The Economic Firewall for AI Agents

Protect any API your agents call

HTTP APIs and MCP tool calls — authenticated, logged, cost-tracked, and budget-enforced. Per-agent budgets. Delegation hierarchies. Instant revocation. Connect in 5 minutes.

One gateway. Every protocol.

SatGate protects HTTP REST APIs and MCP tool servers equally. Same policies, same dashboard, same enforcement.

HTTP APIs

REST · GraphQL · Any HTTP endpoint

Your agents call OpenAI, Stripe, internal services — SatGate sits in front as a reverse proxy. Every request is authenticated, metered, and budget-checked before reaching the upstream.

# Route config
path: /openai/*
upstream: https://api.openai.com
policy: control
cost_credits: 10
  • Reverse proxy for any HTTP API
  • Per-route cost attribution
  • API key injection (agent never sees upstream keys)

MCP Tool Servers

Cursor · Claude Code · Any MCP client

SatGate proxies MCP tool calls from AI agents to your tool servers. Every tool/call is intercepted, cost-attributed, and governed — the agent sees standard MCP, your tools see standard MCP.

# Cursor MCP config
{
  "url": "https://satgate.cloud/sse",
  "headers": { "Authorization": "Bearer <token>" }
}
  • Per-tool cost profiles
  • SSE + Streamable HTTP transports
  • Real-time MCP Monitor dashboard

Start observing. Enforce when ready.

Every SatGate deployment starts in Observe mode. See the data. Then enforce.

Free

Observe

See every API call, every tool invocation, every credit spent — without blocking anything. Shadow reporting shows what enforcement would have caught.

  • Real-time monitoring
  • Cost attribution by agent
  • Shadow Report analytics

Control

Set per-agent budgets. Get alerts at thresholds. Block requests when budgets are exhausted — agents get HTTP 402. No surprise bills.

  • Per-agent credit budgets
  • Budget exhaustion alerts
  • Fiat402 enforcement

Charge

Monetize your APIs. Agents pay per request via Lightning micropayments (L402). No API keys, no subscriptions — just pay and go.

  • L402 Lightning payments
  • Per-request pricing
  • Agent-native monetization
EZ Pass — Autonomous Agent Authentication

Agents authenticate themselves. No humans required.

Your agents present an identity credential, SatGate mints a budgeted macaroon, and they're through the gate. When the budget runs out or you revoke access — they stop. Instantly.

Agent authenticates

JWT from any OIDC provider

SatGate Mint

Issues budgeted macaroon

Agent calls APIs

Budget-enforced, revocable

Admin Kill Switch

Revoke any agent's token instantly. Next request gets 401. Cascade revocation kills the entire delegation tree.

Economic Firewall

Every token carries a spending cap. When credits hit zero, SatGate returns HTTP 402. No surprise bills. No runaway agents.

Delegation Hierarchies

Agents can delegate sub-tokens to other agents. Revoke the parent — the entire swarm stops. Full tree visibility in the dashboard.

Why agents need an Economic Firewall

AI agents don't have credit cards. They have API access. Without governance, every request is an unaudited transaction on your cloud bill.

Macaroon Authentication

Every agent gets a cryptographic bearer token with built-in scope, expiry, and budget caveats. Not an API key — a capability.

Per-Request Cost Attribution

Know exactly which agent called which API or tool and what it cost. Shadow reports show where the money goes before you enforce.

Delegation Hierarchies

Department → team → agent. Each level gets a budget. Parent tokens delegate to children. Spending rolls up automatically.

Zero Trust by Default

Agents start with zero access. Every request is authenticated and authorized. No ambient authority, no overprivileged keys.

See what your agents are really spending

Free Observe mode. No credit card. Works with any HTTP API or MCP server.