Odile Gate

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Give AI agents scoped, expiring API access: exact approvals, retry-safe writes, an audit log.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Odile Gate": {
      "url": "https://gate.odilelabs.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (21)

• gate_openshell_setup read-only

  Read-only local setup plan for native OpenShell + Gate: one command, exact installer hash, recipe schema, prerequisites, authority boundaries and cleanup. Default creates an isolated Free read-only demo with no model or payment. A trusted local controller may configure an owner-authorized API with explicit routes/scope and private credential files. This tool does not run commands, create resources or accept credentials.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• gate_create_project

  Create a Free project in front of an existing HTTPS API. No signup or payment required. For a credential-free demo use https://sandbox.gate.odilelabs.com with GET /customers/:cid/tickets/:id. Returns project_id, admin_key (shown once) and the gateway base URL apps call instead of the API. A real API and its credentials need owner authorization.

  Parameters:

  • name (required) — string — A name for the project, e.g. "Shop API"
  • upstream (required) — string — The API base URL, https only, e.g. https://api.example.com/v1
  • header_name — string — Optional: the secret header your API expects, e.g. Authorization or apikey
  • header_value — string — Optional: its value. Stored encrypted; apps never see it.

  Hints: read-only no · destructive no · idempotent no · open-world yes

• gate_add_app

  Give one app its own key and the calls it may make. Routes are rules like "GET /orders/:id", "POST /orders", "GET /users/{user}/orders" (per-user), or example calls like "GET /orders/42", which become rules allowing any id. Returns key (shown once), app.id and normalized rules. Send key as Authorization: Bearer <key> to the project gateway; never send the admin key to the workload.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • name (required) — string — The app name, e.g. "storefront" or "nightly sync"
  • routes (required) — array — Only the calls this app makes, one "METHOD /path" per item
  • per_minute — integer — Calls per minute for this app (default 60)

  Hints: read-only no · destructive no · idempotent no · open-world yes

• gate_list_apps read-only

  The project's apps with their allowed calls, limits, state and anomaly-guard settings.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_check_setup read-only

  Read actual Gate protection settings before giving an integration production access. Reports observe-only mode, writes without mandatory runs, missing user-token configuration, wildcard grants and approval separation, with evidence, exact remedies and explicit limits. Sends no upstream requests, changes no settings and uses no gateway quota. Configuration-only: not a security certificate or runtime enforcement test.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • app — string — Optional: check one active app id (app_...) instead of all active apps

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• gate_metrics read-only

  Read last-24-hour stored call counts by HTTP status and reason, measured duration through response headers (including upstream wait), per-app anomaly scores and 24-hour anomaly counts, and separate current-month gateway usage: plan, used, allowed, plus upgrade URL and checkout path on Free at 80% or above. Only POST the checkout path when the admin asks to upgrade; reading metrics never starts checkout. Project admin only. Audit may be partial: invalid-key sampling and audit-off periods are disclosed. No upstream requests, quota use or policy changes; not a health certificate or performance guarantee.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• gate_audit read-only

  The most recent calls through the gateway (time, app, matched route, status, reason, duration), newest first, with totals by status and refusal reason. Gate never stores bodies, query values or headers.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • app — string — Optional: only this app id (app_...)
  • limit — integer — How many calls (default 20)
  • status — string — Optional: only this HTTP status, e.g. "403"

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_create_run

  Gate Actions: give one agent session narrow, expiring permission. Actions are rules with {placeholders} bound by scope (e.g. "PATCH /customers/{customer}/tickets/:id" with scope {"customer":"A"}), each with an optional max and approval. Returns a run token (shown once) the agent sends as x-odile-run with its app key. Writes in a run need an Idempotency-Key. Give a write a check ("GET /bookings?idempotency_key={key}") and the agent can settle a lost answer with POST /g/<id>/_gate/recover.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • app (required) — string — The app id (app_...) this run is for
  • actions (required) — array — Rules, or {rule, max, approval, check}
  • label — string — Optional: what the run is for, e.g. "triage ticket 4411"
  • scope — object — Values for the {placeholders}, e.g. {"customer":"A"}
  • max_calls — integer — Optional: calls allowed in the whole run
  • ttl_seconds — integer — How long the run lasts (default 3600)

  Hints: read-only no · destructive no · idempotent no · open-world yes

• gate_set_app_runs

  Make an app need a run: "writes" (every write needs x-odile-run), "all" (every call), or "off".

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • app (required) — string — The app id (app_...)
  • mode (required) — string

  Hints: read-only no · destructive no · idempotent yes · open-world yes

• gate_set_response

  Opt-in JSON response redaction: return only explicit JSON Pointer paths, e.g. /id and /items/*/name. * matches one segment; selecting a container allows its whole subtree. Applies to every upstream response for this app, including errors. Maximum 1 MiB and 5 seconds to read; invalid/non-JSON responses are withheld. No bodies are stored. A withheld reply never reverses an upstream write. null disables filtering. Free and Pro.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • app (required) — string — The app id (app_...)
  • allow (required)

  Hints: read-only no · destructive no · idempotent yes · open-world no

• gate_add_approver

  Create an approver key for the person who approves held actions (shown once). Give it to that person, never to an agent: once a project has an approver, the admin key can no longer approve.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • name (required) — string — Who approves, e.g. "Dana (support lead)"

  Hints: read-only no · destructive no · idempotent no · open-world yes

• gate_list_actions read-only

  Actions waiting for approval (or in another state), with the exact call. With an installed approval-risk model, pending actions sort by risk descending and include risk (0–1) and risk_features (top two advisory signals). No model means no score and newest first. Only a person decides in the dashboard.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • state — string — Default: pending

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_explain_refusal read-only

  What a Gate refusal means and how to fix it, from the x-gate-refused header value (e.g. route_not_allowed).

  Parameters:

  • reason (required) — string — The x-gate-refused value
  • recoverable — boolean — Whether the write was granted with a recovery check

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• gate_delegate_run

  Hand a narrower run to another active app in the same project. Uses the parent app key and run token, never the admin key. Scope, expiry, approvals and ancestor budgets stay enforced; maximum depth five.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • app_key (required) — string — The parent app key (gk_...)
  • run_token (required) — string — The parent run token (gr_...)
  • app (required) — string — The destination app id
  • actions (required) — array
  • label — string — A short label for the delegated job
  • max_calls — integer
  • ttl_seconds — integer

  Hints: read-only no · destructive no · idempotent no · open-world yes

• gate_learn_suggestions read-only

  Read normalized routes and a suggested per-minute limit from an admin-enabled, time-boxed learning session. Records only method, normalized path templates and counts per minute; no query values, raw ids, headers or bodies. Never enables learning or applies rules.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • app (required) — string — The app id

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_audit_proof read-only

  Read chained audit rows, decided-action feature snapshots and anchors with an HMAC-SHA256 signature. No sealed paths/bodies, notes, keys or IPs in the action labels. Legacy actions lack snapshots and are excluded. store_audit=false has no chain. Follow next_from for audit rows and next_actions_after as actions_after for labels (10,000 each). Use API/SDK above the MCP response size limit.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • to — integer
  • from — integer
  • actions_after — string — Action cursor from next_actions_after

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_audit_verify read-only

  Recompute a pasted export chain and project signature; returns intact or broken_at (one-based row position). Does not approve actions or change permissions.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • proof (required) — object — The full signed export from gate_audit_proof

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_run_tree read-only

  Read a run and its delegated descendants without tokens.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • run_id (required) — string — The run id

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_run_timeline read-only

  Read call metadata, approvals and approver names, recovery outcomes and delegated children; no bodies or query values.

  Parameters:

  • project_id (required) — string — The project id from gate_create_project, e.g. p1a2b3...
  • admin_key (required) — string — The project admin key (ga_...). Read it from the .env; never print it.
  • run_id (required) — string — The run id
  • before — integer — Older audit events (timeline pages have at most 500 events)

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• gate_validate_config read-only

  Parse and check a declarative Gate config (apps, routes, rate limits, run mode, plugins including anomaly-guard, alerts, approvers) without changing anything. anomaly-guard settings: mode off|alert|strict, z_threshold 2–10, min_minutes 1–30, half_life 5–1440. Returns errors with their path, warnings, and the normalized config.

  Parameters:

  • config (required) — string — The whole odile.yaml (or the same as JSON) as text

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• gate_sync_declarative

  Make a Gate project match an odile.yaml: creates the project (if no project_id) and missing apps and approvers, applies run mode, loop, learning and anomaly-guard settings and alerts. Example plugin: {name: anomaly-guard, settings: {mode: alert, z_threshold: 4, min_minutes: 3, half_life: 60}}. Never revokes or deletes; differences it cannot apply (an app's routes or rate limit) come back as drift. dry_run lists the steps without changing anything. New keys are shown once.

  Parameters:

  • config (required) — string — The whole odile.yaml (or the same as JSON) as text
  • dry_run — boolean — List the steps without changing anything
  • admin_key — string — Its admin key (ga_...), required with project_id. Read it from the .env; never print it.
  • project_id — string — Optional: an existing project to sync

  Hints: read-only no · destructive no · idempotent yes · open-world yes

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.