Name: SatGate
Author: SatGate-io

LABSCO SUMMARY

It answers a question your auth layer does not: should this agent be allowed to spend?

Routing gateways pick which provider handles a call; this one decides whether the call happens, using tokens an agent can safely sub-delegate with tighter caveats than it holds itself. One thing to know before planning around it: the issue, pay and verify SDK namespace is in private beta and raises a structured error without access, while the self-hosted gateway and its capability APIs work today.

What it is

A self-hosted Go gateway that sits in front of your APIs and MCP servers and decides whether a call should happen at all — based on scoped capability tokens, budgets and policy — before it reaches the backend.

What you get

Capability tokens as macaroons, with built-in caveats, delegation and next-request revocation
MCP-aware parsing of JSON-RPC tool calls, so spend is attributed per tool rather than per request
Budget enforcement that blocks when the budget hits zero, rather than logging or alerting
Default-deny routing: every route requires credentials unless explicitly marked public
Three route policies out of the box — public, capability-protected and paid
Governance endpoints to ban a token, view token lineage, and export a canonical Evidence Pack
A single Go binary, a Docker image, or Kubernetes

Requirements

Download the release binary or run ghcr.io/satgate-io/satgate:latest with your gateway.yaml. ADMIN_TOKEN authorizes minting and revocation; the proxy and its APIs share port 8080. The SDKs install as pip install satgate and npm install @satgate/sdk.

Setup effort

Follow the published steps — curl -L https://github.com/SatGate-io/satgate/releases/latest/download/satgate-darwin-arm64 -o satgate

See installation options

USE CASES

01

Capping what an overnight agent can spend

Give it a token with a budget; requests stop when the budget is gone.

02

Handing a sub-agent less authority than you have

Delegate the token with extra caveats — reduced permissions, tighter budget.

03

Knowing which tool the money went to

MCP tool calls are parsed, so cost lands against a named tool instead of a request count.

04

Answering for it afterwards

Export an Evidence Pack rather than reconstructing the story from application logs.

BEFORE YOU INSTALL

What to know first

Requires

A gateway.yaml config file
ADMIN_TOKEN set in your environment (a value you choose)
Go 1.26 or later to build the satgate-mcp proxy (go.mod declares go 1.26.6)

INSTALLATION

Connect your client

Server setup

TERMINAL

# macOS (Apple Silicon)
curl -L https://github.com/SatGate-io/satgate/releases/latest/download/satgate-darwin-arm64 -o satgate

# macOS (Intel)
curl -L https://github.com/SatGate-io/satgate/releases/latest/download/satgate-darwin-amd64 -o satgate

# Linux (x86_64)
curl -L https://github.com/SatGate-io/satgate/releases/latest/download/satgate-linux-amd64 -o satgate

chmod +x satgate

# Create gateway.yaml (template: https://github.com/SatGate-io/satgate/blob/HEAD/docs/getting-started/quickstart.md#2-configure), then run:
export ADMIN_TOKEN=<YOUR_ADMIN_TOKEN>
./satgate --config gateway.yaml

MCP Clients

Claude Code

CLAUDE CODE · TERMINAL

git clone https://github.com/SatGate-io/satgate.git
cd satgate
go build -o satgate-mcp ./cmd/satgate-mcp

Create satgate-mcp.yaml: under upstreams, name the MCP server you want to gate (transport stdio and its command), then set budget.limit, tools.defaultCost and enforcement.mode — the minimal example in docs/guides/mcp-gateway.md wraps the filesystem server in observe-only shadow mode

Add this to .mcp.json in your project (or your client's MCP config):

CLAUDE CODE · JSON

{
  "mcpServers": {
    "gated-filesystem": {
      "command": "satgate-mcp",
      "args": [
        "--config",
        "<YOUR_PATH_TO_SATGATE_MCP>"
      ]
    }
  }
}

Use the full path to the satgate-mcp binary you just built (inside the satgate folder) unless you move it onto your PATH, and the full path to your satgate-mcp.yaml. The proxy starts your upstream server itself and presents its tools to the client.

SatGate