Agent governance and delivery

Govern the agents your company runs.

Control who can use each agent, what it can do, and what it costs, from your workforce to partners and customers. Every call leaves a trusted receipt.

Run the Gateway How it works

One agent call through Zerker live view

Your workforce gets approved agents in the tools they already use. Keys never leave Gateway.

Workforce Finance team workforce · partner · customer

1 Identity caller · tenant
2 Policy rules · limits · plan
3 Credentials protected key
4 Route proxy · evidence

Your agent contract-review runs where it already runs

waiting for a call…

overhead— denied— evidence—

Products

Three products, one governed record.

Gateway governs every call. Console runs the fleet. Portals turn approved agents into products for partners and customers. Every call leaves a receipt they all share.

Govern

Agent Gateway

Checks identity and policy, protects credentials, routes the call, and measures every agent request.

Explore Gateway →

Operate

Operator Console

Shows ownership, policy, health, usage, cost, and customer activity for every governed agent.

Explore Console →

Deliver

Agent Portals

Turns approved agents into partner and customer products, with access, Rooms, usage, and payments.

Explore Portals →

Gateway

What happens on every call.

Register your agents, control who can call them, protect their credentials, and record what happened. Enforce the same controls on every routed agent call. The path is the same whether the caller is your workforce, a partner, or a customer.

01

Identity and access

Use your identity provider and tenant boundaries to decide which people and services can call each agent.

OIDC
02

Policy and routing

Apply ordered rules by agent, MCP tool, request size, and rate, then route allowed traffic to the right runtime.

ALLOW · WARN · DENY
03

Protected credentials

Resolve and inject upstream credentials only after policy allows the call. Callers never receive the protected key.

CREDENTIAL_REF
04

Usage and outcomes

Measure calls, tool activity, latency, errors, token usage, and reported cost without collecting prompts or tool payloads by default.

INVOCATIONS

Governance happens before the agent runs. Gateway applies this path to calls routed through its HTTP or MCP endpoints.

Explore Gateway Governance for workforce →

Quickstart

Route your first call.

Register your first agent

An agent is a catalog entry: a name and an upstream_url the gateway will proxy calls to.

register.sh

curl -H "Authorization: Bearer $TOKEN" \
     -H 'Content-Type: application/json' \
     -d '{"name":"support-bot",
        "description":"handles refunds",
        "upstream_url":"https://your-upstream.example.com"}' \
     localhost:8080/v1/agents

The response includes the agent id. Use it in the proxy request.

Proxy a call through it

The transactional endpoint accepts the call and returns an invocation ID. Use the streaming endpoint when the upstream response must pass through directly.

proxy.sh

curl -H "Authorization: Bearer $TOKEN" \
     -H 'Content-Type: application/json' \
     -d '{}' \
     localhost:8080/v1/proxy/{id}

Use POST /v1/proxy/{id}/stream to stream the upstream response.

Inspect what happened

List recent invocations for the tenant. Each record includes status and timing. MCP records also include the method and tool.

inspect.sh

curl -H "Authorization: Bearer $TOKEN" \
     localhost:8080/v1/invocations

# status · latency · errors · sizes · MCP method and tool

Monetization is optional. Add a payment requirement only when the capability needs one.

Open source + hosted

Same Gateway. Your servers or ours.

Both options use the same Gateway foundation. Run the open-source data plane yourself, or operate a hosted Gateway tenant with us.

OPEN SOURCE

Run Agent Gateway in your infrastructure.

Use the Apache-licensed Go binary without a Zerker account or hosted control plane. Your team owns the runtime, identity, storage, keys, and upgrades.

View on GitHub Self-hosting docs →

HOSTED PLATFORM

Operate a hosted Gateway tenant with us.

Use Zerker's hosted Gateway and operator surface when you want the platform experience without running the Gateway process yourself.

Talk to our team Read the docs →

Exact-action authorization · Zerker Reason

Enforce company rules before an agent acts.

Reason evaluates one proposed action against governed facts, explicit rules, authority, and time, with no model in the decision path. Treeship carries the receipt across company lines. Each has a separate job behind Gateway.

Zerker Reason

Zerker Reason returns a deterministic certificate for one proposed action, checked against governed facts, explicit rules, authority, and time. Gateway forwards only the matching tool call. Interpreting instruction files into policy is product direction.

See Zerker Reason →

Treeship

Gateway speaks HTTP and MCP. For work that crosses company lines, Treeship from Zerker Labs signs MCP and A2A receipts and exports each one as an OpenTelemetry span.

Zerker Labs →

Install

Run the Gateway locally.

local dev · mock OIDC

git clone https://github.com/zerkerlabs/gateway.git
cd gateway
make dev-auth   # boots a mock OIDC issuer + the gateway

The dev target writes a ready-to-use bearer token to /tmp/zerker-dev-token. The mock issuer is for development. Configure your real identity provider in production.

Clone on GitHub Talk to our team