Why I built OLO ToolGate: authorization at the AI tool boundary

AI agents become more consequential when they can act: write files, call APIs, or change systems.

That raises a question: should this agent be allowed to make this particular tool call, on behalf of this person, right now?

I built OLO ToolGate to put that decision at the tool execution boundary.

What ToolGate does

ToolGate is an open-source, self-hosted security gateway for AI agents, MCP servers, and tool execution.

For each governed invocation, it evaluates one of three decisions:

• ALLOW: proceed under the applicable authority.
• ASK: wait for independent human approval.
• BLOCK: deny the invocation.

The goal is to connect tool access to identities, explicit grants, delegated scopes, and current policy.

Enforcement happens at execution

ToolGate separates request routing from authorization.

The Gateway dispatches the call. The control plane evaluates authorization and issues a single-use permit. The executor must redeem that permit with the control plane before running the call.

If the control plane is unavailable, protected execution stops. Cached metadata does not authorize offline execution.

Requests, approvals, decisions, and outcomes are recorded so that an operator can trace what happened and which identities were involved.

ToolGate in action: an ASK policy pauses a tool call for independent approval, followed by execution and an audit trail. Captured from a local development installation with demo configuration; scripted acceptance traffic is labelled.

Working with existing MCP servers

ToolGate can place existing MCP servers behind its policy, approval, and audit flow.

An operator registers a server, scans its tools, approves which tools to expose, and grants access. Tools start disabled, and a fresh installation grants no runtime access by default.

ToolGate also supports packaging and distributing custom tools. Java and Python authoring implementations are available.

Device enrollment and approval

Follow a device from enrollment and administrator fingerprint review through approval, connection and activity tracking. Device approval alone does not grant tool execution rights.

Tools, policies and delegated access

Explore tool packages, agent groups, delegated authority, explicit grants, ALLOW / ASK / BLOCK policies and execution bindings, including access simulation before execution.

Workspace administration

Tour the workspace console: people and identities, MCP servers, settings, backup and restore, the local vault and version information.

These animations use local development installations and demo configuration. Enabled tools and grants shown are not installation defaults. For individual frames and manual navigation, see the step-by-step screenshot tour.

Try it locally

The repository includes a Docker Compose quickstart for a local, single-node evaluation.

You’ll need Git, Docker, and Docker Compose:

git clone https://github.com/olo-labs/olo-toolgate.git
cd olo-toolgate/deploy/compose/QuickStart
sh manage.sh deploy

On Windows, use:

.\manage.ps1 deploy

After deployment, open:

http://localhost:8080/console/

The quickstart creates separate administrator and reviewer accounts. Follow the repository’s first-login instructions to retrieve the generated credentials, then the first-tool walkthrough to enroll a device, grant access, and execute a governed call.

The default quickstart image uses a mutable development tag. For a repeatable evaluation, follow the README instructions to select a versioned image or digest.

Where the beta stands

ToolGate is in beta. The current limitations matter when evaluating it:

• Tool Host container and network isolation are unfinished.
• Durable result retry is not implemented.
• Protected execution requires a live control plane.
• Nested and dynamic groups are unsupported.
• The quickstart has no high-availability guarantee.
• TypeScript and .NET authoring APIs remain specifications.

The repository documents the security model, threat model, and deployment considerations. A successful local demonstration does not establish production readiness.

About OLO and contributing

OLO stands for Open LLM Orchestration. ToolGate is its first and only current product; other projects are in early development.

OLO Orgs will maintain the open-source work, and I contribute on weekends. ToolGate is licensed under Apache-2.0.

I’d welcome feedback on:

• Whether the trust boundaries and authorization model are clear.
• Where approval workflows become difficult in real agent deployments.
• What makes the local setup confusing or incomplete.
• Which MCP integrations would make evaluation more useful.

Documentation improvements, tests, examples, and bug reports are welcome. Please discuss larger changes in GitHub issues first.

Found a bug or run into an issue? Please log a defect in GitHub Issues. Include steps to reproduce, your ToolGate version and environment, expected versus actual behavior, and relevant logs with secrets removed. For security vulnerabilities, please follow the repository’s security reporting policy.

If you found this article useful, please give it a like on DEV and consider starring OLO ToolGate on GitHub. It helps others discover the project.

Explore OLO ToolGate, the quickstart, and demos.