IdentArk Gateway

Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "identark-gateway": {
      "command": "npx",
      "args": [
        "-y",
        "identark-gateway"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

identark

The AgentGateway Protocol — secure, scalable AI agent execution infrastructure.

The problem

When an AI agent can execute code, call APIs, or access files, it runs in a process. That process has an environment. That environment typically contains everything that can cause serious damage: LLM API keys, database credentials, AWS tokens.

The naive solution — run your agent on the same backend as your REST API — creates two problems at once:

Security: The agent can access every secret on the machine.
Reliability: A memory-hungry agent degrades your API. Redeploying your API kills all running agents.

identark solves both.

How it works

The SDK implements the AgentGateway Protocol — a clean interface between your agent logic and the outside world. Two implementations ship out of the box:

Gateway	When to use	Credentials	History
`DirectGateway`	Local development, CI evals	Your API key	In-memory
`ControlPlaneGateway`	Production on IdentArk	Zero — none in the agent	Control plane DB

Your agent code is identical in both environments. The switch is two lines.

Quick start

Terminal

pip install identark[openai]

server.ts

import asyncio
from openai import AsyncOpenAI
from identark import DirectGateway, Message, Role

async def main():
    gateway = DirectGateway(
        llm_client=AsyncOpenAI(),   # Your API key — not in the agent loop
        model="gpt-4o",
    )

    response = await gateway.invoke_llm(
        new_messages=[Message(role=Role.USER, content="Hello, IdentArk!")]
    )

    print(response.message.content)
    print(f"Cost: ${response.cost_usd:.6f}")

asyncio.run(main())

Moving to production

Change two lines. Your agent logic is untouched.

server.ts

# Before (local)
from identark import DirectGateway
gateway = DirectGateway(llm_client=AsyncOpenAI(), model="gpt-4o")

# After (production — agent holds zero secrets)
from identark import ControlPlaneGateway
gateway = ControlPlaneGateway()  # auto-detects env vars inside a IdentArk sandbox

Installation

bash

# Core SDK only
pip install identark

# With OpenAI support
pip install identark[openai]

# With Anthropic support
pip install identark[anthropic]

# With Google Gemini support
pip install identark[gemini]

# With Mistral AI support (EU provider)
pip install identark[mistral]

# All cloud providers
pip install identark[all]

Requirements: Python 3.10+

Using TypeScript? The parity SDK ships as the zero-runtime-dependency identark npm package, with the same AgentGateway contract and structured credential sessions.

Data Sovereignty

IdentArk is designed from the ground up to work with any LLM provider, including those that keep your data inside the UK or EU. The AgentGateway Protocol decouples your agent logic from the inference provider — switching providers requires changing one line.

Run fully local with Ollama (zero data egress)

server.ts

from openai import AsyncOpenAI
from identark import DirectGateway

gateway = DirectGateway(
    llm_client=AsyncOpenAI(
        base_url="http://localhost:11434/v1",
        api_key="ollama",
    ),
    model="llama3.2",
    provider="local",   # forces $0 cost tracking; inference stays on your machine
)

Install Ollama: brew install ollama && ollama pull llama3.2 && ollama serve

Use Mistral AI (EU data residency)

server.ts

from openai import AsyncOpenAI
from identark import DirectGateway

gateway = DirectGateway(
    llm_client=AsyncOpenAI(
        base_url="https://api.mistral.ai/v1",
        api_key="your-mistral-api-key",
    ),
    model="mistral-small-latest",   # auto-detected as "mistral" provider
)

Mistral AI is a French company. All inference runs in EU data centres, subject to EU data protection law (GDPR). Use this when UK/EU data governance requirements prohibit sending inference traffic to US-based cloud providers.

See examples/ for complete runnable scripts.

The AgentGateway Protocol

Any class implementing these four async methods is a valid gateway:

server.ts

class AgentGateway(Protocol):
    async def invoke_llm(self, new_messages, tools=None, tool_choice="auto") -> LLMResponse: ...
    async def persist_messages(self, messages) -> None: ...
    async def request_file_url(self, file_path, method="PUT") -> PresignedURL: ...
    async def get_session_cost(self) -> float: ...

Write your agent against the protocol. The implementation — local or production — is a runtime detail.

Features

Zero-secret agents — ControlPlaneGateway holds no API keys, database credentials, or cloud tokens
Stateless by design — conversation history owned by the gateway, not the agent; kill and restart without data loss
Framework-agnostic — works with LangChain, LlamaIndex, raw API calls, or any custom agent framework
Built-in cost tracking — every invoke_llm call returns cost_usd; get_session_cost() returns the running total
OpenAI + Anthropic — both providers supported in DirectGateway out of the box
MockGateway for testing — no LLM calls in your test suite; full call recording for assertions
Full type annotations — py.typed marker; works with mypy strict mode

Testing your agents

server.ts

from identark.testing import MockGateway
from identark.models import LLMResponse, Message, Role

async def test_my_agent():
    mock = MockGateway()
    mock.queue_response(LLMResponse(
        message=Message(role=Role.ASSISTANT, content="The answer is 42."),
        cost_usd=0.001,
        model="mock",
        finish_reason="stop",
    ))

    result = await my_agent(gateway=mock)

    assert mock.invoke_llm_call_count == 1
    assert mock.total_messages_sent == 1

Supported providers

Provider	Data residency	DirectGateway	GeminiGateway	ControlPlaneGateway
OpenAI (gpt-4o, gpt-4o-mini, …)	US	✓	—	✓
Anthropic (Claude models)	US	✓	—	✓
Google Gemini	Varies	✓*	✓	Roadmap
Mistral AI	Varies	✓	—	✓
Kimi / Moonshot	Varies	✓*	—	✓
Azure OpenAI	Configured Azure region	✓*	—	✓
AWS Bedrock	Configured AWS region	—	—	✓
OpenRouter	Provider-dependent	✓*	—	✓
Ollama	Local 🏠	✓	—	Not a hosted route
Any OpenAI-compatible endpoint	Varies	✓	—	✓ (custom endpoint)

*Via an OpenAI-compatible client/base URL. Use GeminiGateway for native Gemini SDK features.

Error handling

server.ts

from identark.exceptions import CostCapExceededError, RateLimitError, IdentArkError

try:
    response = await gateway.invoke_llm(new_messages=[...])
except CostCapExceededError as e:
    print(f"Cost cap of ${e.cap_usd} reached. Spent: ${e.consumed_usd}")
except RateLimitError as e:
    await asyncio.sleep(e.retry_after_seconds)
except IdentArkError as e:
    # Catch-all for any SDK error
    raise

Full exception hierarchy: IdentArkError > GatewayError > ControlPlaneError > AuthenticationError | CostCapExceededError | SessionNotFoundError

Architecture

Code

┌─────────────────────────────────────┐
│            Your Agent Code          │
│   (depends only on AgentGateway)    │
└──────────────┬──────────────────────┘
               │
    ┌──────────▼──────────┐
    │    AgentGateway      │  ← Protocol (interface)
    │      Protocol        │
    └──────┬────────┬──────┘
           │        │
  ┌────────▼─┐  ┌───▼──────────────┐
  │  Direct  │  │  ControlPlane    │
  │ Gateway  │  │    Gateway       │
  │          │  │                  │
  │ Local /  │  │   Production     │
  │  Evals   │  │  (zero secrets)  │
  └──────────┘  └────────┬─────────┘
                         │ HTTP
                ┌────────▼─────────┐
                │  IdentArk        │
                │  Control Plane   │
                │  (holds creds)   │
                └──────────────────┘

Community

Discussions: GitHub Discussions — ask questions, share ideas
Issues: GitHub Issues — bug reports and feature requests
Live Demo: identark.io/demo — try IdentArk in your browser

Contributing

Contributions are welcome. Please open an issue before submitting significant changes.

bash

git clone https://github.com/identark/identark.git
cd identark
pip install -e ".[dev]"
pre-commit install
pytest tests/unit/

See CONTRIBUTING.md for full guidelines.

Roadmap

LangChain adapter (IdentArkChatModel)
LlamaIndex adapter (IdentArkLLM)
Streaming support (invoke_llm_stream)
CrewAI integration
LangGraph integration (IdentArkNode, IdentArkStreamNode)
Pluggable inference backends (distributed compute)
identark-cli for one-command control plane deployment

License

The IdentArk SDK is licensed under the MIT License — free for any use, including commercial and closed-source projects. See LICENSE.

The IdentArk control plane (hosted service) is proprietary. The SDK works with any AgentGateway backend, including fully self-hosted ones.

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about IdentArk Gateway

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "identark-gateway": { "command": "npx", "args": ["-y", "IdentArk Gateway"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

IdentArk Gateway AllMCPs Directory Badge

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/identark-gateway?style=directory)](https://allmcps.com/mcp/identark-gateway)

HTML Embed

<a href="https://allmcps.com/mcp/identark-gateway"><img src="https://allmcps.com/api/badge/identark-gateway?style=directory" alt="IdentArk Gateway on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to IdentArk Gateway →Install in Claude Desktop Install in Cursor Install in VS Code

IdentArk Gateway

Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "identark-gateway": {
      "command": "npx",
      "args": [
        "-y",
        "identark-gateway"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

identark

The AgentGateway Protocol — secure, scalable AI agent execution infrastructure.

The problem

The naive solution — run your agent on the same backend as your REST API — creates two problems at once:

Security: The agent can access every secret on the machine.
Reliability: A memory-hungry agent degrades your API. Redeploying your API kills all running agents.

identark solves both.

How it works

The SDK implements the AgentGateway Protocol — a clean interface between your agent logic and the outside world. Two implementations ship out of the box:

Gateway	When to use	Credentials	History
`DirectGateway`	Local development, CI evals	Your API key	In-memory
`ControlPlaneGateway`	Production on IdentArk	Zero — none in the agent	Control plane DB

Your agent code is identical in both environments. The switch is two lines.

Quick start

Terminal

pip install identark[openai]

server.ts

import asyncio
from openai import AsyncOpenAI
from identark import DirectGateway, Message, Role

async def main():
    gateway = DirectGateway(
        llm_client=AsyncOpenAI(),   # Your API key — not in the agent loop
        model="gpt-4o",
    )

    response = await gateway.invoke_llm(
        new_messages=[Message(role=Role.USER, content="Hello, IdentArk!")]
    )

    print(response.message.content)
    print(f"Cost: ${response.cost_usd:.6f}")

asyncio.run(main())

Moving to production

Change two lines. Your agent logic is untouched.

server.ts

# Before (local)
from identark import DirectGateway
gateway = DirectGateway(llm_client=AsyncOpenAI(), model="gpt-4o")

# After (production — agent holds zero secrets)
from identark import ControlPlaneGateway
gateway = ControlPlaneGateway()  # auto-detects env vars inside a IdentArk sandbox

Installation

bash

# Core SDK only
pip install identark

# With OpenAI support
pip install identark[openai]

# With Anthropic support
pip install identark[anthropic]

# With Google Gemini support
pip install identark[gemini]

# With Mistral AI support (EU provider)
pip install identark[mistral]

# All cloud providers
pip install identark[all]

Requirements: Python 3.10+

Using TypeScript? The parity SDK ships as the zero-runtime-dependency identark npm package, with the same AgentGateway contract and structured credential sessions.

Data Sovereignty

Run fully local with Ollama (zero data egress)

server.ts

from openai import AsyncOpenAI
from identark import DirectGateway

gateway = DirectGateway(
    llm_client=AsyncOpenAI(
        base_url="http://localhost:11434/v1",
        api_key="ollama",
    ),
    model="llama3.2",
    provider="local",   # forces $0 cost tracking; inference stays on your machine
)

Install Ollama: brew install ollama && ollama pull llama3.2 && ollama serve

Use Mistral AI (EU data residency)

server.ts

from openai import AsyncOpenAI
from identark import DirectGateway

gateway = DirectGateway(
    llm_client=AsyncOpenAI(
        base_url="https://api.mistral.ai/v1",
        api_key="your-mistral-api-key",
    ),
    model="mistral-small-latest",   # auto-detected as "mistral" provider
)

See examples/ for complete runnable scripts.

The AgentGateway Protocol

Any class implementing these four async methods is a valid gateway:

server.ts

class AgentGateway(Protocol):
    async def invoke_llm(self, new_messages, tools=None, tool_choice="auto") -> LLMResponse: ...
    async def persist_messages(self, messages) -> None: ...
    async def request_file_url(self, file_path, method="PUT") -> PresignedURL: ...
    async def get_session_cost(self) -> float: ...

Write your agent against the protocol. The implementation — local or production — is a runtime detail.

Features

Zero-secret agents — ControlPlaneGateway holds no API keys, database credentials, or cloud tokens
Stateless by design — conversation history owned by the gateway, not the agent; kill and restart without data loss
Framework-agnostic — works with LangChain, LlamaIndex, raw API calls, or any custom agent framework
Built-in cost tracking — every invoke_llm call returns cost_usd; get_session_cost() returns the running total
OpenAI + Anthropic — both providers supported in DirectGateway out of the box
MockGateway for testing — no LLM calls in your test suite; full call recording for assertions
Full type annotations — py.typed marker; works with mypy strict mode

Testing your agents

server.ts

from identark.testing import MockGateway
from identark.models import LLMResponse, Message, Role

async def test_my_agent():
    mock = MockGateway()
    mock.queue_response(LLMResponse(
        message=Message(role=Role.ASSISTANT, content="The answer is 42."),
        cost_usd=0.001,
        model="mock",
        finish_reason="stop",
    ))

    result = await my_agent(gateway=mock)

    assert mock.invoke_llm_call_count == 1
    assert mock.total_messages_sent == 1

Supported providers

Provider	Data residency	DirectGateway	GeminiGateway	ControlPlaneGateway
OpenAI (gpt-4o, gpt-4o-mini, …)	US	✓	—	✓
Anthropic (Claude models)	US	✓	—	✓
Google Gemini	Varies	✓*	✓	Roadmap
Mistral AI	Varies	✓	—	✓
Kimi / Moonshot	Varies	✓*	—	✓
Azure OpenAI	Configured Azure region	✓*	—	✓
AWS Bedrock	Configured AWS region	—	—	✓
OpenRouter	Provider-dependent	✓*	—	✓
Ollama	Local 🏠	✓	—	Not a hosted route
Any OpenAI-compatible endpoint	Varies	✓	—	✓ (custom endpoint)

*Via an OpenAI-compatible client/base URL. Use GeminiGateway for native Gemini SDK features.

Error handling

server.ts

from identark.exceptions import CostCapExceededError, RateLimitError, IdentArkError

try:
    response = await gateway.invoke_llm(new_messages=[...])
except CostCapExceededError as e:
    print(f"Cost cap of ${e.cap_usd} reached. Spent: ${e.consumed_usd}")
except RateLimitError as e:
    await asyncio.sleep(e.retry_after_seconds)
except IdentArkError as e:
    # Catch-all for any SDK error
    raise

Full exception hierarchy: IdentArkError > GatewayError > ControlPlaneError > AuthenticationError | CostCapExceededError | SessionNotFoundError

Architecture

Code

┌─────────────────────────────────────┐
│            Your Agent Code          │
│   (depends only on AgentGateway)    │
└──────────────┬──────────────────────┘
               │
    ┌──────────▼──────────┐
    │    AgentGateway      │  ← Protocol (interface)
    │      Protocol        │
    └──────┬────────┬──────┘
           │        │
  ┌────────▼─┐  ┌───▼──────────────┐
  │  Direct  │  │  ControlPlane    │
  │ Gateway  │  │    Gateway       │
  │          │  │                  │
  │ Local /  │  │   Production     │
  │  Evals   │  │  (zero secrets)  │
  └──────────┘  └────────┬─────────┘
                         │ HTTP
                ┌────────▼─────────┐
                │  IdentArk        │
                │  Control Plane   │
                │  (holds creds)   │
                └──────────────────┘

Community

Discussions: GitHub Discussions — ask questions, share ideas
Issues: GitHub Issues — bug reports and feature requests
Live Demo: identark.io/demo — try IdentArk in your browser

Contributing

Contributions are welcome. Please open an issue before submitting significant changes.

bash

git clone https://github.com/identark/identark.git
cd identark
pip install -e ".[dev]"
pre-commit install
pytest tests/unit/

See CONTRIBUTING.md for full guidelines.

Roadmap

LangChain adapter (IdentArkChatModel)
LlamaIndex adapter (IdentArkLLM)
Streaming support (invoke_llm_stream)
CrewAI integration
LangGraph integration (IdentArkNode, IdentArkStreamNode)
Pluggable inference backends (distributed compute)
identark-cli for one-command control plane deployment

License

The IdentArk SDK is licensed under the MIT License — free for any use, including commercial and closed-source projects. See LICENSE.

The IdentArk control plane (hosted service) is proprietary. The SDK works with any AgentGateway backend, including fully self-hosted ones.

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about IdentArk Gateway

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "identark-gateway": { "command": "npx", "args": ["-y", "IdentArk Gateway"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/identark-gateway?style=directory)](https://allmcps.com/mcp/identark-gateway)

HTML Embed

<a href="https://allmcps.com/mcp/identark-gateway"><img src="https://allmcps.com/api/badge/identark-gateway?style=directory" alt="IdentArk Gateway on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to IdentArk Gateway →Install in Claude Desktop Install in Cursor Install in VS Code