For platform engineering, AI infrastructure, and security teams running MCP tools

Authorize one agent action. Charge it once. Prove what happened.

Your agent invokes a costly tool. The request times out. Was it dispatched? Should the agent retry? Will the retry create another debit?

Agent Middleware API is a gateway between your agents and your paid MCP (Model Context Protocol) tools. The first call executes and is charged once; a retry carrying the same idempotency key cannot dispatch again or debit again. Every completed call returns a signed receipt you can verify offline.

Book a one-tool pilot Verify our receipt yourself — offline

One internal MCP tool · fit and scope discussed privately · no self-serve rollout

00 / Operational problem

Agent intent is not authority—or evidence.

An agent can be correct and still exceed its mandate, retry an expensive call, or leave an operator unable to prove what ran. The gateway sits between the agent and one tool, and it is the only path to that tool.

The result is inspectable before, during, and after execution without asking you to replace your agent framework.

  1. Before Bound the authority

    Tool, wallet, budget, expiry, and operator-defined scope.

  2. During Charge the call once

    The same accepted request key cannot become a second debit.

  3. After Return portable proof

    A signed receipt links the governed call to auditable evidence.

01 / Governed path

One control loop from intent to evidence.

Start with the smallest action where permission, cost, or audit evidence matters.

  1. 01Discover

    The agent reads the manifest: which tools exist and what each call costs.

  2. 02Authenticate

    The caller presents an operator-issued API key. There is no self-serve mint.

  3. 03Authorize

    A scoped permit binds the call to one tool, one wallet, a budget, and an expiry.

  4. 04Invoke

    The gateway is the only path to the tool, so an out-of-scope call is denied here.

  5. 05Meter

    The call is debited from the scoped wallet, once. The same key never debits twice.

  6. 06Receipt

    The terminal outcome is signed with Ed25519 and returned to the caller.

  7. 07Audit

    Wallet events are chained, so a later edit to the record is detectable.

  8. 08Govern

    Operators change scope, budget, and expiry from the control plane, not the agent.

02 / Portable evidence

Inspect the receipt, then verify it offline.

This is self-issued live gateway proof, not customer traction. The published bundle comes from a non-sensitive partner.echo call and is paired with the exact public-key snapshot used by the offline verifier.

Published signed claims loading artifact
receipt
loading…
tool
loading…
charged
loading…
key
loading…

Values are read from the published artifact, not typed into this page.

Offline consistency check offline CLI

Download the portable receipt and matching key snapshot. The SDK verifier checks the Ed25519 signature with no API credential and no callback to the issuer. Authenticate the key snapshot through a trusted channel before treating issuer identity as independently established.

See the proof and run the verifier

03 / Design-partner pilot

Start with one tool, not a platform migration.

Bring one internal MCP tool with a real operator, permission boundary, and retry or audit concern. We qualify fit, define the one action, and walk you through permit → invoke → charge → receipt → replay → deny before discussing any broader rollout.

One tool · one operator · one action. You can run the whole loop locally before the call: clone the repository and run make prove-trust-plane. No credentials, no signup.

Book a one-tool pilot Email 1@christophersellers.com

04 / Machine discovery

Public pointers for agents and operators.

Machine-readable discovery — what an agent fetches before it ever calls a tool. Discovery is public. Protected actions still require an operator-issued API key and an applicable scoped permit.

Agent manifest /.well-known/agent.json Agent instructions /llms.txt MCP discovery /mcp/tools.json Live dependency status /health/dependencies

These four links open raw JSON on the API origin in a new tab.

05 / Honest limitations

What this proof does not establish.

  • Customer traction or production adoption
  • Production settlement or payment rails
  • Compliance-grade ledger storage
  • Exactly-once upstream side effects without upstream support
  • Universal governance across every agent framework

06 / Who is behind this

Built in the open by one accountable operator.

Agent Middleware API is built and run by Christopher Sellers. The gateway, the SDK, and the offline receipt verifier are public source — you can read exactly what the eight steps above do before you talk to anyone.

Source code on GitHub · Quickstart · Security limitations

Bring one tool. Keep the evidence.

A 30-minute call: we scope one governed action on a tool you already run, and you leave with a receipt you can verify without us.

Book a one-tool pilot Verify our receipt yourself — offline