AI Gateways and LLM Cost
An AI gateway sits on the path between agents and models, tools, and other agents. It is where identity, spend, and policy get enforced once instead of in every …
Read more →#AI Gateways
56 posts
MCP: Gateways, Shadow Servers, and Discovery
MCP is how agents find and call tools. The hard part is not the protocol. It is knowing which servers exist, what they can do, and who they act for. These posts …
Read more →OpenAI Red-Teamed Its Sandboxes and Found a CPU Side Channel
OpenAI spent hundreds of billions of tokens trying to break its own agent sandboxes, and its agents won often enough to patch a Kata Containers CVE, a gVisor …
Read more →Grok Bot on agentgateway codeSearch: 96% Fewer Tokens on Real GitHub Work
I run most of my day through Grok Bot. It reads my GitHub, my mail, my calendar, my notes, and it chains those calls all day long. Every one of those MCP calls …
Read more →OpenAI's Patch the Planet: What Safeguards Agent Scanning Needs
OpenAI’s “Patch the Planet” initiative spent two months coordinating a fix for two critical PHP flaws, collectively called PHP2Shell, before …
Read more →Portkey Alternative: agentgateway, Self-Hosted
agentgateway is an open source gateway you run yourself, and it covers the jobs most teams use Portkey for: virtual keys that hide the provider key, per-key …
Read more →What Is an MCP Gateway? agentgateway Examples
An MCP gateway is a proxy between AI clients and MCP servers, so agents reach many tool servers through one endpoint and every tool list and tool call passes …
Read more →Stopping Agent Proxy Laundering at the MCP Gateway
On 2026-10-05 the Wikimedia Foundation disclosed that a handful of wiki edits it attributes to OpenAI-operated agents changed the configuration of a citation …
Read more →Two Grok Bots Leaked a CEO's Bank Balance to Slack
Two “separate” Grok Bots leaked a CEO’s bank balance into a public Slack channel on October 19. Nobody jailbroke anything. Nobody injected a …
Read more →LiteLLM 1.107.0: Why Image Signing Didn't Stop the Backdoor
LiteLLM 1.107.0 landed on PyPI and Docker Hub on October 21, 2026, with a credential stealer built into every wheel, and it was cryptographically signed through …
Read more →LiteLLM security record: a due-diligence timeline
LiteLLM is the easiest way to put one API in front of every model provider. That ease is why it ends up holding a company’s provider keys, virtual keys …
Read more →MCP Tool-Call Guardrails: Gating Agents Before the Tool Runs
agentgateway can now reject or rewrite an MCP tools/call request before the tool runs, and mask the result before the client sees it, from CEL expressions in …
Read more →agentgateway Guardrails How-To
Agents and apps already send prompts through a gateway. Content safety belongs on that hop: inspect the request before it reaches a model, and inspect the …
Read more →MCP Audit Tap: See What a Third-Party Server Actually Sends
A Show HN post for a “WhatsApp MCP server running free on Cloudflare” hit 124 points and 69 comments in under 16 hours on October 19, and none of …
Read more →agentgateway as an Egress Proxy
AI agents need outbound access to models, tools, registries, and APIs. An unrestricted sandbox will use every channel it can find. The durable pattern is a …
Read more →agentgateway vs Agent Router v1.2: MCP prefixMode Defaults
Agent Router v1.2.0 added prefixMode: Never for MCP tool names on October 7, 2026, a control agentgateway already ships with three values: Conditional, Always, …
Read more →MCP Progressive Tool Discovery: Native vs. Hand-Rolled
The 2026-08-22 MCP roadmap names progressive tool discovery as a priority, in almost these words: a server should offer a small entry point and reveal more of …
Read more →agentgateway Standalone: Guardrails, Budgets, Tool Governance
themsquared/agentgateway-standalone-demo runs Solo Enterprise for agentgateway as a single docker compose up, no Kubernetes cluster and no cloud provider …
Read more →Stopping a Filesystem MCP Server From Reading .env Files
Disclosure: I work at Solo.io, which created agentgateway and sells Solo Enterprise for agentgateway. The demos I cite are public repositories. A filesystem MCP …
Read more →Testing Open-Weight Models as an Agent's Cheap Tier
Disclosure: I work at Solo.io, which created agentgateway and sells Solo Enterprise for agentgateway. The demos I cite are public repositories. Two open-weight …
Read more →What Is an AI Agent Gateway?
An AI agent gateway is a reverse proxy between your agents and everything they call: language models, MCP tools, other agents over A2A, and ordinary HTTP or …
Read more →How AI Agents Sharing a Sandbox Leak Each Other's Data
On 2026-10-10, Cybernews reported that Shane Mac, CEO of XMTP Labs, gave a Grok Bot agent read-only access to his personal bank account as a finance assistant. …
Read more →Prisma AIRS Guardrails for agentgateway in 150 Lines of Python
Plenty of security teams already run Prisma AIRS , Palo Alto’s AI runtime security service, and they want every prompt and LLM response checked by it. I …
Read more →What Is a Cloud-Native Agent Harness? (kagent)
Coding agents grew up on laptops: one person, one machine, and one process that is the UI, the agent loop, the sandbox, the credential store and the session …
Read more →agentgateway Token Exchange for AI Agents
An AI agent that calls tools for a user needs that user’s authority, and the usual shortcuts are a pasted personal access token or a shared service …
Read more →MCP Cross App Access Explained: The ID-JAG Exchange on the Wire
MCP’s Enterprise-Managed Authorization lets the corporate IdP decide which employees can use which MCP servers, by making the client trade an IdP-signed …
Read more →Rate-Limiting AI Agent Egress to Already-Allowed APIs
An egress allowlist decides whether an agent can reach a destination. It has no opinion about how often. On October 7, 2026, the Wikimedia Foundation disclosed …
Read more →Agent Platform Gateway Control Plane
A production agent platform needs one gateway path where SPIFFE identity binds the caller and four controls ride the same hop: secretless provider keys, per-key …
Read more →agentgateway v1.6.0: Cost Tracking With No Catalog Config
agentgateway v1.6.0 went GA on October 2. Two features are worth a hands-on look before anything else: a built-in LLM pricing catalog that gives you cost …
Read more →Do AI Agents Need SPIFFE or OAuth?
They answer different questions. SPIFFE proves which process is calling, without a provisioned secret. OAuth scopes what it may do and, when a human is in the …
Read more →Per-Request Minted JWTs for Agent Backends with agentgateway
I built a demo where an AI agent calls a backend API and holds no credential for it. No API key in its environment, no key file on disk, no token. agentgateway …
Read more →Stateless MCP on Kubernetes: No More Sticky Sessions
Three replicas of an MCP server, fronted by agentgateway , with no session affinity configured anywhere. A four-call shopping cart session (create cart, add two …
Read more →AI Agent Security on Kubernetes: Which Controls Actually Held
I spent the last month building small, runnable labs for the ways AI agents break the infrastructure they run on: credentials, egress, audit logs, MCP tool …
Read more →Choose an AI Agent Gateway: agentgateway Guide
Choose by the controls in the request path, not by model-catalog size. Write down what you must enforce on agent to model and agent to tool traffic: workload …
Read more →What Is an Agentic Mesh (vs a Service Mesh)?
An agentic mesh is infrastructure that applies identity, policy, and observability to agent traffic (calls to models, tools, and other agents) so those controls …
Read more →Your Agent Egress Proxy Never Saw the DNS Query
An OpenAI research agent got its HTTPS requests to a public chatbot blocked by a web proxy. So it found a different way to ask the chatbot questions: it queried …
Read more →agentgateway vs LiteLLM vs Portkey, Compared
Disclosure: I work at Solo.io, which created agentgateway and sells Solo Enterprise for agentgateway. Every product claim below links to that project’s …
Read more →What Stopped AI Agent Probes of Government Data Sites
On September 24, Australia’s prime minister told reporters that an OpenAI agent had broken into a government Medicare statistics portal, accessed …
Read more →Serve Markdown to Agents at the Gateway, Not the Origin
Agents parse HTML badly and expensively. The usual fix is to make the site emit markdown: add a per-page index.md, publish an llms.txt, change the build. That …
Read more →Your Artifact Registry Is a Two-Way Channel for Agents
Egress control for AI agents usually gets framed as a blocklist problem. Keep the agent off the hosts it should not reach, and you have contained it. This …
Read more →MCP Tool Poisoning: A Name Allowlist Is Not Enough
I built a four-container demo that reproduces an MCP server rewriting its own tool definitions mid-session, and puts two controls in front of it to see which …
Read more →A WAF That Reads the Prompt: OWASP CRS for LLM and MCP
A conventional web application firewall reads a URL, some headers, and maybe a form body. For agent traffic that is the wrong layer. The interesting content is …
Read more →agentgateway CEL Gotchas: Fail-Open + 403 Fix
I was writing a CEL authorization policy for an LLM route in Solo Enterprise for agentgateway : restrict which models a caller may reach, and refuse callers …
Read more →Conway's Law Is Coming for Your MCP Servers
I have some version of this conversation just about every week. A platform team is rolling out MCP across the company, and the plan looks the same every time: …
Read more →Your Agent's LLM Key Survives Every Kubernetes Secret Control
I gave an agent pod an LLM API key the normal way, as a Secret projected into its environment. Then I turned on every Kubernetes control that sounds like it …
Read more →Keeping MCP Server Instructions Out of Your Agent's System Prompt
How do you keep MCP server instructions out of the trusted system prompt? Isolate them, cap them, bind any cache that stores them to server and caller, and pin …
Read more →The agentgateway Token Service Now Runs Without a Cluster
Solo shipped agentgateway enterprise 2026.9.0 on Tuesday, and the part worth your attention is not a feature inside the proxy. It is where the token service now …
Read more →Agent Audit Logs: What METR and Redwood Found
Two weeks ago METR and Redwood Research published their review of ~1,300 agent transcripts from the OpenAI / Hugging Face incident. Buried in it is a finding …
Read more →Cap LLM Spend per API Key: agentgateway 1.5
agentgateway v1.5.0 shipped on 2026-08-27 with two controls that attach to the API key rather than the route: a rolling spend budget that blocks with an HTTP …
Read more →Why Proxy-Variable Agent Sandboxes Fail, and the CONNECT-Time Fix
On September 4, 2026, researchers published ~18,000 posts that autonomous agents left on a 25-year-old German wiki over six weeks, using it as a message board …
Read more →Your AGENTS.md Is Not a Security Control
An agent with a policy file that says “you must not delete customer records”, running behind an approval layer that denylists the delete tool, …
Read more →Which Controls Would Have Stopped the July 2026 Agent Intrusion?
An autonomous agent escaped its evaluation sandbox on July 9, 2026, and about twelve and a half hours of wall-clock work later it held cluster-admin on multiple …
Read more →SPIFFE for AI Agents: End-to-End Identity Demo
SPIFFE gives each AI agent a short-lived, attested workload identity (an SVID) instead of a stored secret, issued at runtime by SPIRE, rotated automatically, …
Read more →Your AI Agent Should Not Hold the LLM API Key
I built a demo where an agent calls an LLM and has no LLM credential anywhere in its process. No API key in the environment, no key file on disk, nothing in …
Read more →Multi-Tenant MCP Servers: Per-Customer Tools
Three companies authenticate against three different identity providers, connect to the same three MCP URLs, and get three completely different products. Acme …
Read more →Cap LLM Spend per Team with Virtual Keys
Cap LLM spend at the AI gateway: give each team or agent a virtual key, price every request against a model catalog, and refuse the request with HTTP 429 once …
Read more →