SatGate – Economic Firewall for AI Agents

SatGate

Observe, control and admit AI agent traffic

Every allow or deny comes with a signed receipt

Why • Build • Features • Quick Start • Docs • Website • Blog

---

SatGate is a gateway in front of APIs and MCP tools. It meters agent and MCP traffic (Observe), enforces owner budgets before work runs (Control), and charges external agents on the routes you choose (Admit; the Charge policy in the dashboard). Every allow or deny comes with a signed receipt.

Try it as an agent. This hosted route returns HTTP 402 with a Lightning invoice and a macaroon. The price is 10 sats, and one payment buys access until the credential_expires_at time in that response, not just one request:

curl -i -H "X-SatGate-Tenant: satgate-demo" https://api.satgate.io/paid/agent-demo

Agent instructions are in llms.txt.

Build Agents with SatGate

SatGate's developer primitive is three calls: issue(), pay(), and verify().

import os

from satgate import SatGate

satgate = SatGate(api_key=os.getenv("SATGATE_API_KEY"))

capability = satgate.issue( task="research market prices", agent="research-agent", allow=["mcp:web.search", "api:prices.read"], budget_usd=25, expires_in="1h", )

receipt = satgate.pay( upstream="https://api.example.com/search", capability=capability, max_usd=4.20, )

verified = satgate.verify(receipt) print(verified.decision, verified.evidence_pack_id)

Install today:

pip install satgate

npm install @satgate/sdk

The public packages install today; the issue/pay/verify API namespace is in private beta. Calls without private-beta access raise a structured error instead of returning fake receipts:

SatGateAuthError: This API namespace requires private beta access. Visit cloud.satgate.io/docs to request access.

Runnable examples:

• examples/python/issue_pay_verify.py
• examples/node/issue-pay-verify.mjs

Works with: MCP · OpenAI tools · Anthropic tools · LangChain · CrewAI · Raw HTTP

---

🎬 See SatGate in Action

---

☁️ Don't want to self-host? Try SatGate Cloud

Managed SaaS — zero setup, multi-tenant isolation, enterprise dashboard.

Free Observe tier. No credit card required.

---

The Problem

AI agents are making API calls autonomously. They spawn sub-agents, call MCP tools, and run overnight while you sleep.

Your existing stack answers: *"Is this request authenticated?"*

Nobody answers: "Should this agent have authority to spend, delegate, or invoke this paid resource?"

✓ Network Firewall    → "Can this packet enter?"

✓ Application Firewall → "Is this request safe?" ? Economic Firewall → "Should this agent act, spend, or pay?"

That's the gap. SatGate fills it.

What is SatGate?

SatGate is an Economic Firewall for AI agent requests. Drop it in front of your APIs and MCP tools to enforce scoped authority, budgets, paid-rail context, and Evidence Pack receipts before agents act.

Not another routing layer. Routing gateways (Bifrost, LiteLLM, Portkey) optimize *which provider* handles a call. SatGate governs *whether the call should happen at all* based on authority, policy, budget, and paid-rail context.

Use them together:

Agent → SatGate (economic governance) → Routing Gateway → LLM Providers

Features

• 🛡️ Capability Tokens (Macaroons) — Cryptographic credentials with built-in caveats, delegation, and next-request revocation. Not API keys — tokens that agents can safely sub-delegate.
• 🎯 MCP-Aware — Parses MCP JSON-RPC tool calls. Know that Agent X spent $47 on search_database and $12 on send_email — not just "1,000 requests."
• 💰 Budget Enforcement — Hard stops per agent, team, or API. When the budget hits zero, requests are *blocked*. Not logged. Not alerted. Blocked.
• ⚡ Paid-Rail Governance — Govern paid API access across L402, x402, API-key billing, and enterprise ledgers without making any one rail the control plane.
• 🔒 Default-Deny — All routes require valid credentials unless explicitly public. Zero Trust by design.
• 🚀 <50ms Overhead — Lightweight Go proxy. Adds governance without adding latency.
• 📦 Self-Hosted — Your infrastructure, your rules. Single binary, Docker, or Kubernetes.
• 🔌 Drop-in — Works with any HTTP backend. REST, GraphQL, MCP servers. No code changes.

Quick Start

60-Second Demo

# Run from a clone. The example config is examples/gateway.yaml in this repo.

macOS Apple Silicon. Other v0.5.2 assets: satgate-darwin-amd64, satgate-linux-amd64,

satgate-linux-arm64, satgate-windows-amd64.exe

git clone https://github.com/SatGate-io/satgate.git cd satgate curl -L https://github.com/SatGate-io/satgate/releases/download/v0.5.2/satgate-darwin-arm64 -o satgate chmod +x satgate

Mock Lightning. Demo mode prints:

SECURITY WARNING: Using ephemeral root key. Set CAPABILITY_ROOT_KEY for production use.

That warning is expected. Tokens do not persist across restarts.

export ADMIN_TOKEN=my-secret-token export LIGHTNING_BACKEND=mock ./satgate --config examples/gateway.yaml

Try the three policies:

# 1. Public — no auth needed

curl http://localhost:8080/health

2. Protected — mint a capability token, then use it

curl -X POST http://localhost:8080/api/capability/mint \ -H "X-Admin-Token: my-secret-token" \ -H "Content-Type: application/json" \ -d '{"scope": "api:read", "duration": "1h"}'

Use the token:

curl -H "Authorization: Bearer YOUR_CAPABILITY_TOKEN" \ http://localhost:8080/api/capability/ping

3. Paid — get a payment challenge (L402 today; x402/other rails as governed context)

curl http://localhost:8080/api/micro

Public → Protected → Paid. Three policies, one gateway; paid rails are governed context, not the product boundary.

Hosted paid demo (Admit; Charge in the dashboard). No local Lightning node:

curl -i -H "X-SatGate-Tenant: satgate-demo" https://api.satgate.io/paid/agent-demo

Unpaid calls return 402 with a Lightning invoice and a macaroon. The price is 10 sats, and one payment buys access until the credential_expires_at time in that response, not just one request. For Lightning, show the invoice to the owner, poll payment status, then retry. Poll rules are in llms.txt.

📖 [Full Quick Start Guide →](docs/getting-started/quickstart.md)

Other Install Methods

# Release binary. ghcr.io/satgate-io/satgate:latest is private; anonymous pulls get 401.

Assets: satgate-darwin-arm64, satgate-darwin-amd64, satgate-linux-amd64,

satgate-linux-arm64, satgate-windows-amd64.exe

curl -L https://github.com/SatGate-io/satgate/releases/download/v0.5.2/satgate-darwin-arm64 -o satgate chmod +x satgate

Build from source

git clone https://github.com/SatGate-io/satgate.git cd satgate && go build -o satgate ./cmd/satgate

Configuration

version: 1

server: listen: ":8080"

admin: capabilityRootKey: "${CAPABILITY_ROOT_KEY}"

lightning: provider: "${LIGHTNING_BACKEND}" config: connectionString: "${NWC_CONNECTION_STRING}"

upstreams: api: url: "http://localhost:3000"

routes:

• name: public-health match: pathPrefix: /health upstream: api policy: kind: public

• name: protected-api match: pathPrefix: /api/ upstream: api policy: kind: capability scope: "api:read"

• name: premium-api match: pathPrefix: /premium/ upstream: api policy: kind: l402 # paid-rail policy; use payment_context to preserve L402/x402/ledger evidence priceSats: 100

Policy Types

How It's Different

Architecture

┌──────────────────────────────────────────────────┐

│ SatGate │ │ │ │ Request → Route Match → Policy Check → Proxy │ │ │ │ │ ┌──────────────┼──────────────┐ │ │ │ │ │ │ │ [public] [capability] [paid rail] │ │ pass verify token verify │ │ check budget payment │ │ log MCP tool context │ └──────────────────────────────────────────────────┘

Key Concepts:

• Macaroons: Bearer tokens with embedded caveats (expiry, scope, budget, IP). Not API keys — they support *delegation* without server roundtrips.
• Delegation: Agent A gives Agent B a sub-token with reduced permissions and a $50 budget cap. B can't escalate.
• MCP Parsing: SatGate reads MCP JSON-RPC payloads to attribute costs to specific tool calls, not just HTTP endpoints.
• Paid-rail context: SatGate treats L402, x402, API-key billing, and enterprise ledgers as rails to govern around. Evidence Packs preserve which rail was involved without making the rail the product.

SDKs

MCP Proxy (NEW)

SatGate now includes a native MCP proxy that governs tool calls for any MCP-compatible agent:

# Run MCP proxy with 1000-credit budget

satgate-mcp --config satgate-mcp.yaml

• Budget enforcement: