# SatGate – Economic Firewall for AI Agents

Controls AI agent budgets and verifies permissions before MCP tools run. It stops unauthorized spending and returns a signed receipt for every decision.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 11
- Author: SatGate-io
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/SatGate-io/satgate
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/satgate-economic-firewall-for-ai-agents

## What it does

SatGate positions itself between autonomous agents, external APIs, and MCP tools. The Go proxy inspects incoming JSON-RPC traffic, measures dollar costs down to individual tool calls, and enforces spending limits. Once a budget reaches zero, calls are blocked on the spot instead of merely generating a log warning.

Access control relies on macaroon tokens rather than raw API keys. These cryptographic credentials support caveats, time limits, and sub-delegation to downstream agents. On paid endpoints, the gateway handles monetization via Lightning invoices and L402 payment rails.

Running the proxy without `CAPABILITY_ROOT_KEY` wipes active tokens whenever the process restarts. Using the stdio bridge requires Node.js along with configured `SATGATE_URL` and `SATGATE_TOKEN` values.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://satgate-mcp-saas.fly.dev/sse`
- Environment variables: `SATGATE_URL`, `SATGATE_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

1. **Platform CLI**
```bash
claude mcp add satgate -e SATGATE_URL=<SATGATE_URL> -e SATGATE_TOKEN=<SATGATE_TOKEN> -- npx -y satgate-mcp-bridge
```
Replace <…> with your own values

2. **Platform CLI: remote server**
```bash
claude mcp add --transport sse satgate-economic-firewall-for-ai-agents https://satgate-mcp-saas.fly.dev/sse
```

### Codex

**Platform CLI**
```bash
codex mcp add satgate-economic-firewall-for-ai-agents --env SATGATE_URL=<SATGATE_URL> --env SATGATE_TOKEN=<SATGATE_TOKEN> -- npx -y satgate-mcp-bridge
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "satgate-economic-firewall-for-ai-agents": {
            "url": "https://satgate-mcp-saas.fly.dev/sse"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "satgate-economic-firewall-for-ai-agents": {
            "command": "npx",
            "args": [
                "-y",
                "satgate-mcp-bridge"
            ],
            "env": {
                "SATGATE_URL": "<SATGATE_URL>",
                "SATGATE_TOKEN": "<SATGATE_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "satgate-economic-firewall-for-ai-agents": {
            "type": "sse",
            "url": "https://satgate-mcp-saas.fly.dev/sse"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "satgate-economic-firewall-for-ai-agents": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "satgate-mcp-bridge"
            ],
            "env": {
                "SATGATE_URL": "<SATGATE_URL>",
                "SATGATE_TOKEN": "<SATGATE_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t sse satgate-economic-firewall-for-ai-agents https://satgate-mcp-saas.fly.dev/sse
```

2. **Platform CLI**
```bash
gemini mcp add -e SATGATE_URL=<SATGATE_URL> -e SATGATE_TOKEN=<SATGATE_TOKEN> satgate-economic-firewall-for-ai-agents npx -y satgate-mcp-bridge
```
Replace <…> with your own values

## When to use it
- halt tool calls instantly when an assigned budget reaches zero
- track agent spending by specific MCP tool rather than raw request counts
- delegate restricted task tokens to sub-agents with custom budgets
- monetize external agent access via Lightning Network invoices

## Example prompts
- Check the current spending balance for the web search MCP tool through SatGate
- Issue a delegated capability token for the research agent with a two dollar limit
- Verify the signed receipt from the last blocked API call

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md