Give each agent its own key. A key is tied to one agent id, so that agent cannot pose as another or touch its runs. Revoke it any time.
Copy this key now. It is shown only once.
Publish a read-only page about one agent's last 30 days, built only from what this Gatesi saw itself (calls made through the vault and decisions on checks), never from what the agent says about itself. Shows no arguments, results or agent id.
The shared AGENT_KEY secret still works for any agent id. Once every agent has its own key, delete the AGENT_KEY secret in Cloudflare.
Store an API credential once. Agents ask Gatesi to make the call (POST /v1/call), so they never see the credential. It is encrypted and cannot be read back, only replaced. You can also add a remote MCP server: its tools then appear (after you review them) in Gatesi's MCP tool list, and every call goes through your rules and approvals.
Use * for the default policy, or an agent id for that agent only. Lists accept wildcards like *delete* and match tool or tool.action. Costs are in USD. rules can look inside the arguments (e.g. amount over 100); first_use: "approve" asks the first time an agent uses a tool. burst_calls / burst_seconds / burst_action: if an agent makes that many calls within that many seconds, ask you (or deny) until it calms down.
See what Gatesi would do, without sending anything: no approval is opened, no Telegram message, nothing is recorded.
Actions you allowed for an hour or for good. Deny rules, budgets and read-only connections still win. Revoke any time.
Bait that no honest agent should touch. If an agent uses a fake tool or a planted fake secret, the request is blocked, the event is recorded, your phone is alerted and, by default, that agent is stopped.
Make a realistic fake key, then leave it where a snooping agent could read it (a .env file, a notes file, a document). Any agent that uses it trips the trap.
Create one from a run (open a run, tap Share replay). Revoke any time.
Agents wait for your answer. Gatesi can send the Telegram message again as a reminder, and refuses the request when the wait time runs out. Reminders are sent while the agent is still waiting.
Loading...
If you do not check in for this many hours, every agent is paused until you do. Tapping a button here or a command in Telegram counts as checking in. Just leaving this page open does not.
Loading...
The receipt format is an open, written spec. Anyone can check a run's receipt and trace on their own computer with a small script that needs no Gatesi and no internet.
The spec · Python checker · JavaScript checker · How to use · Check in a browser
Try Gatesi with no setup, copy a runnable example, or lock an agent down so it cannot skip Gatesi.
Examples and offline test mode · Lockdown kit (Docker)
The Policy tab has a "Try a request" box: see what your rules would do without sending anything.
Adds one short sentence from a small AI model to each approval request ("could delete customer data"). It is advice only: it never allows or blocks anything, and the agent never sees it. It can be wrong, and an agent can word its request to fool it, so trust the rules and the raw request first. Uses Cloudflare's free Workers AI allowance (no card).
Loading...
Loading...
An estimate of the free plan's 100,000 daily writes. Cloudflare's dashboard shows the exact number.
Pick how your agent will talk to Gatesi. You get ready-to-copy code with your address and key filled in.
Checking...
A signed receipt proves this Gatesi recorded a run up to a certain point. Anyone can check it on the verify page; only you can issue one. Needs the secret SIGNING_KEY.
Copy this now and save it as a Worker secret named SIGNING_KEY (type Secret). It is shown only once and is not stored anywhere else. Keep a copy: if you lose it, old receipts still verify but you cannot sign new ones with the same key.
Needs TELEGRAM_BOT_TOKEN, WEBHOOK_SECRET and TELEGRAM_CHAT_ID set as secrets.
Sends a test request using your admin token. No other tool needed.
Base URL:
Agents send their own key (create one on the Keys tab) as a Bearer token. See the README for the Python and JavaScript helpers.
Telegram commands: /stop (all agents), /stop agent-id, /resume, /status.
Add a person and they get their own separate account: their own agents, keys, vault, policy, runs and Telegram chat. They cannot see yours or each other's. You, as the owner, can see everything and switch anyone off. Everyone shares your free database, so each person has a daily limit on recorded events.
Loading...
This is your own separate space. Your agents, keys, vault connections, policy and runs belong to you alone. The owner of this Gatesi runs the service, can see activity on it and can switch accounts off.
Loading...
Approval requests for your agents go to your own Telegram chat, with the Approve and Deny buttons. Link it once:
Lost it, or think someone saw it? Get a new one. The old one stops working at once. Your agent keys are not affected.