For security engineers
A gate you can audit before you trust it.
A box that sees every prompt and holds your audit evidence belongs in your threat model — so AnchorGate is built to be inspected: fully open source, self-hosted inside your boundary, deny-by-default on tool calls, and signing every decision so even its own operators can’t quietly rewrite history.
The problem
Why agent traffic belongs in your threat model
MCP turned agents into actors
Tool use means agents write to systems, not just generate text. One leaked token or one wildcard allowlist entry turns a helpful integration into an exfiltration path — and most MCP setups have both.
Prompt injection meets tool use
A poisoned document in a RAG pipeline becomes an instruction to an agent with credentials. Detection isn’t enough; you need something in the path that can quarantine the session and page a human.
Safety tooling you can’t inspect
Closed guardrail services ask you to route your most sensitive traffic through code you can’t read, with logs you can’t verify. That’s a strange posture for a security control.
What the gate hardens
MCP Security
Deny-by-default: exact-string target allowlists (wildcards deliberately unsupported), shell invocations rejected outright, and single-use task-bound tokens that burn on first use.
Learn more →
Policy Enforcement
A deterministic policy DSL — IF condition THEN redact, alert, or block — compiled, human-approved, and evaluated before a request leaves. No LLM judging LLMs: the same input always gets the same verdict.
Learn more →
Signed Evidence
Every decision signed with ECDSA P-256 over RFC 8785 canonical JSON, appended to an immutable ledger, graded L1–L5. An auditor can replay who acted, what was touched, and which policy fired.
Learn more →
MCP security
An MCP gateway that assumes the token will leak
One stolen token is all an MCP integration needs to become an exfiltration path. Long-lived credentials and wildcard allowlists don’t stop it — so AnchorGate’s MCP gateway is built as if the leak already happened.
- Exact-string target allowlists — wildcards deliberately unsupported, because wildcards are how tokens get harvested.
- Shell invocations rejected outright. The posture is deny-by-default: if a target isn’t on the list byte-for-byte, the call doesn’t happen.
- TBAC single-use, task-bound tokens that burn on first use — a stolen token is useless outside its task, and useless twice.
Design partners
No borrowed logos. A standing offer instead.
AnchorGate is v0.1. We don’t have testimonials yet, and we won’t invent them — what we have is a program for the first teams who put real traffic through the gate. We’d rather build with five serious teams than sell to fifty.
Who it’s for
- Platform and GRC teams facing an EU AI Act, ISO/IEC 42001, or SOC 2 conversation this year
- Agentic workloads — RAG, copilots, MCP tool use — running in regulated environments
- Teams that want enforcement and evidence from the same gate their traffic already crosses
The exchange
You get
- A direct line to the maintainers, not a ticket queue
- Deployment support in your VPC
- Your governance requirements shaping the roadmap
We get
- Your ugliest governance requirements, stated plainly
- Feedback from a real deployment — not a demo
FAQ
What security engineers ask us
- What actually happens on a prompt-injection hit?
- A deterministic risk rule matches — say prompt-injection-via-rag — the session is quarantined, and a human is alerted, all inline. The quarantine, the risk score, and the policy version land on a signed decision event. No model second-guessing a model: the same trigger produces the same containment every time.
- Can we pen-test and review it before deployment?
- Please do — the code, the signing, the trigger, and the target matching are all in the open repository, and “audit us before you deploy us” is the intended evaluation path. Vulnerabilities go to security@anchorgate.ai; we respond within two business days.
- What is the trust boundary of a deployment?
- Your network. The stack is self-hosted — Docker Compose or Helm in your VPC — and the only egress is to the model providers you configure. There is no AnchorGate cloud, no phone-home, and no telemetry leaving your boundary. Production signing keys load from your KMS or HSM.
Read the source. Then put it in the path.
Every security claim on this site has a file you can open. Start with the MCP gateway and the signing implementation — then decide whether it earns a place in your traffic.
Read the sourceor email hello@anchorgate.ai