AgentGate

AgentGate

Human-in-the-loop approval system for AI agents.

Agents request. Policies decide. Humans approve.

Keep humans in control of what AI agents can do.

---

Your AI agent wants to send an email, delete a file, or deploy to production. Should it? AgentGate lets you define policies that auto-approve safe actions, auto-deny dangerous ones, and route everything else to a human — via dashboard, Slack, Discord, or email.

✨ Highlights

• 🛡️ Policy engine — auto-approve, auto-deny, or route to humans based on rules
• 👥 Multi-channel approvals — Slack, Discord, email, or web dashboard
• 🔌 TypeScript SDK + MCP — works with any agent framework or Claude Desktop
• 🪝 Webhooks with retry — real-time notifications with exponential backoff
• 📝 Full audit trail — every request, decision, and action logged, each policy decision tagged with the OWASP LLM Top-10 risk it mitigates (compliance evidence)
• 🐳 Docker-ready — one docker-compose up for the full stack
• 🔐 Production-hardened — SSRF protection, ReDoS defense, structured logging, graceful shutdown
• 🔗 One-click decision links — approve or deny directly from notification emails and webhooks
• ♿ Accessible UI — keyboard-navigable approval modals, focus trapping, ARIA labels
• 💀 Skeleton loading — smooth loading states across every dashboard page
• ⚡ Fast & lightweight — Hono server, SQLite or PostgreSQL

Quickstart

# Self-host the full stack (server + dashboard + Postgres):

docker compose up

…or from source:

pnpm install && pnpm --filter @agentkitai/agentgate-server db:migrate && pnpm --filter @agentkitai/agentgate-server bootstrap && pnpm dev

Drop AgentGate into an MCP client (Claude Desktop / Cursor / VS Code) — point it at the gateway:

{ "mcpServers": { "agentgate": { "command": "npx", "args": ["@agentkitai/agentgate-mcp"] } } }

Dashboard

See all pending requests at a glance, color-coded by urgency so you know what needs attention first.

Approval Requests

Review, approve, or deny requests — filter by status to focus on what matters.

Audit Log

Search through every decision with filters for event type, action, actor, and date range.

Request Detail

Drill into any request to see parameters, context, timeline, and audit trail — with one-click Approve/Deny buttons.

API Keys

Manage API keys with fine-grained scopes, rate limits, and usage tracking. Create, edit, or revoke keys from the dashboard.

Webhooks

Configure webhook endpoints for real-time notifications. Add URLs, pick events, and let AgentGate handle retries automatically.

Login

Sign in with your API key — create one via the CLI or ask your admin.

---

Table of Contents

• Quick Start
• Architecture
• Packages
• SDK Usage
• CLI
• MCP Integration
• Authentication
• API Endpoints
• Rate Limiting
• Webhooks
• Configuration
• Docker Deployment
• Development
• Troubleshooting
• Contributing
• License

---

Quick Start

1. Install dependencies

pnpm install

2. Run database migrations

pnpm --filter @agentkitai/agentgate-server db:migrate

3. Bootstrap (create admin API key)

pnpm --filter @agentkitai/agentgate-server bootstrap

Save the API key - it's shown once only! Set it in your environment:

export AGENTGATE_API_KEY="agk_..."

4. Start the development environment

# Start server (port 3000) and dashboard (port 5173)

pnpm dev

5. Run the demo

In a new terminal (with API key set):

export AGENTGATE_API_KEY="agk_..."

pnpm demo

6. Open the dashboard

Visit http://localhost:5173 to view and manage approval requests.

Architecture

┌─────────────────────────────────────────────────────────────────┐

│ AI Agents │ │ (use @agentkitai/agentgate-sdk or MCP to request approvals) │ └───────────────────────────┬─────────────────────────────────────┘ │ HTTP API (authenticated) ▼ ┌─────────────────────────────────────────────────────────────────┐ │ AgentGate Server │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Policy Engine│ │ Request Store│ │ Audit Logger │ │ │ ├──────────────┤ ├──────────────┤ ├──────────────┤ │ │ │ API Keys │ │ Webhooks │ │ MCP Server │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ └───────────────────────────┬─────────────────────────────────────┘ │ ┌─────────────┼─────────────┐ ▼ ▼ ▼ ┌────────────────┐ ┌────────────────┐ ┌────────────────┐ │ Web Dashboard │ │ Slack Bot │ │ Discord Bot │ │(React+Tailwind)│ │(approve in DM) │ │(approve in ch) │ └────────────────┘ └────────────────┘ └────────────────┘ │ │ │ └─────────────┼─────────────┘ ▼ ┌──────────┐ │ Humans │ └──────────┘

Packages

SDK Usage

import { AgentGateClient } from '@agentkitai/agentgate-sdk';

// Create client with API key const client = new AgentGateClient({ baseUrl: 'http://localhost:3000', apiKey: process.env.AGENTGATE_API_KEY, });

// Request approval const request = await client.request({ action: 'send_email', params: { to: 'customer@example.com', subject: 'Order shipped!', }, urgency: 'normal', });

// Wait for human decision const decided = await client.waitForDecision(request.id, { timeout: 60000, // 1 minute });

if (decided.status === 'approved') { // Execute the action await sendEmail(decided.params); } else { console.log('Action denied:', decided.decisionReason); }

CLI

AgentGate includes a command-line interface for managing approval requests.

Installation

# From the monorepo

pnpm --filter @agentkitai/agentgate-cli build

Or install globally (when published)

npm install -g @agentkitai/agentgate-cli

Configuration

Configure the CLI with your server URL and API key:

# Set server URL

agentgate config set serverUrl http://localhost:3000

Set API key

agentgate config set apiKey agk_your_api_key

View current config

agentgate config show

Configuration is stored in ~/.agentgate/config.json. You can also use environment variables:

export AGENTGATE_URL=http://localhost:3000

export AGENTGATE_API_KEY=agk_...

Commands

Examples

# Create a request

agentgate request send_email \ --params '{"to": "user@example.com", "subject": "Hello"}' \ --urgency high

List pending requests

agentgate list --status pending

Approve a request

agentgate approve req_abc123 --reason "Looks good"

Deny a request

agentgate deny req_abc123 --reason "Not authorized"

Output as JSON

agentgate list --json

MCP Integration

AgentGate includes a Model Context Protocol (MCP) server for integration with Claude Desktop and other MCP-compatible clients.

Claude Desktop Configuration

Add to your claude_desktop_config.json:

{

"mcpServers": { "agentgate": { "command": "npx", "args": ["@agentkitai/agentgate-mcp"], "env": { "AGENTGATE_URL": "http://localhost:3000", "AGENTGATE_API_KEY": "agk_..." } } } }

Available MCP Tools

Authentication

AgentGate uses API keys for authentication. All API requests (except /health) require a valid API key.

API Key Scopes

Using API Keys

HTTP Header:

curl -H "Authorization: Bearer agk_..." http://localhost:3000/api/requests

SDK:

const client = new AgentGateClient({

baseUrl: 'http://localhost:3000', apiKey: process.env.AGENTGATE_API_KEY, });

Creating Additional API Keys

// Via API (requires admin scope)

POST /api/api-keys { "name": "My Agent", "scopes": ["request:create", "request:read"] }

API Endpoints

| POST | `/ap