Govern every agent, not just every request.
An agent turns one instruction into dozens of model calls, tool calls and calls to other agents. Wäg sits in front of all of them, and knows which agent is acting, which person it is acting for, what it may touch, what it may spend and who approved the risky step — and can prove each of those afterwards. Build agents wherever you like. They reach everything through here.
An agent is not a bigger request.
A chat request is one decision you can allow or refuse. An agent is a loop: it reads a document, calls a tool, reads the result, calls another, and keeps going until it decides it is finished. The expensive failures are not bad answers. They are a loop that will not stop, a tool that quietly changed under you, data that left through a call nobody inspected, and a credential that lives in an environment variable forever.
MCP and A2A identify the agent and the account it uses. Neither carries the fact an auditor asks for first: which human authorized this particular step. Wäg records the approver's identity on the call itself, in a hash-chained ledger entry you can verify offline.
Thirteen controls, in the order you meet them
Apache-2.0 except where marked. All of it applies to agents you build anywhere — LangGraph, Bedrock AgentCore, Vertex, Foundry, Claude Code or your own loop — because they all reach models, tools and other agents through the gateway.
Agents are principals
An agent is a first-class identity with a named human owner, a declared runtime, a risk tier and an intended purpose. Every request carries the agent and the person it acts for, into the request log and the evidence ledger.
Runs, and limits that stop them
A run is one agent task. Cap its requests, tool calls, tokens, cost and run time. Past the cap the run's next request is refused and the caller is told which limit it hit — before the invoice arrives, rather than after.
Tool policy: the agent firewall
Ordered rules decide each tool call: allow, deny, classify with a model, or hold for a human. Conditions read the arguments and the caller, so "refunds over 1,000 need approval" is one rule. Dry-run counts what a rule would have done, and Test a call shows which rule decides — in the console or in CI.
Approvals with a name on them
A held call waits for a person, not a flag. Approvers are users or teams, self-approval is refused by default and every request expires. They decide in the console or through a prompt inside their own MCP client, and an email can tell them a request is waiting; deciding in Slack or Microsoft Teams is Enterprise. The decision and the decider are ledgered.
Data-flow control
Tools carry labels: returns private data, returns content outsiders control, can send data out. Once a run has touched the first two, the third is refused or held — the lethal trifecta, closed by construction. It can also match the data itself, through keyed fingerprints of what a sensitive tool returned, never the text.
Tool pinning
Every MCP tool is pinned to the definition an administrator approved: name, description, schemas and annotations, so a tool that stops being read-only counts as changed. When a server changes one, it is quarantined until a human reviews the difference and accepts it. Rug pulls stop being silent.
No standing keys
Agents fetch credentials that last minutes, proving who they are with a registered key pair instead of a shared secret, bound to a single run when you want. DPoP makes a copied token useless; mutual TLS and SPIFFE identities work too, and long-lived keys can be refused outright.
Managed egress
Agents reach third-party APIs through a registered destination, and the gateway adds the credential — so the agent never holds the key, and its own auth headers are stripped on the way through. Each destination fixes which methods and paths it allows, and every call runs through tool policy, approvals, budgets, guardrails, residency and the ledger like any other.
Every outbound connection
Point an agent's HTTPS_PROXY at the gateway and its whole web traffic goes through the control plane, not just its model and tool calls. Host rules decide which sites it may reach, and every connection is treated as a tool call — so policy, approvals and data-flow labels apply, and it counts against the run. The TLS name must match the host it asked for, encrypted client hello is refused, and open tunnels close within seconds when a grant is withdrawn or the agent is stopped. Opening TLS for selected hosts, so request rules and guardrails apply inside, is Enterprise.
Other agents, behind your keys
Register a remote agent by its A2A agent card, and your people and agents call it under /v1/a2a with their usual credentials. The remote agent only ever sees the gateway's credential, and every message gets access checks, budgets, guardrails, run limits, tool policy and evidence like a model call.
Inventory, and a kill switch
Find the agents nobody registered — Wäg recognises them from how their traffic behaves — and the MCP servers your developers run on their own machines, from the tool names their requests carry. Give each a review date and an expiry that is enforced. When something goes wrong, stop one run, one agent or every agent in an organization, on every replica and region at once.
Agents from other platforms Enterprise
Import the agents Microsoft Foundry, AWS Agent Registry, Microsoft Entra Agent ID and Gemini Enterprise already know into the inventory, and keep them in sync. Each gets an owner, a risk tier, run limits and tool policies; its instructions and credentials are never read.
Agent payments Enterprise
Give an agent a spending mandate rather than a card: its own budget per currency, approval above a threshold, and a record of every payment. Rails for x402, AP2 mandates and ACP or UCP checkout, with the gateway either holding the credential or verifying an agent that holds its own.
Proof, not a dashboard screenshot
Governance that cannot be evidenced is a preference. Every decision above lands in the same place: a hash-chained, signed ledger you can export and verify offline against the gateway's own public key.
- Every provider call, every outcome and every configuration change, chained — so a gap or an edit shows.
- Every approval: who asked, what for, who decided, and when it would have expired.
- OpenTelemetry spans for agent runs, ingested from your own framework, so the gateway's view and the agent's view are one trace tree.
- With Enterprise, agent evidence packs: signed packs of an organization's agent runs, approvals, stops and ledger, mapped to the AI Act and DORA.
It runs where you run
One Rust binary in your own infrastructure. No phone-home, air-gap supported, and Apache-2.0 for everything above except the cards marked Enterprise, Slack and Teams approvals, identity-provider and workload tokens, tool policy on pass-through answers, TLS inspection and tool rules for devices. Agents reach models through an OpenAI-compatible endpoint, tools through the MCP gateway and other agents through the A2A gateway — all under the same policy, budgets and evidence.
MCP and tool governance · The whole platform · How this compares to LiteLLM
Put a control plane in front of your agents
Run it in your own infrastructure
Everything you need to run a control plane in production is Apache-2.0 and stays that way — routing, HA, caching, failover, budgets, policy, MCP, jobs and observability. Self-hosted, no account, no phone-home.
$ docker run -p 4000:4000 <registry>/waeg-gateway:<version>Not a working pull: the images are not public yet. Design partners receive the registry details privately.
Deploy in 5 minutesShape it as a design partner
Wäg is not publicly released yet. We are working with a small cohort of teams running multi-provider AI in production, and serious about governance and sovereignty, to harden the control plane on real workloads.
- Every Enterprise capability included, at no licence cost
- Hands-on migration — we do it with you, including from LiteLLM
- A direct line to the engineers building it, and real influence on what ships next