ZerkerGateway

Zerker/Agent Gateway

One checkpoint for every agent call

Put one checkpoint in front of every agent call.

Keep the agents and frameworks you already use. Gateway applies identity, policy, protected credentials, rate limits, payment, and evidence before the agent receives the request.

Run the quickstart → Read the code

The request path

Control the call before the agent runs.

Gateway applies the same ordered boundary to transactional, streaming, and MCP traffic routed through its public proxy.

  1. 01Identify

    Resolve the tenant, caller, catalog agent, and requested operation.

    OIDC · CATALOG
  2. 02Decide

    Apply policy, rate boundaries, SSRF checks, and any payment requirement.

    ALLOW · WARN · DENY
  3. 03Protect

    Strip caller authorization and inject the protected upstream credential after allow.

    CREDENTIAL_REF
  4. 04Record

    Capture status, latency, sizes, errors, MCP method and tool, payment, and settlement state.

    INVOCATION

Zerker Reason

Authorize the exact action. Enforce the matching call.

Zerker Reason is deterministic authorization for exact agent actions. It evaluates governed facts, explicit rules, authority, and time, then returns a certificate Gateway can verify against the real MCP call. Today this applies to transactional tools/call when Reason enforcement is configured; it does not authorize every Gateway request automatically.

  1. 01Propose

    The agent proposes an exact MCP tool and canonical arguments.

    TOOL · ARGUMENTS
  2. 02Authorize

    Reason evaluates typed facts and rules and returns a deterministic certificate.

    FOUR-STATE RESULT
  3. 03Verify

    Gateway verifies the bundle and binds it to the tenant, principal, and agent.

    IDENTITY · DIGEST · TIME
  4. 04Enforce

    Gateway blocks a mismatch, replay, conflict, or failure and forwards only the exact match.

    BLOCK · FORWARD
Explore Zerker Reason →Read the source

Business outcomes

Register once. Every call gets the same checks.

Register each agent once. Apply the same checks to every HTTP or MCP call that passes through Gateway.

Connect

Put existing agents behind one address.

Register HTTP, streaming, or MCP upstreams once. Callers use a stable catalog identity instead of an arbitrary URL.

CATALOG · HTTP · MCP
Protect

Keep upstream secrets away from callers.

Store credentials as write-only resources, remove caller authorization, and inject the protected credential only after allow.

WRITE-ONLY · ENVELOPE ENCRYPTED
Control

Apply the decision before costly work starts.

Evaluate identity, tenant, policy, SSRF, rate, and payment requirements before the upstream receives the request.

ALLOW · WARN · DENY
Monetize

Turn usage into a paid agent offering.

Price an agent or MCP tool, issue an x402 challenge, verify authorization, and optionally settle before forwarding.

PRICE · VERIFY · SETTLE
Operate

Trace outcomes without collecting everything.

Record timing, errors, protocol details, tool names, token and cost fields, payment, and settlement state. Bodies stay off by default.

EVIDENCE · PRIVACY
Own

Run the boundary where your data already lives.

Deploy the Apache-licensed Go service with your OIDC provider and Postgres. Gateway has no required Zerker control plane.

SELF-HOST · NO CALL HOME

What it changes

What each control saves you.

Each control produces an operating outcome: fewer secrets in application code, fewer one-off policy implementations, clearer failures, and evidence tied to the invocation.

01

Catalog every callable agent.

Keep tenant-scoped identity, status, suspension, protocol, upstream, rate boundary, credential reference, tags, and pricing in one system of record.

/v1/agents
02

Serve transactional, streaming, and MCP traffic.

Return 202 and polling for transactional work, pass streaming responses through with time-to-first-token evidence, and support MCP Streamable HTTP with method and tool records.

HTTP · STREAM · MCP
03

Enforce identity and tenant isolation.

Authenticate OIDC bearers, resolve client and acting-user identity, scope resources by tenant, and return 404 for cross-tenant resource access.

OIDC · TENANT
04

Decide before work starts.

Apply ordered allow, warn, or deny rules, default and on-error posture, SSRF checks at write and dial time, and per-agent rate boundaries before forwarding.

POLICY · SSRF · RATE
05

Protect upstream access.

Credentials are separate write-only resources with masked metadata and envelope encryption. Caller authorization is stripped before the referenced credential is injected.

CREDENTIAL_REF
06

Recover from ordinary upstream failure.

Use retries and circuit breaking where replay is safe. MCP tools/call is deliberately never retried automatically because the operation may have side effects.

RETRY · CIRCUIT
07

Meter, verify, and settle paid work.

Price an agent or MCP tool, return an x402 challenge, verify signed authorization, and optionally settle before the upstream runs. Settlement failure prevents execution.

PRICE · VERIFY · SETTLE
08

Investigate the exact outcome.

Filter and page invocation records by agent, result, mode, error, time, and settlement. Aggregate counts, errors, latency percentiles, and streaming TTFT over bounded windows.

INVOCATIONS · ANALYTICS
09

Measure local agent activity without prompt capture.

Adapters for Pi, Claude Code, Codex, Gemini CLI, and Hermes report privacy-safe session, tool outcome, model, token, and cost fields without prompts or tool payloads.

ACTIVITY · OPT-IN

Clear boundary

A gateway, not a replacement runtime.

Zerker does not ask you to rewrite agents around a new framework. It controls traffic routed through its proxy and measures adapter events that explicitly opt in.

HTTP + MCP routing

Transactional calls return 202 and can be polled. Streaming calls pass through directly. MCP uses Streamable HTTP and records method and tool metadata.

Self-hosted operations

Run one statically linked Go service with automatic migrations, health and version probes, optional Postgres durability, graceful rollouts, and no required call home.

Deliberate limit

Only routed traffic is governed

A call that bypasses Gateway also bypasses its policy, credential injection, payment gate, and invocation record. Gateway does not claim otherwise.

Build on it

Console operates the tenant. Portals package governed agents for customers. Rooms carries durable multi-agent work through the same proxy boundary.

Operate

Operator Console

Work from the catalog, inspect invocations and settlement state, and act on conditions derived from tenant data.

See Console →
Publish and sell

Agent Portals

Package approved agents with documentation, customer access, plans, usage, and support.

See Portals →
Deliver durable work

Agent Rooms

Coordinate persistent, membership-scoped agent work while every addressed call still goes through Gateway.

See Rooms →

Put one agent behind the boundary.

Start with a local development issuer, register one upstream, route a call, and inspect the resulting invocation record.

Open the quickstart →Read Gateway docs