← Back
Home › Systems › AI and agent security

agent-gateway

policy gateway for agent tool calls and MCP traffic

MCP gateways, Invariant

SystemTechniques · 35Primitives · 108 agent-gateway Human-in-the-loop approvalagentic-ai · medium: Classify each proposed action as auto, ask or deny; park asks as durable pending records a human approves, edits or rejects, executing once, with timeouts that deny.›Model context protocolagentic-ai · medium: JSON-RPC protocol exposing tools, resources and prompts from servers to LLM clients, with capability negotiationPrompt injection defenseagentic-ai · medium: Treat every untrusted string as data, track where values came from, and make tool calls and rendered output depend on provenance, not on what the model says.›Tool retrieval (selecting tools for…agentic-ai · medium: Index tool descriptions, filter by the caller's permissions, rank against the request and put only the top few definitions in context, in a stable order.›Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Reverse proxynetworking · medium: A server-side intermediary that terminates client connections and forwards each request to one of a pool of upstream servers, with routing, health checks, timeouts and safe retries.›Json rpcnetworking · low: JSON-RPC 2.0 requests, notifications and batchingServer-sent eventsnetworking · low: One long-lived HTTP response carries text events one way; each event may carry an id, so a reconnecting client names its last one and the server resumes.›JSON Schema validationsecurity · low: Compile a JSON Schema once, then check every untrusted document against it, within hard size and depth limits, and report failures as JSON Pointers.›OAuth 2 and OpenID Connectsecurity · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Mutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Token bucketsystems · low: A bucket of up to b tokens refilled at rate r; requests spend tokens, enforcing an average rate while allowing bursts of b.›Secrets managementsecurity · low: Keep keys and passwords out of code and logs, give workloads short-lived identity instead of static keys, and make rotation routine.›Agent tracingagentic-ai · unknown: Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Circuit breakersystems · low: Stop calling a failing dependency for a while, probe it with trial calls, and resume on recovery: fail fast instead of piling up timeouts.›Graceful drainingsystems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›Statechartsgraphics · low: State machines with nesting, parallel regions, history and entry/exit actions, so UI and animation logic stays linear in size instead of exploding.›Dual control approvalsecurity · low: Four-eyes / maker-checker approval with quorum policies for sensitive operationsHierarchical timing wheelsystems · low: Timers bucketed by expiry into wheels of slots, coarser wheels for far deadlines: O(1) insert and cancel for millions of timeouts.›+ 28 more techniques+ 92 more primitives

Similar systems

Share the most building blocks with this one.

mcp-host 40 %api-gateway 39 %mcp-server 39 %zero-trust 37 %auto-remediation 35 %