabilityRootKey: "${CAPABILITY_ROOT_KEY}" lightning: provider: "${LIGHTNING_BACKEND}" config: connectionString: "${NWC_CONNECTION_STRING}" upstreams: api: url: "http://localhost:3000" routes: - name: public-health match: pathPrefix: /health upstream: api policy: kind: public - name: protected-api match: pathPrefix: /api/ upstream: api policy: kind: capability scope: "api:read" - name: premium-api match: pathPrefix: /premium/ upstream: api policy: kind: l402 # paid-rail policy; use payment_context to preserve L402/x402/ledger evidence priceSats: 100

┌──────────────────────────────────────────────────┐ │ SatGate │ │ │ │ Request → Route Match → Policy Check → Proxy │ │ │ │ │ ┌──────────────┼──────────────┐ │ │ │ │ │ │ │ [public] [capability] [paid rail] │ │ pass verify token verify │ │ check budget payment │ │ log MCP tool context │ └──────────────────────────────────────────────────┘

- Macaroons: Bearer tokens with embedded caveats (expiry, scope, budget, IP). Not API keys — they supportdelegationwithout server roundtrips.
- Delegation: Agent A gives Agent B a sub-token with reduced permissions and a $50 budget cap. B can't escalate.
- MCP Parsing: SatGate reads MCP JSON-RPC payloads to attribute costs to specific tool calls, not just HTTP endpoints.
- Paid-rail context: SatGate treats L402, x402, API-key billing, and enterprise ledgers as rails to govern around. Evidence Packs preserve which rail was involved without making the rail the product.

SatGate now includes a nativeMCP proxythat governs tool calls for any MCP-compatible agent:

# Run MCP proxy with 1000-credit budget satgate-mcp --config satgate-mcp.yaml

- Budget enforcement: Hard 402 when agents exhaust their allocation
- Delegation: Parent agents mint sub-agent tokens with carved budgets
- Per-tool costs:web_search: 5,dalle_generate: 50(wildcard patterns supported)
- Two transports: stdio (local sidecar) or SSE/HTTP (remote multi-agent)
- Three auth modes: none, static token, macaroon (HMAC chain)

Seepkg/mcpserver/README.mdfor full documentation.

- Architecture Overview
- Quick Start Guide
- Configuration Reference
- Production Checklist
- Kubernetes Deployment
- LangChain Integration
- MCP Gateway Guide

Self-hosting not your thing?SatGate Cloudis the fully managed version — same gateway, zero ops.

Start Free →(Observe mode is free, unlimited, forever)

We welcome contributions! SeeCONTRIBUTING.mdfor guidelines.

git clone https://github.com/satgate-io/satgate.git cd satgate go mod download go test ./... go build -o satgate ./cmd/satgate

Apache License 2.0 — seeLICENSEfor details.

- 🌐satgate.io— Website
- 📝Blog— Technical articles
- 🏢Enterprise Governance— CISO/CFO/CTO use cases
- 💰Pricing— Free Observe tier, Pro for enforcement
- 🔒Security Model— Architecture & compliance
- 🧪Sandbox— Try without signup
- 📊ROI Calculator— Estimate savings
- ⚖️Compare— SatGate vs Zuplo, Bifrost, cloud-native
- 📧contact@satgate.io

Built with ⚡ bySatGate— The Economic Firewall

Static MCP discovery card for x402 spend-policy, paid MCP launch guidance, seller checkout repair, and agent-payment safety APIs.