Keep your AI agents within budget on the paid services they use. Make outside agents pay before they use yours. Get a signed receipt for every decision.
Each time an agent uses a service, SatGate checks it first. (Developers call these services APIs.) Your own agents stop when their budget runs out. External agents pay on the routes you choose, so hammering your API gets expensive, and paying never gets them past your access rules.
Build with SatGate·See a signed receipt (Evidence Pack)
14 days free. No credit card.
The product shots come from the production recordings below.
See how it worksFour recordings from production, with narration.
Connect an API, set a route to Control, and mint a token with a 100-credit budget. Without the token the route returns 401; with it, 200. A demo agent spends the budget at 10 credits a call until SatGate blocks its next call. Then the open-source verifier checks the signed receipt for that refusal.
The agent in the recording is the dashboard's built-in demo agent.
Add an MCP server, mint a token with a 3-credit budget that can call one tool, and copy its config into Claude Code, Cursor, Hermes, OpenClaw or any other MCP client. A tool outside the list is refused before it runs. Once the budget is spent, the next call is refused too. Each refusal gets a signed receipt, and the open-source verifier checks them.
The agent in the recording is a scripted MCP client using the public satgate-mcp-bridge npm package.
Two agents trade one real brokerage account through SatGate, each with its own token. The trading agent can spend $200 a day, needs the owner's OK for any order over $4, and can only use its own account. It's refused on the owner's main account, buys $1 of Bitcoin, and is refused a $250 order the account could pay for. A $5 order waits until the owner approves it from the link in the email, then fills. The owner revokes the trading agent's token. Its next connection is refused, and the savings agent keeps trading. The refusals, the hold and each order get a signed receipt, and the open-source verifier checks them.
The agents in the recording are scripted MCP clients. The orders are real: three Bitcoin buys, $7 in total. Account numbers are masked.
Set a route to Admit and choose how external agents pay: USDC on Base, sats over Lightning, or both, each with its own price. An agent with no wallet gets 402 Payment Required and never reaches your API. In the recording, a second agent sends one cent in USDC, the payment settles on Base, and the call goes through. Sending the same payment again is refused. With USDC, each payment buys one request. On Lightning you choose how many requests one payment buys, and on sat-priced routes the price can rise under load, up to a ceiling you set; unpaid 402s don't raise it. Paying never gets an agent past your access rules, and payment decisions, refusals included, get a signed receipt.
The agents in the recording are scripted HTTP clients. The USDC payment is real: one cent, settled on Base.
Check the receipts from the video yourself. The paid call: live receipt or downloaded copy. A call refused for no payment: live receipt or downloaded copy. Then run the open-source verifier against SatGate's public key:
python3 tools/verify_evidence_pack.py https://api.satgate.io/v1/evidence/evid_e-suLq8DGymE6LvIJ2D1mTN95Oavy_4E --jwks-url https://api.satgate.io/.well-known/jwks.json --require-trusted-issuer
Free tools
Start with these three. The tools page has more calculators.
Estimate what loops, retries and fan-out could cost before anyone notices.
Open toolOur benchmark data on agent loops, retry storms and wasted spend, as JSON and CSV.
Open toolGrade your setup on budgets, permissions, revocation, MCP tools and audit records.
Open toolControl caps what your own agents can spend. Admit makes external agents pay before their request reaches you. Both leave signed receipts.
Every route except the ones you mark PUBLIC
Before SatGate forwards a request, it checks what that agent is allowed to do. Paying doesn't change that: a paid request still can't go past its permissions, use an expired token or get around a revoke.
Your agents: budgets
See usage and cost without blocking requests.
Start here. Nothing is blocked while you see which agents call what, and what it costs.
Enforce budgets and permissions before a request runs.
Then turn on limits. An agent that is out of budget or asks for something it isn't allowed is stopped before the request runs.
External agents: access and payment
Give external agents limited access, and charge them where you want to.
On a paid route, payment comes first, before the request reaches your API, so hammering it gets expensive. Paying never gets an agent past your access rules.
From Observe, Control and Admit
When SatGate allows, refuses, charges or revokes, it signs a receipt. Receipts roll up into an Evidence Pack. Your auditor can check the signatures with the open-source verifier, without having to trust us. A receipt shows what SatGate decided. It is not a compliance certificate.
Charging for access makes abuse more expensive. It doesn't replace rate limits or access controls, and it only covers traffic that goes through SatGate.
An API key gives full access or none. A SatGate token carries its own budget, permissions and expiry. An agent can hand a sub-agent a narrower token, never a broader one.
Mark a route PUBLIC to leave it open, for health checks (/healthz), docs and webhooks. Every other route is protected by default.
An agent gets a token when it starts, like putting an E-ZPass on the windshield. After that, SatGate checks and meters each request as it passes.
SatGate checks the token itself, so it doesn't call your identity provider on every request.
A 2026 paper on AI delegation describes a problem we see in practice: when agents hand work to other agents, each one needs clear limits on what it can do and spend. One approach it proposes is tokens that can only be narrowed as they are passed down, such as macaroons.
SatGate's tokens are macaroons.
Each agent gets only the permissions it needs, and each handoff can only narrow them.
Set budgets per agent and per route. SatGate checks them before forwarding.
Once an agent hits a limit, SatGate refuses its next request.
We built SatGate because standing API keys and after-the-fact alerts are a bad fit for autonomous systems. The paper put words to a problem we were already seeing in agent deployments. - Tomasev et al., 2026
Three ways to set it up. Start with one route or one tool.
REST, GraphQL, any HTTP endpoint
Route only agent traffic through SatGate
Budgets per tool, including for sub-agents
Most teams start by pointing one endpoint or one MCP tool at SatGate.
Set a policy per route: public for health checks and docs, protected for everything else.
routes:
- path: /healthz
policy: public
- path: /v1/*
policy: observe
- path: /premium/*
policy: chargeApply it when you are ready. Every version is kept, with a receipt for who changed what, so you can roll back.
v3 (applied) ← current v2 (available) v1 (available) Receipt: who, when, diff
Send agent traffic to api.satgate.io with your tenant header, so every request goes through SatGate.
# Agent requests GET https://api.satgate.io/v1/... X-SatGate-Tenant: your-tenant # MCP clients npx satgate-mcp-bridge
Receipts for allowed, denied, paid, delegated, and revoked decisions, ready to export as an Evidence Pack.
Illustrative sample, not live customer data Allowed receipts: 1,203 Denied receipts: 12,847 Paid receipts: $847 settled Delegations: 42 Revocations: 9 → Export Evidence Pack
FAQ
SatGate is a gateway that sits in front of your APIs and MCP tools. It keeps your own agents within the budgets and permissions you set, charges external agents on the routes you choose, and signs a receipt for each decision.
Before a request reaches your API or MCP tool, SatGate checks the agent’s permissions, its remaining budget and whether its token was revoked. If a check fails, the request stops at SatGate.
You set the budget, the permissions and how many times it can hand work to a sub-agent. The agent gets a token with those limits built in. Every allow, refusal, payment, handoff and revoke gets a receipt.