Economic firewall for MCP tools

Connect MCP in four steps

Start a 14-day trial. No card.
Open MCP Setup in the dashboard and copy the connect snippet. Cursor uses this:

{
  "mcpServers": {
    "satgate": {
      "command": "npx",
      "args": ["-y", "satgate-mcp-bridge"],
      "env": {
        "SATGATE_URL": "https://satgate-mcp-saas.fly.dev",
        "SATGATE_TOKEN": "paste-the-token-from-cloud.satgate.io"
      }
    }
  }
}

A new token starts at 1,000 credits. A tool call costs 1 credit unless you set per-tool costs.
Watch calls in the MCP Monitor.

Start free trial Open MCP Setup

Claude Desktop uses the same npx snippet as Cursor. Claude Code uses the claude mcp add command from MCP Setup. OpenClaw uses the tenant /mcp URL with an Authorization Bearer header, copied from MCP Setup.

Economic firewall for MCP tools

MCP for your agents, with a budget

SatGate sits in front of MCP tools. You see what each agent calls, you cap it, and you get a signed receipt when a priced call is allowed or a call is refused for budget or permission.

MCP connect snippet

The Cloud MCP connect snippets for Cursor, Claude Desktop, Claude Code and OpenClaw. Credits, not a dollar budget.

Open resource

MCP budget enforcement guide

How per-tool costs and budgets for sub-agents stop a tool call before it runs.

Open resource

Verify a signed receipt (Evidence Pack)

Check signed MCP receipts against the published keys with the open-source verifier.

Open resource

Three controls, one gateway

Observe. See which agent called which tool, and what each call would cost, without blocking anything.
Control. Give each agent token a credit budget and a tool allowlist. A call past either limit is refused before it reaches the MCP server.
Admit. Charge external agents on the HTTP routes you choose. Each route takes Lightning, USDC on Base, or both. You set how many requests a Lightning payment buys; a USDC payment buys one. See pricing.

When a receipt signer is configured, a priced call and a budget or tool-permission refusal get a signed receipt. The open-source MCP proxy does not sign one unless that signer is set. To prove what an agent was allowed to do, export those receipts as an Evidence Pack and verify them yourself. For the budget model in detail, read the MCP budget enforcement guide, or start from the developer page.

Price every tool

Assign cost profiles to MCP tools so agents cannot treat expensive operations like free function calls.

Enforce before the call runs

Block over-budget or out-of-scope tool calls before they reach the upstream MCP server.

Audit budget and tool refusals

When a receipt signer is configured, a priced call and a budget or tool-permission refusal get a signed receipt.

MCP governance FAQ

What is MCP governance?

MCP governance is the control layer around Model Context Protocol tool calls: budgets, scoped authority, revocation, signed receipts, and risk actions before agents execute tools.

Why do MCP tools need budget enforcement?

Autonomous agents can call paid or risky tools repeatedly, delegate work, or loop. MCP budget enforcement stops over-budget tool calls before the request goes through instead of discovering spend after the fact.

How does SatGate control MCP spend?

SatGate can proxy MCP traffic and enforce per-tool prices, token budgets, capability caveats and revocation before tool calls reach the upstream MCP server.