agentgateway

Your personal MCP

Give any agentall of your context.Any API.Your rules.

One MCP server, yours, that gives claude.ai, ChatGPT, OpenCode, Claude Code and your own agents the whole of your GitHub and Google, not a handful of tools. Agents never hold a secret. Every call is checked. When it isn't clear, your phone asks what the session is for.

Works with claude.ai ChatGPT OpenCode Claude Code your own agents
agent gatewaybot · Telegram

⚠️ OpenCode wants to call GitHub (priya-ships)

POST /repos/priya-ships/demo-repo/issues/3/comments

{"body": "Looks like a duplicate of #1. Closing in favour of that thread."}

Why I'm asking: You haven't said what this session is for yet, so I'm checking before it can create an issue comment.

expires in 30 min

🎯 What's this session for? OpenCode says: “triaging demo-repo issues”

💬 Reply with what this session is for, and I'll re-check this against it.

More than an MCP server

Every API you can use. Every rule you set.

Vendor MCP servers hand agents a short, curated list of tools. The gateway gives them the full API you already have, as typed tools, under rules you write.

A vendor's MCP server

~12hand-picked tools

  • Their scopes, their limits
  • A separate OAuth grant in every app
  • Revoking means visiting each app

agent gateway

306GitHub REST operations as typed tools, plus Gmail, Drive and Docs

  • Your policy on every call: allow judge ask deny
  • Connect each account once, use it from every agent
  • One audit trail, one place to revoke
gate · example decisions
claude.aiGET/repos/priya-ships/demo-repo/issues?state=openallowjudge: a read that fits “triage demo-repo”
OpenCodePOST/repos/priya-ships/demo-repo/issues/3/commentsaskjudge: no session intent yet → asked you
OpenCodePOST/repos/priya-ships/demo-repo/issues/4/labelsallowjudge: fits “triage demo-repo; labels and comments are fine”
OpenCodePUT/repos/priya-ships/demo-repo/collaborators/demo-intruder-x9q4denyrule: collaborators are never changed

How it works

Connect once. Point any agent at it. Stay in charge.

  1. Connect your accounts

    Sign in with GitHub or Google. The gateway holds the credentials, encrypted, and refreshes them itself.

  2. Point an agent at it

    Add it as an MCP server or swap a base URL. The first time an app uses an account, your phone asks.

  3. Every call is checked

    Your rules first. A fast classifier on everything you haven't explicitly allowed. Your phone for the rest.

  4. Tell it what the session is for

    Reply to a card in plain words. That becomes the session's intent, and held calls are re-checked against it.

Recording · defining policy in conversation
OpenCodeagent · session ses_7Kq2
→ github · issues_create_comment
POST /repos/priya-ships/demo-repo/issues/3/comments
held waiting for you · no session intent yet
released comment posted · 201
→ github · repos_add_collaborator
PUT /repos/priya-ships/demo-repo/collaborators/demo-intruder-x9q4
denied out of bounds (rule + classifier)
Your phoneTelegram · agent gateway

⚠️ OpenCode wants to call GitHub (priya-ships)

POST /repos/priya-ships/demo-repo/issues/3/comments

Why I'm asking: You haven't said what this session is for yet, so I'm checking before it can create an issue comment.

🎯 What's this session for? OpenCode says: “triaging demo-repo issues”

💬 Reply with what this session is for, and I'll re-check this against it.

✅ Approved by the classifier, after you described the session

OpenCode → GitHub (priya-ships): POST /repos/priya-ships/demo-repo/issues/3/comments

↩ OpenCode wants to call GitHubTriaging the open issues on demo-repo.

Got it: this session is triaging demo-repo's open issues.

✅ I've approved the comment on #3.

From here on, labels and comments on demo-repo go through without asking. Anything outside triage, like settings or adding people, still comes to you.

Four answers, one order

Deny beats ask beats judge beats allow.

Whatever order you wrote your rules in. The classifier decides only inside the limit a rule sets.

deny01

Never, by rule.Collaborators, keys, settings. The classifier can raise one of these to you; it can never let it through.

ask02

Always ask me.The card shows the classifier's opinion; you decide.

judge03

The default.The classifier checks the call against your policy and the session's intent: allow, ask you, or deny.

allow04

Explicitly fine.Only what you've chosen to always allow. Nothing is allowed by default, reads included.

Why you can trust it

Built so you don't have to take our word for it.

  • 01 / RUNS WHERE YOU SEE IT

    A Worker you deploy

    A Cloudflare Worker on your account. This page is served by the same Worker that holds your connections.

  • 02 / NO SECRETS IN AGENTS

    Grants, not keys

    Upstream tokens are encrypted at rest and added to calls at the last moment. Agents get revocable grants.

  • 03 / DENY IS FINAL

    Rules the classifier can't override

    The classifier can escalate a denied call to you. It can never allow it.

  • 04 / NO REPLAYS

    Single-use approvals

    Each approval is bound to the exact request. Change one byte of the body and it asks again.

  • 05 / ON THE RECORD

    Every decision logged

    Who asked, what for, which rule fired, and the classifier's exact input, stored for every call.

  • 06 / DATA, NOT ORDERS

    Injection-resistant

    Instructions come only from you. Text an agent sends, like an injected issue, is never treated as instructions.

What it doesn't do: it protects your credentials and the actions taken with them. It can't un-read data you've allowed an agent to read, and for apps you don't host it can't see your conversation with the agent, only what you tell the gateway.

Connect an agent

One URL. Sign in once.

Each app signs in through the gateway's own consent screen. Nothing is shared until it first uses an account, and then you're asked.

claude.ai

Settings → Connectors → Add custom connector:

https://personalmcp.dev/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings → turn on Developer mode. Then Create a connector with this MCP server URL and OAuth authentication:

https://personalmcp.dev/mcp

OpenCode

In opencode.json, then opencode mcp auth gateway:

{"mcp": {"gateway": {
  "type": "remote",
  "url": "https://personalmcp.dev/mcp"
}}}

Claude Code

Add it, then run /mcp to sign in:

claude mcp add --transport http gateway https://personalmcp.dev/mcp

Give your agents the keys.
Keep the locks.