Let AI agents act — with an identity, an allow list and a person for what matters

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

AgentGate puts every AI agent behind its own identity and every MCP tool call behind a check: is this agent allowed this tool, do the arguments carry sensitive data, does a person need to approve it? Server credentials stay with AgentGate, and every call is recorded.

2The challenge

AI agents now act — they read customer records, send e-mails, issue refunds and change systems through MCP servers. Each agent usually holds a server token that can do everything, nobody can say which agent called what, and a single prompt injection can turn a helpful agent into one that closes accounts or mails out customer data.

The TotalHeal approach. AgentGate sits between your AI agents and your MCP servers. Each agent gets its own identity and token and sees only the tools it is allowed; the servers’ own credentials stay with AgentGate. Every tool call is checked against the agent’s allow list — and, on the Professional tier, for sensitive data and for tools that need a person’s approval — then forwarded and recorded.

3Architecture

4How it works

1. RegisterAdd your MCP servers; AgentGate reads their tools and keeps their credentials.
2. IdentifyGive each agent its own token, an owner and the tools it may use.
3. CheckEach call is checked against the allow list and, on Professional, for sensitive data and approval.
4. ApproveA person approves or rejects high-impact calls; the approved call goes through once.
5. RecordEvery call is recorded; unusual behaviour raises an alert and the kill switch stops agents at once.

5Capabilities in detail

• Registry of MCP serversRegister each server’s endpoint once; AgentGate reads its tools and how each declares itself (read only, or changes and deletes data). Turn any tool off for everyone, and pause a whole server.
• Credentials agents never holdThe server’s token is kept encrypted by AgentGate and added to each forwarded request. Agents authenticate to AgentGate with their own token; revoking it cuts the agent off without touching the server.
• An identity per agentEvery agent has a name, an accountable owner, a token shown once (only its fingerprint is kept) and an allow list of servers and tools. When an agent lists tools it sees only the ones it may call.
• Arguments checked for sensitive dataBefore a call is forwarded its arguments are inspected with the DataShield detectors — Aadhaar, PAN, bank accounts and IFSC, card numbers, cloud keys and passwords — and stopped at the threshold you set per server, with a message the agent can act on.
• A person approves what mattersTools that change or delete data can require approval. The call waits; a person approves or rejects it in the console with a note, and that exact call — same tool, same arguments — goes through once within 15 minutes. An AI agent can never approve.
• Rate limits and a kill switchEach agent has its own limit of tool calls a minute. Disable one agent, or stop every agent at once, and requests are refused immediately.
• Unusual behaviourAfter a learning week, an agent that calls a tool it has never used, or makes three times more calls in an hour than its busiest hour so far, raises an alert in the same incident queue as everything else.
• A record of every callAgent, server, tool, decision and reason, argument names and sizes (never their values), sensitive data found (masked), result and latency — for audits and for investigating what an agent did.

6Security and data handling

• Agents never hold server credentialsAgentGate keeps them encrypted and adds them to each forwarded request.
• An AI never approvesApprovals come from people signed in to the console, never from agent or service identities.
• Argument values are not keptThe record keeps argument names and sizes and masked sensitive findings only.
• Revocation is immediateA deleted, disabled or stopped agent is refused on its next request.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• MCP servers reachable over HTTPS that speak Streamable HTTP
• Agents whose MCP client can send a bearer token

Start a 30 days, up to 5 agents trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.