Quick Start

What is AgentGate?

AI Agent → AgentGate → Identity, Delegation, Data, Policy, Risk, Operational Rules → ALLOW / REQUIRE_APPROVAL / BLOCK → Pre-execution Confirmation → MCP / GitHub / Model / Agent

Control AI agent interactions—including GitHub, MCP, models, and inter-agent communication—before execution. Pass only the AgentGate key to the agent; connection credentials are managed on the server side. Restrict direct connections at the organizational level and route all relevant operations through this path.

1. Getting Started with GitHub

1. Create an account. If starting with MCP or models, proceed to their respective connection guides.
2. Install the GitHub app with the "Only select repositories" option.
3. Create a sandbox agent by specifying its name, owner, and purpose, and save the displayed API key—this is the only time it will be shown.
4. Review permissions, delegation, and data rules for humans and agents under Organization/Permissions, and run safety simulations using policies with limited scope.

Verify policies and approval workflows using a test repository before connecting to a production repository.

Check GitHub App permissions before connecting

At first, select only the test repository and connect. The permissions and purposes used in standard GitHub integration are as follows. Please check the actual permissions to be granted and the target repository on the GitHub installation confirmation screen.

• Metadata (read): Obtain repository information.
• Issues (reading and writing): Creating an issue and closing it during a recovery operation.
• Pull requests (read/write): Creation of Pull Request.
• Contents (reading and writing): Merging pull requests and deleting branches during recovery operations.

Administration privileges are not granted in the standard configuration. Deletion of the repository is denied using the default BLOCK rule. Authorization on the GitHub side alone does not permit Agent operations, and settings for the target, tool, authority, delegation, and policy are required on the AgentGate side as well.

Required permissions are from GitHub officialRepository acquisition、Issue creation、Pull Request operation、Deleting branch references You can also check. If you want to stop usingConnection disconnection/authorization revocation/deletion Please proceed to.

2. Agents and Policies

Create an agent on the Agent screen and save the API key to a secrets management service. On the Policy screen, configure actions, resource patterns, decisions, and priorities. Requests are denied by default if no policy matches.

Stop the agent in the event of a leak or anomaly. While stopped, all actions are denied; you can resume operation or rotate keys via the Agent screen.

Set Policy by limiting the target Select Agent, connection destination, Tool, and resource in

1. policy, and enter the judgment and reason. You can also add it from the Tool details of MCP Server.
2. If there is a matching valid BLOCK rule, it will be rejected even if the ALLOW or approval rule has a high priority. For example, even if the priority of ALLOW is 1000 and the BLOCK that matches the same operation is 10, the result is BLOCK. If there is no BLOCK, the highest priority matching valid rule is used. If the priority is the same, the Agent specification comes before all Agent specifications, and if they are also the same, they are ordered by ID.
3. MCP resources are obtained from the synchronized Tool's Resource argument.docs/*is matchesdocs/public, but Does not matchdocs/a/b. It is also case sensitive. If the Resource argument is not specified, the target is It will be*.
4. ALLOW does not compensate for deficiencies in privileges, delegation, or data rules. Please check the actual Agent and request inConfiguration Simulationand revalidate after making changes.

Disabled policies are excluded from the judgment and the number of applied cases in the Agent list. You can view the rules and versions that matched individual requests in your audit history.

Register/change agent usage Usage is required for

agentregistration. Please be specific about what you want to do and for which target. It cannot be registered if it is just blank.

What is the purpose of the existing Agent?Identity settings for organization/authority Change with. The saved purpose of use will also be reflected in the Agent list. If the record is old and the usage has not been set, the settings screen can be used, but new operations and execution after approval will be rejected. Please set your purpose before submitting a new request.

Compare Shadow judgment

Shadow comparison report for operation and accident responseallows you to select judgments that were not executed externally and compare them with human judgments or saved production judgments. To compare with Production, it is necessary to record the same connection destination, tool, target, and saved input. The target is Production/Autonomous at the time of recording.

When the Owner/Admin/Approver saves the comparison, links to both matching and non-matching records will be displayed. For the same judgment/comparison type, the last comparison is aggregated, and the acquisition range is the latest 1,000 audit histories. There is no external rerun with comparison or detail display.

3. Action API

curl -X POST https://app.agentgatehq.com/api/v1/actions \
  -H "Authorization: Bearer $AGENTGATE_API_KEY" \
  -H "Idempotency-Key: $AGENTGATE_REQUEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"github.repo.read","resource":{"owner":"YOUR_ORG","repo":"sandbox","installationId":"YOUR_INSTALLATION_ID"},"payload":{}}'

Set `AGENTGATE_REQUEST_KEY` to an identifier (8–160 characters) saved for this specific operation. When resending the same operation, ensure the identifier and request body remain unchanged. In TypeScript, pass the same headers and JSON body to `fetch`. Store API keys exclusively in a server-side secret management service.

// Node.js 24 / TypeScript: run on your server, never in browser code.
async function readSandbox(apiKey: string, requestKey: string) {
  const response = await fetch("https://app.agentgatehq.com/api/v1/actions", {
    method: "POST",
    redirect: "error",
    signal: AbortSignal.timeout(50_000),
    headers: {
      Authorization: `Bearer ${apiKey}`,
      "Idempotency-Key": requestKey,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      action: "github.repo.read",
      resource: { owner: "YOUR_ORG", repo: "sandbox", installationId: "YOUR_INSTALLATION_ID" },
      payload: {},
    }),
  });
  const result: unknown = await response.json();
  return { httpStatus: response.status, result };
}

// Supply your server-side secret and the saved key for this exact request.
// const result = await readSandbox(apiKey, savedRequestKey);
// Check result.result.decision and execution.status before treating it as executed.
// On timeout/network failure, inspect audit history; do not retry with a new key.

4. Determination

Requests are rejected by default if no matching valid policy exists.

MCP Connection

1. Register a public HTTPS endpoint that supports Streamable HTTP in Servers and synchronize the Tool.
2. Specify the Resource argument for the Tool, and set the delegation from Human to Agent and the upper limit of privileges in the organization settings.
3. Register Tool/Resource policies and input/output data rules. If not set, it will be rejected.
4. MCP Client Connect to/api/mcpand set the Agent key in the Bearer header. Add an 8 to 160 character Idempotency-Key to the Tool call.

Do not pass the credentials of the connection destination to the Agent, and reject direct connections other than AgentGate on the connection destination side as well.

Model connections and budgets

Model Registry for operation and accident response Set in. Additions and changes are applicable to Teams and above. The provider's authentication information is set on the server side by the operator, and only the AgentGate key is passed to the agent.

1. Identification namesummary-model, the corresponding application Register the model assummary. Standard cloud connectivity adapterai-gateway. provider (e.g. openai) and the model ID, version, and unit price available from that provider.
2. Be sure to select the organization and agent to be allowed, and set the processing region, confidentiality, and token limit. Models with empty organization and agent selections cannot be used. Check the contents and set the usage status to APPROVED.
3. Organization/authorityConnection destination "AgentGate internal model/Agent-to-Agent communication", Tool namemodel.generate, target resource Specifysummary-model. Set READ permissions for Human and Agent, valid delegation from Human to Agent, and required READ permissions for Tool.
4. Register data classification and INPUT/OUTPUT data rules for the same connection destination, tool, and resource, and read only public data that is allowed to be sent externally. On the policy screen, set ALLOW or REQUIRE_APPROVAL to limit the target Agent, Tool, or resource. Unset or DENY cannot be canceled by model registration.
5. Set the daily/monthly budget (USD) for each agent or the entire organization, and the BLOCK/approval/alternative model in case of exceedance using Budget, and publish the rules.

{
  "provider": "mcp",
  "server": "00000000-0000-4000-8000-000000000005",
  "tool": "model.generate",
  "resource": "summary-model",
  "arguments": {
    "prompt": "Please create a short public greeting.",
    "task": "summary",
    "sensitivity": "PUBLIC",
    "residency": "GLOBAL",
    "maxOutput": 512,
    "maxCost": 0.02
  }
}

resource: "auto"selects the one with the lowest estimated cost from among the approved models that meet the conditions. Permissions and policies to use auto are also required. If a specific identification name is specified, that model will be used, and if failure occurs, the registered alternative models will be tried in priority order. We will reconfirm the authority, data, budget, and operational stage of the Agent at each alternative destination. If restrictions such as Obsolete/Shadow/Limited are applied during the process, subsequent calls will be stopped. If you stop switching without knowing the results of the previous model, we will keep it as "result unknown" and guide you to check the provider's records.

Success isexecution.statusandexecution.result.usage, Check the activity details for failures. If you wish to refuse use, please check the authority and connection settings of the provider, and if the result is unclear, please check the records of the provider. Instead of automatically redoing the same request, keep the estimated cost of unknown results in your budget.

Check communication between agents

The sending agent is an internal tool. Specify the receiving Agent ID and message in agent.request. Communication permission is registered between Agents of the same organization, and permissions, policies, and data policies are required on both the sending and receiving sides. reception only Requests cannot be made directly toagent.receive.

If the receiving side is waiting for rejection or approval, the process will not proceed. The receiving side's judgment is included in the sending side's operation result.Replay of accident investigationallows you to move from tracking communication between agents to saved judgments for each sender and receiver. Even if you open the history, communication will not be re-executed. Check the depth, daily number, circulation, and organizational boundaries of the configured delegations.

Confirm the proposed settings without saving them

Rule simulation for operation and accident response You can specify the target Agent and request inand check the final judgment based on the saved settings or the settings plan being edited on the same screen. You can copy saved requests by opening Replay in an incident investigation. Masked data will not be restored.

Configuration proposals will not be published, nor will tools be run or approval requests created. Current permissions, data rules, and emergency suspensions will still apply in the proposed configuration. If intent analysis is enabled, a fee may be charged for using the analysis model. Judgments are current at the time of implementation, so please reconfirm if you change input or settings.

Data Control

Classify PUBLIC, INTERNAL, CONFIDENTIAL, and RESTRICTED by field, and set READ, MASK, and DENY for input and output. MASKed values ​​cannot be restored. External transmission requires externalAllowed and permission from the connection destination.

Prompt and Tool output are untrusted inputs. Including directives does not change permissions or policies. Please do not include Secret/Cookie/Token in the request body.

Track decisions and execution

API responsecontrolreturns contractVersion, requestId, actionId, decisionId, executionId, reasonCodes, and versions. You can track the same operation by resending the same Idempotency-Key and the same body. Reusing in different texts is 409.

BLOCK will not be canceled by subsequent risk assessment, approval, or billing. ALLOW indicates permission to execute. Please check the execution result with execution.status.

Emergency stop/Replay/Recovery

STOP ALL AGENTS in Enterprise stops new executions of the organization. Any pending approvals before suspension will still require a new request after restart. Individual Agents can be suspended, and MCP Servers and Models can be disabled.

Compare the then and current Policy, Authority, and Risk using Action Replay. Replay itself does not perform any external operations. Compensable Tools validate the current version and require human approval for high-impact restorations. Please do not rerun UNKNOWN automatically and check the result at the connection destination.

In compatible plans, you can obtain the audit, action, approval, black box, enterprise, authority, and risk setting history of the selected organization within the retention period in JSONL from "Export trail" on the operation screen. There are no omissions depending on the number of items displayed on the screen. There is JSON for each line, and the last line records the completion of acquisition and the number of items by type. If it fails during the process, the file will not be saved and you will be prompted to try again. Please check the download location in your browser. Expired records and secret values ​​before obfuscation cannot be restored.

Confirm the rapid increase in Risk/BLOCK

AI SOC surge monitoringallows you to compare the number of BLOCKs and High/Critical Risks for the most recent hour and the previous hour. Confirmation is required if each target has 20 or more cases and the number of cases exceeds 3 times. A small amount of data is not proof of normality. Targets all retained data, and also displays the comparison time and number of items.

Check the Agent, Tool, and rejection reason from "Check the cause by event" and review the permissions and policy as necessary. Only detection does not involve changing settings or stopping the Agent. Evaluate on screen reload and on periodic workers. For external notification, it is necessary to set the log notification destination on the operation side.

Processing roles and retirees

Admin is responsible for management, Security is responsible for suspension and safety policy, Approver is responsible for approval, MANAGER is responsible for Policy Manager, and VIEWER is responsible for viewing and auditing. For SSO, register the Supabase Auth Provider ID with your organization and connect. For the first time, log in from the organization-specific SSO link, agree to the terms of use, and share the displayed user ID with the organization owner. It can be used when the Owner sets the affiliation and Role in the member addition method "User ID". This is a separate account from the normal login using the same email, and existing privileges will not be automatically transferred.

When leaving an organization, the organization member is disabled, the owning agent is stopped, and keys and delegations are revoked. Enterprise session expiration will also be reflected in the existing access token. All sessions for users who also belong to other organizations can be revoked by the user themselves or by the company-wide authentication administrator.

Plans & Retention Periods

Start with Free and use Plan purchase to switch to a paid plan, and manage your contract from Fees/Usage Status Start from. Even if payment failure or cancellation changes your limits, safety policies and emergency stop remain active. Each record keeps the retention period set when it was written; downgrading does not shorten existing retention.

Trails can be exported from Enterprise. Compliance labels indicate compliance with regulations and do not imply external certification.

5. Approval Flow

Review the `approvalId` from the response on the approval screen; check the target Tool, resources, input, and reason before approving or rejecting. The original input is locked; execution will not proceed if the request expires, is rejected, or undergoes duplicate approval. Permissions, data rules, and suspension status are re-verified even after approval. Check the results via the approval card and audit history.

6. Activity / Audit Logs

Activity logs record events—such as action receipt, policy determination, approval, and execution success or failure—as append-only entries. You can filter by agent, determination, action, or date, and trace the entire process using the request ID.

Compliance/setting history In, check the reason for the rule, the version at the time of recording, and the corresponding label, and proceed to Replay the corresponding operation. The publication history of operational rules saves the settings at the time of publication. By switching the displayed history, you can narrow down the relevant records and setting disclosure.

Compliance is a function to register rules established by an organization. Open the operational rule Compliance in Team or higher and set the target connection destination, tool, resource, confidentiality, and whether to stop or require approval. When changing existing rules, please increase the version and publish it. Label registration is not a guarantee of external certification or legal compliance.

7. Errors and Retries

For 401 errors, check authentication credentials; for 409, check for request conflicts or approval/configuration status; for 429, check for rate limits or plan caps. If a 429 response includes a `Retry-After` header, wait for the specified duration. Since 5xx errors or communication interruptions may leave the execution status uncertain, verify the `requestId` and check audit logs or connection destination records. Use the same request body and `Idempotency-Key` to check the status of a request; do not automatically retry an operation with an unknown result using a new key.

8. Security

• Do not send API keys or GitHub tokens to logs, feedback channels, or browsers.
• Limit GitHub App permissions to the minimum required and restrict access to selected repositories.
• If a leak occurs, stop the agent and rotate (update) the keys.
• Installation tokens cannot be issued after the GitHub integration is disconnected.

Connection disconnection/authorization revocation/deletion Please proceed to

1. Stop the target Agent and write out the necessary audit trail within the retention period. Rekeying revokes the old key and disables human-to-agent delegation and unnecessary affiliations.
2. Disable MCP Server/Model and revoke credentials and access permissions for AgentGate at the connection destination.
3. Remove the AgentGate association on the settings screen, and also configure or uninstall AgentGate via the "Installed GitHub Apps" screen on GitHub. Revoking repository access will cause operations on that repository to fail for security reasons.
4. To delete the Agent itself, use the management API DELETE /api/v1/agents/:id in an authenticated session of the administrator. The history remains depending on the retention period and ongoing processing, so please do not interpret deletion as canceling external operations or immediately erasing audits.

Cancellation of contractFees/Usage Status Start from. Request for deletion of personal information and storage period Please checkPrivacy Policy. Simply disconnecting on the screen will not delete the provider account or existing external data.

Sample Agent / Example MCP Server

You can get an execution sample that runs on Node.js 24 from this page. The Agent connects to the action API using standard fetch, and the MCP Server connects to the public sample document. Provides onlydocument.read.

1. Create an empty folder and save the following 4 files in the same folder.
   • Download Agent (agent.mjs)
   • Download MCP Server (mcp-server.mjs)
   • Download dependencies (package.json)
   • Download the environment settings template (agent.env.example)
2. Open that folder in the terminal, install the dependencies and start the Server with the command below. Requires Node.js 24 and npm.
3. agent.env.exampleSave it as.env.agent.localand set the AgentGate URL, Agent key, registered MCP Server ID, and request identifier. Please do not publish or commit files with keys set.

npm install
npm run server
# Open the same folder in another terminal
npm run agent

Local Server It will be waiting at127.0.0.1:3110/mcp. You cannot connect to localhost from public AgentGate. For actual connection, place the sample in a managed HTTPS environment, add Gateway-specific authentication and direct connection restrictions, and then register and synchronize. The Resource argument ispath, the target isdocs/public. Please set Human/Agent's authority, delegation, input/output data rules and policies first.

Client using MCP SDK is Streamable HTTP Connect to/api/mcpand send Bearer and Idempotency-Key for each call. Please specify the Tool name returned by tools/list as is in tools/call. The original Tool name you connect to and the name on the Gateway may be different.

10. Troubleshooting

• GitHub not connected: Reconnect the app via the setup process.
• MCP connection failure: Check the Endpoint, Secret reference, and Timeout settings under "Servers," then retry the connection test and tool synchronization. If only the list retrieval fails, simply reload the list.
• Repository not found / Insufficient permissions: Check the selected repositories and app permissions on the GitHub side.
• BLOCK: Check the reason code to verify the agent's purpose, permissions, delegation, data rules, policies, and suspended status. Do not bypass this using unconditional ALLOW or by directly distributing credentials.
• Usage Limits / Timeouts: Check error codes, the "Retry-After" header, and audit logs. For UNKNOWN errors, check the execution result at the destination; do not automatically retry.
• Agent Suspended: Check the status on the agent screen and resume operation after resolving the cause. When updating keys, the old key becomes invalid; ensure agent-side settings are updated accordingly.