This Agent Gateway console is restricted to authorized tenant administrators (WEB_ADMIN_EMAILS). Enter your administrator email below to authenticate via the OAuth / OIDC flow.
Every sign-in goes through the identity provider OAuth flow (with account selection / re-authentication prompt) and verifies that your authenticated email matches both the email entered above and this tenant's administrator allowlist.
Delegations
loading…
Create delegation
Pending approvals
loading…
Approving binds consent to the exact action (resource + amount +
details). If the agent changes those details, a new decision is required.
Pending signup requests
Sign in to review pending signup requests.
Approving or denying a request records your verified sign-in identity.
Approval notifications — Telegram
Protected APIs & MCP Servers
Loading protected APIs & MCP servers…
Every protected MCP server and REST API runs behind a dedicated policy-enforcement point (PEP) in this tenant's namespace. Calls are verified against active delegations, gated by human approval rules, and recorded in the audit log below.
✨ AI Configuration AssistantFreeride Free Router · gpt-4oZero-Config AI
Describe in plain English what API or MCP server you want to protect. In-cluster Freeride AI (http://freeride.freeride.svc.cluster.local:11434) automatically generates the PEP route, least-privilege agent delegation, spend caps, and human-in-the-loop approval guardrails.
1 Select a Guided Preset or Enter Your Requirements
🌍 Weather Geocoding API
Public city search GET API. Agent searches coordinates with URL query params.
Financial API with spend caps. Orders over €100 held for human sign-off.
https://jsonplaceholder.typicode.com
🤖 Customer CRM MCP
Claude MCP server. Read tools automatic; delete_customer held for sign-off.
http://mcpsrv:8091
3 Deploy or Customize
Your architecture plan is ready. You can deploy it to k3s with 1 click, customize it in the wizard, or jump right into testing:
2 AI Architecture Plan & Policy
Select a preset on the left and click ✨ Ask Freeride AI to Generate.
No plan generated yet. Pick a preset on the left and click "Ask Freeride AI to Generate".
### Ready
Select a preset or type your requirement on the left and click "✨ Ask Freeride AI to Generate".
{}
🔑 Get Bearer Token & Test Protected Endpoints Live
Calling a protected endpoint without Authorization: Bearer <TOKEN> returns HTTP 401 {"error":"unauthorized: missing Authorization header"}. Click ⚡ Mint Fresh Bearer Token Now to issue a delegation-bound JWT for your signed-in identity, copy the ready-to-run curl command, or click ▶ Send Test Request to test the endpoint right here in the browser.
Ready-to-Run curl (with Bearer Token & Params)
Includes your live Authorization: Bearer header once minted:
https://…/t/default/mcp-crm
Pre-filled with this tenant's built-in Demo CRM server (http://mcpsrv:8091), or enter your own external https:// API / MCP server URL. Authorized requests are forwarded with X-Auth-User, X-Auth-Agent, and X-Delegation-ID headers.
Protocol discovery actions (initialize, list) are automatically included so Claude & MCP Inspector handshakes succeed without error. Select which tools agents may invoke:
Requests arriving at your governed endpoint are matched against these patterns before forwarding downstream.
Why a Delegation is required: The Gateway denies all requests by default until a human principal grants a scoped Delegation to an Agent ID for this endpoint. This step configures the delegation that will be created automatically alongside your protected service.
Step 1 of 5
Equivalent curl Commands
Live CLI equivalents for everything configured in the wizard:
Audit Trail & Decision Log
Equivalent curl to query the audit log with current filters:
Sign in as tenant operator to view and filter audit events.
Every allowed, held, or denied call across all protected MCP servers and REST APIs is recorded with verified human identity, agent, delegation, tool/action, and policy verdict. Click any row's Inspect button for the full JSON event.