ZerkerGateway

Zerker/Agent Gateway

Agent Gateway · open source

One checkpoint for every agent call.

Identity, policy, credentials, rate limits, and payment, checked before the agent runs. Keep the agents you already have.

Run the quickstart → Read the code

The request path

Four steps on every call.

The same order for HTTP, streaming, and MCP traffic.

  1. 01Identify

    Resolve the tenant, caller, catalog agent, and requested operation.

    OIDC · CATALOG
  2. 02Decide

    Apply policy, rate boundaries, SSRF checks, and any payment requirement.

    ALLOW · WARN · DENY
  3. 03Protect

    Strip caller authorization and inject the protected upstream credential after allow.

    CREDENTIAL_REF
  4. 04Record

    Capture status, latency, sizes, errors, MCP method and tool, payment, and settlement state.

    INVOCATION

Zerker Reason

Authorize the exact action.

Reason checks one proposed action against your facts, rules, authority, and time, with no model in the decision path. Gateway forwards only the matching call. Today this applies to transactional tools/call when Reason enforcement is configured.

  1. 01Propose

    The agent proposes an exact MCP tool and canonical arguments.

    TOOL · ARGUMENTS
  2. 02Authorize

    Reason evaluates typed facts and rules and returns a deterministic certificate.

    FOUR-STATE RESULT
  3. 03Verify

    Gateway verifies the bundle and binds it to the tenant, principal, and agent.

    IDENTITY · DIGEST · TIME
  4. 04Enforce

    Gateway blocks a mismatch, replay, conflict, or failure and forwards only the exact match.

    BLOCK · FORWARD
Explore Zerker Reason →Read the source

What it does

Register once. Same checks on every call.

Six controls, applied to every HTTP or MCP call through Gateway.

Connect

Put your agents behind one address.

Register HTTP, streaming, or MCP upstreams once. Callers use a stable catalog identity instead of an arbitrary URL.

CATALOG · HTTP · MCP
Protect

Callers never see your keys.

Store credentials as write-only resources, remove caller authorization, and inject the protected credential only after allow.

WRITE-ONLY · ENVELOPE ENCRYPTED
Control

Decide before the agent does anything expensive.

Evaluate identity, tenant, policy, SSRF, rate, and payment requirements before the upstream receives the request.

ALLOW · WARN · DENY
Monetize

Charge for agent usage.

Price an agent or MCP tool, issue an x402 challenge, verify authorization, and optionally settle before forwarding.

PRICE · VERIFY · SETTLE
Operate

See what happened without storing prompts.

Record timing, errors, protocol details, tool names, token and cost fields, payment, and settlement state. Bodies stay off by default.

EVIDENCE · PRIVACY
Own

Run it where your data lives.

Deploy the Apache-licensed Go service with your OIDC provider and Postgres. Gateway has no required Zerker control plane.

SELF-HOST · NO CALL HOME

In detail

Every control, in detail.

Fewer secrets in application code. Fewer one-off policy implementations. Clearer failures, with a record for each one.

01

One catalog of every agent.

Keep tenant-scoped identity, status, suspension, protocol, upstream, rate boundary, credential reference, tags, and pricing in one system of record.

/v1/agents
02

HTTP, streaming, and MCP.

Return 202 and polling for transactional work, pass streaming responses through with time-to-first-token evidence, and support MCP Streamable HTTP with method and tool records.

HTTP · STREAM · MCP
03

Identity and tenant isolation.

Authenticate OIDC bearers, resolve client and acting-user identity, scope resources by tenant, and return 404 for cross-tenant resource access.

OIDC · TENANT
04

Decide before work starts.

Apply ordered allow, warn, or deny rules, default and on-error posture, SSRF checks at write and dial time, and per-agent rate boundaries before forwarding.

POLICY · SSRF · RATE
05

Protected credentials.

Credentials are separate write-only resources with masked metadata and envelope encryption. Caller authorization is stripped before the referenced credential is injected.

CREDENTIAL_REF
06

Retries and circuit breaking.

Use retries and circuit breaking where replay is safe. MCP tools/call is deliberately never retried automatically because the operation may have side effects.

RETRY · CIRCUIT
07

Meter and charge for calls.

Price an agent or MCP tool, return an x402 challenge, verify signed authorization, and optionally settle before the upstream runs. Settlement failure prevents execution.

PRICE · VERIFY · SETTLE
08

A record of every call.

Filter and page invocation records by agent, result, mode, error, time, and settlement. Aggregate counts, errors, latency percentiles, and streaming TTFT over bounded windows.

INVOCATIONS · ANALYTICS
09

Measure local agents without capturing prompts.

Adapters for Pi, Claude Code, Codex, Gemini CLI, and Hermes report privacy-safe session, tool outcome, model, token, and cost fields without prompts or tool payloads.

ACTIVITY · OPT-IN

Boundary

A gateway. Not a new runtime.

Keep your agents as they are. Gateway controls the traffic routed through it and measures the local agents that opt in.

HTTP + MCP routing

Transactional calls return 202 and can be polled. Streaming calls pass through directly. MCP uses Streamable HTTP and records method and tool metadata.

Self-hosted operations

Run one statically linked Go service with automatic migrations, health and version probes, optional Postgres durability, graceful rollouts, and no required call home.

Deliberate limit

Only routed traffic is governed

A call that bypasses Gateway also bypasses its policy, credentials, payment gate, and record.

Build on it

Console operates it. Portals sell it. Rooms run longer work through it.

Operate

Operator Console

Work from the catalog, inspect invocations and settlement state, and act on conditions derived from tenant data.

See Console →
Publish and sell

Agent Portals

Package approved agents with documentation, customer access, plans, usage, and support.

See Portals →
Deliver durable work

Agent Rooms

Coordinate persistent, membership-scoped agent work while every addressed call still goes through Gateway.

See Rooms →

Put one agent behind it.

Register one upstream, route a call, and read the record.

Open the quickstart →Read Gateway docs