AI Agent Gateway: open-source tool keeps model keys and MCP credentials out of agent configs
AI agents that call tools through MCP servers or talk to model providers no longer have to store API keys and MCP credentials in their own config files. Tuskira’s AI Agent Gateway is an open-source proxy that runs inside a team’s own environment, holds the real credentials in an encrypted store, and hands them out only when an approved profile asks for an approved tool.
For any team running Claude Code, Cursor, or a homegrown ticket bot across laptops and CI runners, the gateway replaces scattered secrets with a single chokepoint that checks keys, profiles, and tool permissions on every call.
What the gateway actually does
The gateway sits between AI agents and the two kinds of services they reach: MCP tool servers that connect to platforms like GitHub and Jira, and the model providers that answer prompts. The gateway runs in the team’s own environment, and no Tuskira account is required to operate it.
A team that runs Claude Code, Cursor, and an internal ticket bot usually has model API keys and MCP credentials copied into each agent’s configuration on every laptop and CI runner. Any file leak exposes the credentials inside it, and nothing inside Tuskira’s product checks an agent’s permissions when it acts. The gateway is built to close that gap.
What happens on a call
An agent registers the gateway as its MCP server and sends a gateway key plus a profile name with every request. The gateway validates the key, ties it to a tenant and a role, and then checks whether the named profile is allowed to call the requested tool.
A denied call returns an error and is written to the log without ever reaching the backend. An allowed call has the real credential pulled from an encrypted store and attached to the outgoing request, so the agent itself never holds the GitHub token. The check runs at the moment of each call, on top of trimming the tool list each agent can see. An agent that is talked into calling a tool it was never shown still gets refused.
Model traffic can be routed through the same gateway by changing an SDK’s base URL. The gateway covers Anthropic directly or through AWS Bedrock, plus OpenAI and Gemini, and records tokens and an estimated cost for each call.
Two defaults worth checking before rollout
Profile binding is opt-in. A key with no profile attached lets the caller name its own profile in a request header, which means a leaked unbound key can request any profile it wants. Binding each key to a single profile keeps a leaked CI key scoped to what that profile allows. Tuskira’s sample CI profile is restricted to one tool.
Request and response body storage. The demo stack stores full LLM request and response bodies, capped at 1 MiB each, so the console can display them. Those bodies contain whatever prompts and code the agents send, and a single setting turns storage off.
The shipped Docker Compose file allows outbound connections to the host machine and the loopback range for local testing, and Tuskira’s guidance is to remove both for any shared deployment. Outside those exceptions, the gateway refuses connections to private and loopback addresses by default and always blocks the cloud metadata address.
Platform support and examples
AI Agent Gateway runs on macOS and Linux. Windows through WSL2 is listed as untested. The repository ships worked examples for Claude Code, Cursor, VS Code, Codex CLI, a Python agent, and Kubernetes. The project is available for free on GitHub.
FAQ
What is Tuskira’s AI Agent Gateway?
It is an open-source proxy that sits between AI agents and the MCP tool servers and model providers they call. It runs in the team’s own environment, holds real credentials in an encrypted store, and checks keys, profiles, and tool permissions on every request. No Tuskira account is needed.
How does the gateway keep credentials out of agent config files?
Agents register the gateway as their MCP server and send a gateway key plus a profile name with each request. The gateway validates the key, confirms the profile can use the requested tool, and pulls the real credential from its encrypted store to attach to the outgoing call. The agent itself never stores the GitHub token or model key.
Which models and tools does AI Agent Gateway support?
It covers Anthropic directly or through AWS Bedrock, plus OpenAI and Gemini, and it works with any MCP tool server, including those connecting to GitHub and Jira. Shipped examples cover Claude Code, Cursor, VS Code, Codex CLI, a Python agent, and Kubernetes, with support for macOS and Linux.
Related coverage
This article summarizes reporting from helpnetsecurity.com.