Hard-Capping MCP Tool Spend with SatGate Proxy

Your AI agent just burned $500 overnight calling Google Search in a loop. You found out when the bill arrived. Sound familiar?

If you're running Claude Code, Cursor, or Claude Desktop with MCP tools, you've probably had a version of this moment. Maybe it was $50, maybe $5,000. The pattern is always the same: an agent gets stuck, loops on a tool call, and your API bill explodes while you sleep.

There's a fix. And it doesn't involve monitoring dashboards, Slack alerts, or hoping you catch it in time.

The Problem: MCP Has No Credit Card Limit

The Model Context Protocol is brilliant at what it does: giving AI agents structured access to tools. Search engines, databases, code execution, image generation — MCP makes it all available through a clean JSON-RPC interface.

What MCP doesn't do is care about cost. Every tools/call request flows through to the upstream server with no budget awareness whatsoever. The spec has no concept of "you've spent too much" or "stop here."

This creates a specific, expensive failure mode:

• Agent loops — A stuck agent can make thousands of tool calls before anyone notices. Each call costs real money: API credits, compute, tokens.
• No built-in limits — The MCP spec includes no budget, quota, or cost mechanism. It's a capability protocol, not an economic one.
• Rate limits don't help — Rate limits protect servers from overload. They don't protect your wallet from a runaway agent staying within rate limits but burning money for hours.
• Manual monitoring is reactive — By the time you check a dashboard or get a Slack alert, the damage is done.

The Solution: Spending Controls at the Protocol Level

SatGate MCP Proxy sits between your MCP client and your MCP servers. It intercepts every tools/call, tracks cost in real-time, and enforces hard budget caps — not soft alerts, not warnings, actual enforcement.

When the budget is exhausted, the proxy refuses the call with a budget_exhausted error. The agent receives a clean "Budget exceeded" message and stops. No infinite loops. No surprise bills.

The enforcement mechanism uses L402 macaroons — cryptographic tokens with embedded budget constraints. Unlike API keys (which grant unlimited access until revoked), a macaroon can encode: "This agent can spend up to $5 on search tools, expiring in 1 hour." The constraints are baked into the token itself and verified on every call.

The Governance Gap

Here's what changes when you add spending controls to MCP:

How It Works

Architecture

The proxy is transparent to both sides. Your MCP client thinks it's talking to the server. The server thinks it's talking to the client. SatGate sits in the middle, enforcing policy.

┌─────────────┐     ┌──────────────────┐     ┌────────────────┐
│  Claude Code │────▶│  SatGate Proxy   │────▶│  MCP Server    │
│  Cursor      │◀────│                  │◀────│  (search, db…) │
│  Claude      │     │  ✓ Budget check  │     │                │
│  Desktop     │     │  ✓ Cost tracking │     │                │
│              │     │  ✓ refuse at cap │     │                │
└─────────────┘     └──────────────────┘     └────────────────┘

Configuration

Point your MCP client to SatGate instead of directly to the upstream server. Here's an example for Claude Desktop:

{
  "mcpServers": {
    "satgate": {
      "command": "npx",
      "args": ["-y", "satgate-mcp-bridge"],
      "env": {
        "SATGATE_URL": "https://satgate-mcp-saas.fly.dev",
        "SATGATE_TOKEN": "paste-the-token-from-MCP-Setup"
      }
    }
  }
}

This is the snippet MCP Setup gives Claude Desktop. The cap is the budget on the token you mint there (a new token starts at 1,000 credits), and each tool call costs 1 credit unless you set per-tool costs. No code changes. No agent modifications.

What Happens on Each Tool Call

1. Intercept — Proxy receives the tools/call JSON-RPC request
2. Resolve cost — Looks up the tool name in the cost table (exact match or wildcard)
3. Check budget — Compares accumulated spend against the macaroon's budget caveat
4. Forward or reject — If within budget: forward to upstream, debit cost. If over budget, the call is refused with a budget_exhausted error

{
  "jsonrpc": "2.0",
  "id": 7,
  "error": {
    "code": -32000,
    "message": "Budget exhausted",
    "data": { "error": "budget_exhausted" }
  }
}

The agent receives a clean error, stops calling the tool, and continues with other work. No crash, no hang — just a boundary.

Macaroon Delegation

This is where it gets powerful. L402 macaroons support narrowing — you can take a token and add restrictions to it, but never remove them. This lets you create delegation chains:

Mint a token with a budget in the SatGate dashboard: Cloud, then Tokens or MCP setup.
Send the agent's calls through the gateway with that token.
There is no satgate token create or satgate token attenuate command.
There is no daily limit. A spent budget refuses the next call with code budget_exhausted.

Give your coding agent a tight budget for search. Give your research agent more for database access. Each gets exactly the permissions and budget they need — cryptographically enforced.

Getting Started