IndyKite Agent Gateway

The Indykite Agent Gateway (IAG) is a standalone service that protects exactly one downstream - an A2A agent or an MCP server. Deploy one IAG per protected downstream. From the caller's perspective IAG appears as the Target; from the protected downstream's perspective IAG appears as the Source. IAG is not a generic reverse proxy: by default (protocol: a2a) it speaks the A2A protocol and tracks A2A sessions so JSON-RPC streams flow correctly; with protocol: mcp it proxies MCP Streamable HTTP traffic (forwarding Mcp-Session-Id and streaming SSE responses through). Either way the same authorization runs in front.

For each request IAG validates three things:

1. The caller (token introspection at the IdP).
2. The workflow (subject CAN_TRIGGER check via AuthZEN/KBAC).
3. The delegation chain (the request's act chain matches a chain modeled in the IKG).

When to use

Activate this skill when the user: