Nothing executes in the gateway
The edge parses, decides, routes, and logs. Tools run in a separate, sandboxed process (uid, seccomp, landlock, no network). A prompt injection can’t turn the gateway into a shell — there is none.
portcullis
Lower the gate on untrusted tools. An open-source MCP gateway with identity, isolation, audit, and protocol translation — in one Apache-2.0 binary, no enterprise tier.
portcullis sits between agent clients and tool servers and provides identity, authorization, sandboxed execution, auditing, and protocol translation — without adding meaningful latency, without an enterprise paywall, and without ever executing tool logic in its own process.
Why portcullis
Section titled “Why portcullis”All Apache-2.0, no enterprise tier
SSO, RBAC, DLP, audit, rate limiting, and multi-tenancy are core features. A build-time check enforces that nothing is gated on a licence.
Latency is a hard budget
p99 ≤ 5 ms of gateway-added overhead, gated in CI. The passthrough path never fully deserializes payloads.
Zero required infrastructure
One binary runs on a laptop and in production. Postgres, Redis, Vault, and OIDC are optional integrations, never prerequisites.
Explore the docs
Section titled “Explore the docs” Install & first run Build it, check it with doctor, run it.
Your first proxied server A five-minute walkthrough with real, verified output.
Architecture The edge, broker, and runner — and how compromise is contained.
Security model What's enforced, what's CI-gated, and what's not yet.
Authorization policy RBAC/ABAC in the request lifecycle.
Roadmap Milestones M0–M6, done and planned.