Introducing Gatehouse
AI agents stopped being chat windows a while ago. They open pull requests, run database queries, file tickets and kick off deploys. Most of that happens through the Model Context Protocol, and most of it happens with no one watching.
Today we're introducing Gatehouse, an MCP gateway that gives every agent on your team one front door.
#The problem we kept seeing
Ask how a company's agents reach its systems and you usually hear some version of this:
- Each developer connected their own agent with their own personal token.
- Those tokens are long-lived and often broader than the task needs.
- Nobody approves the risky actions. An agent can deploy to production as easily as it can read a file.
- There's no single record of what agents did, so an incident review starts with guesswork.
- Nobody reviews the MCP servers themselves, even though their tool descriptions go straight into the model's context.
Security teams respond the only way they can: by saying no. Then people connect agents anyway.
#What Gatehouse does
Gatehouse is a single URL every agent connects to. Behind it, for every tool call:
- It knows who's asking. People sign in with your SSO. Agents get short-lived tokens tied to that person.
- It checks the tool. New tools are off until an admin reviews them. If a server quietly changes a tool's description, the tool pauses.
- It checks policy. Allow, require approval or deny, by tool, group, person and argument values. No match means no.
- It asks a person when it should. Approvers see the exact call in the console or Slack, and can't approve their own.
- It holds the keys. Credentials are stored encrypted and added on the way out. Agents never see them.
- It writes it down. Every call lands in a hash-chained audit log you can verify, export and stream to your SIEM.
And when someone needs a tool they don't have, they can ask from the same chat. Their agent files the request, and an admin approves it in one click.
#Built for the people who say yes
We built Gatehouse for platform and security teams who want to say yes to agents. That means the boring parts matter: SCIM, roles, two-step verification, IP allow-lists, password policies, break-glass access, and a self-hosted deployment that runs fully air-gapped.
It's one process and one database. You can try it in a minute with npm run demo, or run it in your own Kubernetes cluster today.
#Get started
Read the quickstart, or go straight to self-hosting. We'd love to hear what you connect first.