Every agent. Every tool. Under control.
Your AI agents reach MCP servers holding real credentials — GitHub, databases, your CRM — and today each client holds its own keys, can call any tool it can see, and leaves no central record. GateRelay is the checkpoint in between: one governed endpoint, a scoped key per agent, deny-by-default tool allowlists, and a complete audit log of every call. From $29/month.
Every call checked, then logged.
Each agent connects with its own scoped key. A call is policy-checked, rate-limited and quota-checked before it is forwarded — and every decision lands in the audit log.
| Agent | Tool | Decision | Latency |
|---|---|---|---|
| support-bot | github:list_issues | Allowed | 12 ms |
| support-bot | github:get_issue | Allowed | 18 ms |
| research-agent | github:list_issues | Denied | — |
| support-bot | github:list_issues | Rate limited | — |
Why GateRelay
The MCP adoption guides name the same deployment mistakes again and again: direct server exposure, static keys in every client, tool access far broader than the agent's job, and no log that answers "what did the agent do?"
Deny-by-default allowlists
Each agent sees only the tools its allowlist names — github:list_issues, nothing else. If it isn't listed, it doesn't exist for that agent.
Agents never hold credentials
Upstream auth headers stay server-side and are injected by the gateway on every forwarded call. No API response ever returns them.
Every call, audited
Allowed, denied, rate-limited, quota-blocked, failed — each lands in the workspace audit log with latency, and secret-looking arguments redacted before storage.
Limits that hold
Per-agent rate limits slow a runaway loop; a monthly quota caps the damage. Denied calls never consume quota. Delete one key and that agent is revoked instantly.
Plans from $29/mo
Enterprise MCP gateways charge per seat, meter every request, or start with a sales call. GateRelay is flat-priced and self-serve — and the free tier is real: 1 server, 2 agent keys, 1,000 calls a month.
GateRelay pricing
Straightforward plans — pick the tier that fits and check out securely. Every plan is described in full on the pricing page.
Team
$29/mo
- 50,000 forwarded tool calls/mo
- Deny-by-default per-tool allowlists
- Per-agent rate limits
- Server-side credential injection
- Audit log, 30-day retention + CSV export
Growth
$79/mo
- 250,000 forwarded tool calls/mo
- Everything in Team
- Audit log, 90-day retention
- Per-workspace usage reporting (calls vs. cap)
Scale
$199/mo
- 1,000,000 forwarded tool calls/mo
- Everything in Growth
- Audit log, 1-year retention
- Priority support (email, one business day)
More of what GateRelay does
Features
One checkpoint between your agents and your tools — every mechanism below is in the v1 code, not on a roadmap.
support-bot calls github:list_issues
The agent authenticates with its own key — never the upstream credential — and the gateway runs the same checks, in the same order, on every call. github:list_issues is named in this agent’s allowlist — the call may proceed. Checked against the agent’s per-minute limit and the plan’s monthly quota on forwarded calls. The stored upstream auth header is injected server-side and the call is forwarded. Agent, server, tool, outcome and latency are logged — secret-looking arguments redacted first.
One endpoint for every MCP server
Register your streamable-HTTP MCP servers once. Agents connect to a single GateRelay URL and see the union of tools, namespaced server__tool — swap or remove a server in one place, for every agent at once.
How it works
Per-agent keys, deny-by-default
Mint one key per agent. Keys are stored only as SHA-256 hashes. Allowlist patterns: * , server:* , or server:tool — an empty allowlist means the agent can see and call nothing.
Server-side credential injection
Store each upstream's auth header once; the gateway injects it on forwarded calls. Agents authenticate with their own scoped key and never touch the real credentials.
Rate limits + monthly quotas
A sliding-window rate limit per agent and a plan quota on forwarded calls. Over-limit calls return a clear JSON-RPC error and are audited — they don't silently burn your budget.
What you get
Audit log with redaction
Every decision is logged: timestamp, agent, server, tool, outcome, latency. Arguments are redacted for secret-looking keys ( password , token , api_key , …) before storage. Export as CSV anytime.
Upstream failure isolation
A dead upstream is skipped in tool listings and its calls audit as errors — the gateway and your other servers keep working. Upstream JSON-RPC errors pass through with their original code and message.
How we compare
Competitor prices verified October 2026.
The details
Quickstart
From signup to your first audited tool call in fifteen minutes.
Pick your plan
Choose a tier above and check out securely with Stripe — or start on the free tier (1 server, 2 agent keys, 1,000 calls/mo) by emailing us.
Get your workspace key
We provision your workspace at your plan and email your workspace key ( gr_ws_… ). Only its hash is stored server-side — keep it safe.
Going further
Register an MCP server
curl -X POST localhost:8096/api/v1/servers \ -H 'Content-Type: application/json' -H "X-API-Key: gr_ws_..." \ -d '{"name":"github","url":"https://mcp.example.com/mcp","auth_header":"Bearer UPSTREAM_TOKEN"}' The upstream's auth header is injected server-side from here on — agents never see it.
Create a scoped agent key
curl -X POST localhost:8096/api/v1/agents \ -H 'Content-Type: application/json' -H "X-API-Key: gr_ws_..." \ -d '{"name":"support-bot","allowed_tools":["github:list_issues","github:get_issue"],"rate_limit_per_min":60}' # -> {"agent_id": "agt_...", "agent_key": "gr_agent_...", ...} Deny-by-default: this agent can call exactly two tools. Everything else doesn't exist for it.
Point the agent at GateRelay
{"mcpServers": {"gaterelay": {"url": "https://YOUR_HOST/mcp", "headers": {"Authorization": "Bearer gr_agent_..."}}}} The agent sees namespaced tools ( github__list_issues , …) — only the ones its allowlist permits.
In depth
Read the audit log
curl -H "X-API-Key: gr_ws_..." \ localhost:8096/api/v1/audit?limit=10 Every call is there — allowed, denied, rate-limited — with secret-looking arguments redacted. GET /api/v1/usage shows calls vs. your plan cap.
About GateRelay
GateRelay is a governed MCP gateway for AI agents. The problem it solves is the one every team hits the week agents reach production: each AI client holds its own credentials to each system, agents can call any tool their servers expose, and nobody can produce a record of what an agent did. We're in pre-launch. The gateway — workspace and agent management, allowlist/rate-limit/quota enforcement, upstream proxying with credential injection, and the redacted audit log — is built and tested (34 automated tests, all passing, including deny-by-default, rate-limit, quota, and cross-workspace isolation tests against a live test upstream). We are the
What we won't do
We won't claim to stop all prompt injection, we won't list SSO, OAuth agent identity, or a connector catalog as features (they're roadmap, not v1), and we won't invent customers or call-volume stats.