Governance
for the run,
not the call.
Rungate is a control plane for AI agent runs — budgets, policies, and approval gates applied to the complete workflow, from first model call to final tool invocation.
Paste it into Claude Code, Cursor, Codex, or any agent. Let it evaluate Rungate for you.
Stop agents from doing things they shouldn't.
Declarative rules enforced in the proxy, not your application code. Allowed models, tool blocklists, rate limits, destructive-action gates. Attached to a run at its start — every call in the workflow is checked against the policy before it goes out.
- —Per-run override via x-rungate-policy header — pin a run to a specific ruleset
- —Policy match context in error responses: which rule fired, why, how to recover
- —Catch recursive loops and unauthorized tool calls before they run up a bill
- —Policy versioning: pin agents to stable rulesets; drift alerts when they try something new
Caps that actually stop the run.
Every step — model call, tool invocation, retry — accrues against the run's budget. When the ceiling looms, Rungate alerts. When it's crossed, the next call is blocked at the workflow boundary. Not advice. Enforcement.
- —HTTP 402 on hard-stop with full budget context — clean, retryable after cap reset
- —Cross-call cost accrues automatically, no agent-side tracking needed
- —Set $X per run, per agent, or per team — one cap for the whole workflow
- —Alert at 80%, block at 100%. No post-hoc surprises from looping agents.
Pause a run. Human approves. Run continues.
When a tool call matches a rule that needs human review, Rungate returns HTTP 202 instead of forwarding the request — the run pauses at the gate. An approver reviews the proposed action. On green, the agent's next retry of the same request succeeds and the run picks up from there. No error-handling gymnastics, no lost context.
- —202 semantic: "paused, retry later" — one branch to handle, not a dozen
- —Approval context in the response body. Seamless resume on the next retry.
- —Approvals via Slack, email, webhook, or dashboard — wherever the approver lives
- —Full audit of who approved, when, and the exact proposed action
Every run, reconstructable.
The trace is the full reconstruction — every model call, every tool, every retry, every approval, every cost. OpenTelemetry-compatible exports plug into the observability stack you already use.
- —OTLP exports to the collector you already run — no new stack
- —Artifacts (files, search results, tool outputs) attached to the run
- —Compliance-ready audit: reconstruct any workflow end-to-end
- —Hand a run ID to legal or the board — they get the whole story, not a log scroll
- Rungate proxies AI agent requests to LLM providers (OpenAI, Anthropic) and enforces governance at the run level — not per-call.
- A run is the complete unit of agent work: first call, every tool invocation, every retry, approval gates, final output.
- Budget enforcement, per-run policies, HTTP 202 approval gates, and full audit trails all apply to the workflow, not to individual requests.
- Point your agent at
https://api.rungate.dev/v1with anrg_agt_*token. Accepts OpenAI and Anthropic request formats unchanged. - Apache 2.0 open source. Self-host or managed cloud.