Agentgateway is a proxy for agent traffic built around the Model Context Protocol (MCP) and the Agent2Agent (A2A) protocol. It sits between agents and the LLMs, tools, and other agents they talk to, and applies security, observability, and governance policies at that boundary regardless of the agent framework or runtime on either side.
It covers three kinds of traffic. As an LLM gateway it routes requests to providers such as OpenAI, Anthropic, Gemini, and Bedrock through one OpenAI-compatible API, with budget and spend controls, prompt enrichment, load balancing, and failover. As an MCP gateway it connects models to tools and data sources over stdio, HTTP, SSE, and Streamable HTTP transports, federates tools from several servers, wraps OpenAPI services as tools, and handles OAuth. As an A2A gateway it brokers agent-to-agent calls with capability discovery, modality negotiation, and task collaboration.
Deployment is either standalone, driven by flat YAML configuration, or on Kubernetes through a built-in controller with Gateway API support. On Kubernetes it can also route inference to self-hosted models using Inference Gateway extensions, choosing a backend from GPU utilization, KV cache state, LoRA adapters, and queue depth. A built-in UI shows agent-to-tool and agent-to-agent connections. The project is hosted by the Linux Foundation.
Features
- LLM gateway: unified OpenAI-compatible API in front of OpenAI, Anthropic, Gemini, Bedrock, and other providers with spend limits, prompt enrichment, load balancing, and failover
- MCP gateway: tool federation across MCP servers, stdio/HTTP/SSE/Streamable HTTP transports, OpenAPI-to-tool integration, and OAuth authentication
- A2A gateway: agent-to-agent communication with capability discovery, modality negotiation, and task collaboration
- Inference routing: Kubernetes Inference Gateway extensions pick self-hosted model backends by GPU utilization, KV cache, LoRA adapters, and queue depth
- Guardrails: layered content filtering with regex, OpenAI moderation, AWS Bedrock Guardrails, Google Model Armor, and custom webhooks
- Authentication and authorization: JWT, API keys, OAuth, and fine-grained RBAC through a CEL policy engine
- Traffic controls: rate limiting and TLS
- Observability: OpenTelemetry metrics, logs, and tracing
- Two deployment modes: standalone with YAML config, or Kubernetes with a built-in controller and Gateway API
- Built-in UI: a web interface for exploring configured agent, tool, and LLM connections
