# AI Gateways

> Posts on Web of Mike tagged "AI Gateways".

- Canonical URL: https://webofmike.com/tags/ai-gateways/
- Author: Mike Moore (https://webofmike.com/about/)
- Curated index for LLMs: https://webofmike.com/llms.txt
- Full content of every post: https://webofmike.com/llms-full.txt
- Every page is also served as raw markdown at <canonical-url>index.md

## Pages

- [Two agentgateway CEL Gotchas: One Fails Open, One Fails Closed](https://webofmike.com/agentgateway-cel-authorization-gotchas/): Two CEL authorization gotchas in agentgateway: matchExpressions entries are OR'ed, and llm.requestModel is empty at the traffic phase. One fails open. (2026-09-18) - markdown: https://webofmike.com/agentgateway-cel-authorization-gotchas/index.md
- [Conway's Law Is Coming for Your MCP Servers](https://webofmike.com/conways-law-mcp-servers/): Putting every MCP tool behind one federated endpoint rebuilds the ESB and makes agents worse. Why MCP federation should follow business domain boundaries. (2026-09-15) - markdown: https://webofmike.com/conways-law-mcp-servers/index.md
- [Your Agent's LLM Key Survives Every Kubernetes Secret Control](https://webofmike.com/agent-llm-key-kubernetes-controls/): RBAC, restricted Pod Security, and automountServiceAccountToken all on, and one file read still hands over an agent's LLM API key. Tested on a live cluster. (2026-09-13) - markdown: https://webofmike.com/agent-llm-key-kubernetes-controls/index.md
- [MCP Prompt Injection Before the First Tool Call](https://webofmike.com/mcp-discovery-prompt-injection/): The MCP instructions field reaches the model before any tool call, 66% of live servers send it, and a shared cache can serve it to a caller who never connected. (2026-09-11) - markdown: https://webofmike.com/mcp-discovery-prompt-injection/index.md
- [The agentgateway Token Service Now Runs Without a Cluster](https://webofmike.com/agent-token-service-standalone/): agentgateway enterprise 2026.9.0 ships its token service as a standalone binary on a public bucket, so a gateway-mediated agent identity setup fits on a laptop. (2026-09-10) - markdown: https://webofmike.com/agent-token-service-standalone/index.md
- [Your Agent Wrote the Audit Log You Are Judging It By](https://webofmike.com/agent-audit-log-integrity/): METR found spoofed tool calls in 7% of agent transcripts from the Hugging Face incident. A transcript monitor reads them as clean. Diff against a witness. (2026-09-09) - markdown: https://webofmike.com/agent-audit-log-integrity/index.md
- [agentgateway v1.5.0: Per-Key LLM Budgets That Return 429](https://webofmike.com/agentgateway-per-key-llm-budgets/): agentgateway v1.5.0 caps LLM spend per API key and restricts which models a key may call. A local demo that proves the 429, the price math, and the gotchas. (2026-09-07) - markdown: https://webofmike.com/agentgateway-per-key-llm-budgets/index.md
- [Egress Control for AI Agents: Four Bypasses, One Fix](https://webofmike.com/agent-egress-control-bypasses/): Agents in a read-only sandbox wrote 18,000 wiki posts. Four egress bypasses reproduced in Docker Compose, and the CONNECT-time control that stops all four. (2026-09-06) - markdown: https://webofmike.com/agent-egress-control-bypasses/index.md
- [Your AGENTS.md Is Not a Security Control](https://webofmike.com/agents-md-not-a-security-control/): A prompt-injected agent destroyed every record with an AGENTS.md forbidding it and an approval classifier watching. An MCP allowlist at the gateway stopped it. (2026-09-04) - markdown: https://webofmike.com/agents-md-not-a-security-control/index.md
- [Which Controls Would Have Stopped the July 2026 Agent Intrusion?](https://webofmike.com/rogue-agent-kubernetes-controls/): An autonomous agent went from sandbox escape to Kubernetes cluster-admin in under 13 hours. A stage-by-stage map of which controls would have broken the chain. (2026-09-03) - markdown: https://webofmike.com/rogue-agent-kubernetes-controls/index.md
- [SPIFFE Workload Identity for AI Agents, End to End](https://webofmike.com/spiffe-identity-for-ai-agents/): An agentgateway v1.5.0 demo where the agent, the gateway, and the model upstream all authenticate with SPIFFE SVIDs and no certificate file exists anywhere. (2026-09-02) - markdown: https://webofmike.com/spiffe-identity-for-ai-agents/index.md
- [Your AI Agent Should Not Hold the LLM API Key](https://webofmike.com/secretless-ai-agents/): The LiteLLM PyPI compromise stole exactly where LLM API keys live. A working agentgateway demo: agents that call LLMs holding no provider credential at all. (2026-09-01) - markdown: https://webofmike.com/secretless-ai-agents/index.md
- [Multi-Tenant MCP Federation with agentgateway](https://webofmike.com/multi-tenant-mcp-federation/): Six MCP servers federated into three business domains on agentgateway, with per-customer tool entitlements, quotas, and chargeback. No auth code in the servers. (2026-08-28) - markdown: https://webofmike.com/multi-tenant-mcp-federation/index.md
- [Capping LLM Spend at the AI Gateway: Budgets and Virtual Keys](https://webofmike.com/llm-cost-controls-ai-gateway/): Token counts are not costs. I wired a price catalog, virtual keys, and budgets into agentgateway so LLM spend gets attributed, priced, and capped with a 429. (2026-08-27) - markdown: https://webofmike.com/llm-cost-controls-ai-gateway/index.md