Routing gateways pick which provider handles a call; this one decides whether the call happens, using tokens an agent can safely sub-delegate with tighter caveats than it holds itself. One thing to know before planning around it: the issue, pay and verify SDK namespace is in private beta and raises a structured error without access, while the self-hosted gateway and its capability APIs work today.
A self-hosted Go gateway that sits in front of your APIs and MCP servers and decides whether a call should happen at all — based on scoped capability tokens, budgets and policy — before it reaches the backend.
- Capability tokens as macaroons, with built-in caveats, delegation and next-request revocation
- MCP-aware parsing of JSON-RPC tool calls, so spend is attributed per tool rather than per request
- Budget enforcement that blocks when the budget hits zero, rather than logging or alerting
- Default-deny routing: every route requires credentials unless explicitly marked public
- Three route policies out of the box — public, capability-protected and paid
- Governance endpoints to ban a token, view token lineage, and export a canonical Evidence Pack
- A single Go binary, a Docker image, or Kubernetes
Download the release binary or run ghcr.io/satgate-io/satgate:latest with your gateway.yaml. ADMIN_TOKEN authorizes minting and revocation; the proxy and its APIs share port 8080. The SDKs install as pip install satgate and npm install @satgate/sdk.
One command plus a key — curl -L https://github.com/satgate-io/satgate/releases/latest/download/satgate-darwin-arm64 -o satgate, then supply credentials