Choose a tier above and check out securely with Stripe — or start on the free tier (1 server, 2 agent keys, 1,000 calls/mo) by emailing us.

We provision your workspace at your plan and email your workspace key (gr_ws_…). Only its hash is stored server-side — keep it safe.

curl -X POST localhost:8096/api/v1/servers \
  -H 'Content-Type: application/json' -H "X-API-Key: gr_ws_..." \
  -d '{"name":"github","url":"https://mcp.example.com/mcp","auth_header":"Bearer UPSTREAM_TOKEN"}'

The upstream's auth header is injected server-side from here on — agents never see it.

curl -X POST localhost:8096/api/v1/agents \
  -H 'Content-Type: application/json' -H "X-API-Key: gr_ws_..." \
  -d '{"name":"support-bot","allowed_tools":["github:list_issues","github:get_issue"],"rate_limit_per_min":60}'
# -> {"agent_id": "agt_...", "agent_key": "gr_agent_...", ...}

Deny-by-default: this agent can call exactly two tools. Everything else doesn't exist for it.

{"mcpServers": {"gaterelay": {"url": "https://YOUR_HOST/mcp",
  "headers": {"Authorization": "Bearer gr_agent_..."}}}}

The agent sees namespaced tools (github__list_issues, …) — only the ones its allowlist permits.

curl -H "X-API-Key: gr_ws_..." \
  localhost:8096/api/v1/audit?limit=10

Every call is there — allowed, denied, rate-limited — with secret-looking arguments redacted. GET /api/v1/usage shows calls vs. your plan cap.