EQTY LabDocs

Agent Gateway

Learn what the Agent Gateway is, what it gives your organization, and where to start.

View as Markdown

The Agent Gateway accounts for every AI agent that works in your environment. It gives you an inventory of your agents, control over what they are allowed to do, and a record of every request they make to an LLM provider.

The gateway is an optional part of a Guardian Platform deployment. Your administrator enables it during deployment.

Why the gateway exists

Coding agents such as Claude Code, Codex, and OpenCode do their work by calling LLM providers like Anthropic and OpenAI. Left alone, those calls go straight from the developer’s machine to the provider. Your organization has no inventory of which agents are running, no way to control what they do, and no record of what they sent or received.

The Agent Gateway sits between your agents and the providers. Each request passes through it, so each request can be attributed, checked, and recorded.

The two parts

The Agent Gateway has a client side and a server side.

Viper runs on the developer’s machine, in CI, or next to a service. It wraps or proxies the agent. Developers start their agent through Viper and then work as usual. Viper captures the agent’s configuration and state, signs each outbound request with the agent’s key, and sends it to the gateway.

The gateway runs as part of your Guardian Platform deployment. It verifies each signed request, applies your policies, forwards the request to the provider, records the exchange, and returns the response to the agent.

What every request gets

Every request that passes through the gateway is:

  • Tied to an identity. The request comes from a registered agent with its own agent ID (urn:uuid:...) and an owner in your organization.
  • Signature checked. The gateway rejects requests that are unsigned, tampered with, replayed, or signed by a revoked agent.
  • Policy checked. Any policy plugins your organization or project has configured run before the request reaches the provider.
  • Recorded. The request, the response, the decision, and a reference to the agent’s state at that moment are kept as an audit record.

What you get

Inventory. The Agent Catalog in Guardian lists every registered agent, who owns it, which projects it works in, and when it was last active. See Agent Inventory.

Controls. You decide what agents may do with policy plugins, including OPA/Rego rules such as model allowlists. Policies run organization-wide, with an optional additional layer per project. You can also revoke an agent at any time. See Gateway Policies.

Audit. Every exchange is recorded. You can open any exchange to see what the agent sent, what it received, and why the gateway allowed or denied it. See Audit Trail.

Agent configuration. Viper captures the agent’s settings, skills, permissions, and environment when it starts each session and attaches that record to every request. You can see what an agent was configured with for any past request, and how its configuration changed over time. See Agent Configuration.

Verification rules. Configuration validation rules flag risky agent settings, such as unrestricted shell access or a disabled sandbox, on every request. Rules observe and tag; to block an agent based on its configuration, you write a policy, or require a certification of the configuration you approved. See Agent Configuration and Agent Certifications.

Supported agents

The gateway supports agents that talk to the Anthropic API, the OpenAI API, or the ChatGPT backend. Viper has a dedicated command for each of these agents:

AgentCommand
Claude Codeviper claude
Codexviper codex
OpenCodeviper opencode
OpenClawviper openclaw

Any other agent or application, such as a LangGraph service, runs behind viper proxy and points its provider base URL at Viper. See Run Agents, or the LangGraph Quickstart and Deep Agents Quickstart to run one as a named agent, and the OpenShell Quickstart to run one in a sandbox.

Where to start

  1. Read Gateway Basics for a walkthrough of a single request.
  2. Follow Agent Onboarding, which also lists the supported versions. In short:
  3. Check what is and is not recorded for your agent on Agent Coverage.
  4. Find the agent in the Agent Catalog and associate it with a project.
  5. Review what it is configured with in Agent Configuration and what it sends in the Audit Trail.
  6. Add controls with Gateway Policies, OPA/Rego Policies, and Policy as Code.