Agent Middleware is a gateway you put in front of an agent's risky tools (refunds, payouts, deploys) so each action needs a signed permit, runs at most once per request key, and leaves a signed receipt anyone can check offline.
Status: Pre revenue, pre release, solo maintained. There are no paying customers or production deployments to point to. We are looking for design partners with one real consequential tool. Install from source; nothing is published to PyPI or npm.
Use the hosted demo. Get a demo key at the demo key page. The example also needs the associated wallet ID.
git clone https://github.com/agentmiddleware/amw-demo.git
cd amw-demo
python3 -m venv .venv
source .venv/bin/activate
pip install -e .
export AMW_API_KEY='<your key>'
export AMW_WALLET_ID='<your wallet id>'
python examples/permit_echo_retry.pyThe example creates a permit, calls the reference echo tool, retries with the same key, and checks the receipt offline.
Use the gateway Makefile to start a local gateway. QUICKSTART.md has the full walk through.
git clone https://github.com/agentmiddleware/agent-middleware
cd agent-middleware/gateway
make quickstart- Permit: A signed grant that limits an agent to specified tools, a budget, and an expiry.
- Call: A governed MCP tool invocation under a permit.
- Request key: The
Idempotency-Keyheader that identifies a request for retry handling. - Receipt: A signed record of a call's outcome and hashes of its request and response, with a debit link when applicable.
- Credits: Internal metering units, not money.
- a retry with the same key returns the original receipt instead of dispatching again
- a new key is a new request
- Reusing a key with a different request fails with a conflict before dispatch.
- A
delivery_uncertainreceipt means no trustworthy answer came back. The debit is kept, and the operator must reconcile with the downstream tool. The gateway does not resend automatically. - The gateway limits dispatch and debit per key, but remote effects depend on the tool honoring the forwarded key. A receipt signs request and response hashes, not raw tool content, and cannot prove a remote effect happened. This is not exactly once.
Read Security Limitations before relying on the gateway for a consequential action.
This repository holds the reference gateway, protocol spec, SDKs,
integrations, and design-partner pilot loop (start with
QUICKSTART.md). The separate agent-middleware-api
repository is outside this checkout; partner evaluation guidance is here.
| Path | What it contains |
|---|---|
| gateway/ | Gateway implementation and local Makefile |
| sdk/ | Python and TypeScript client and verification code |
| verifier/ | Offline verification guide and vector checker |
| spec/ | Draft permit, receipt, and key formats |
| integrations/ | Framework wrappers and adapters |
| examples/ | Runnable examples and MCP client config |
| amw-demo | Hosted demo client and receipt verifier |
| amw-paypal-agent-demo | PayPal agent demo |
Apache 2.0 (gateway is Fair Source, FSL-1.1)