SatGate – Economic Firewall for AI Agents — Claude Code MCP server
Controls AI agent budgets and verifies permissions before MCP tools run. It stops unauthorized spending and returns a signed receipt for every decision.
claude mcp add satgate -e SATGATE_URL=<SATGATE_URL> -e SATGATE_TOKEN=<SATGATE_TOKEN> -- npx -y satgate-mcp-bridgeWhat SatGate – Economic Firewall for AI Agents does
SatGate positions itself between autonomous agents, external APIs, and MCP tools. The Go proxy inspects incoming JSON-RPC traffic, measures dollar costs down to individual tool calls, and enforces spending limits. Once a budget reaches zero, calls are blocked on the spot instead of merely generating a log warning.
Access control relies on macaroon tokens rather than raw API keys. These cryptographic credentials support caveats, time limits, and sub-delegation to downstream agents. On paid endpoints, the gateway handles monetization via Lightning invoices and L402 payment rails.
Running the proxy without CAPABILITY_ROOT_KEY wipes active tokens whenever the process restarts. Using the stdio bridge requires Node.js along with configured SATGATE_URL and SATGATE_TOKEN values.
What it helps with
- halt tool calls instantly when an assigned budget reaches zero
- track agent spending by specific MCP tool rather than raw request counts
- delegate restricted task tokens to sub-agents with custom budgets
- monetize external agent access via Lightning Network invoices
Example prompts for the agent
- Check the current spending balance for the web search MCP tool through SatGate
- Issue a delegated capability token for the research agent with a two dollar limit
- Verify the signed receipt from the last blocked API call
How to install SatGate – Economic Firewall for AI Agents
1Platform CLI
claude mcp add satgate -e SATGATE_URL=<SATGATE_URL> -e SATGATE_TOKEN=<SATGATE_TOKEN> -- npx -y satgate-mcp-bridgeReplace <…> with your own values
2Platform CLI: remote server
claude mcp add --transport sse satgate-economic-firewall-for-ai-agents https://satgate-mcp-saas.fly.dev/ssePlatform CLI
codex mcp add satgate-economic-firewall-for-ai-agents --env SATGATE_URL=<SATGATE_URL> --env SATGATE_TOKEN=<SATGATE_TOKEN> -- npx -y satgate-mcp-bridgeReplace <…> with your own values
Config file
{
"mcpServers": {
"satgate-economic-firewall-for-ai-agents": {
"url": "https://satgate-mcp-saas.fly.dev/sse"
}
}
}{
"mcpServers": {
"satgate-economic-firewall-for-ai-agents": {
"command": "npx",
"args": [
"-y",
"satgate-mcp-bridge"
],
"env": {
"SATGATE_URL": "<SATGATE_URL>",
"SATGATE_TOKEN": "<SATGATE_TOKEN>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"satgate-economic-firewall-for-ai-agents": {
"type": "sse",
"url": "https://satgate-mcp-saas.fly.dev/sse"
}
}
}{
"servers": {
"satgate-economic-firewall-for-ai-agents": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"satgate-mcp-bridge"
],
"env": {
"SATGATE_URL": "<SATGATE_URL>",
"SATGATE_TOKEN": "<SATGATE_TOKEN>"
}
}
}
}Replace <…> with your own values
1Platform CLI: remote server
gemini mcp add -t sse satgate-economic-firewall-for-ai-agents https://satgate-mcp-saas.fly.dev/sse2Platform CLI
gemini mcp add -e SATGATE_URL=<SATGATE_URL> -e SATGATE_TOKEN=<SATGATE_TOKEN> satgate-economic-firewall-for-ai-agents npx -y satgate-mcp-bridgeReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about SatGate – Economic Firewall for AI Agents
How to install SatGate – Economic Firewall for AI Agents in Claude Code?
Add the cloud SSE endpoint with claude mcp add --transport sse satgate-economic-firewall-for-ai-agents https://satgate-mcp-saas.fly.dev/sse. For a local bridge setup, run `claude mcp add --env SATGATE_URL=<SATGATE_URL> --env SATGATE_TOKEN=<SATGATE_TOKEN> --transport stdio satgate-economic-firewall-for-ai-agents -- npx -y satgate-mcp-bridge`.
How does SatGate differ from model routers?
Routers select which model or provider handles an inference call. SatGate checks whether the agent holds financial permission and sufficient budget to perform the action in the first place.
What happens when an agent exhausts its budget?
The gateway blocks the action immediately, returning an explicit denial accompanied by a cryptographic Evidence Pack receipt.
