How it works

Architecture

AvertGate uses a hybrid architecture: inspection runs in the customer's own network, while management lives in the cloud.

Two planes

	Data plane	Control plane
Where	Customer machine / network (on-premise, stdio)	Hosted web app and database
What runs	MCP proxy, reverse proxy, SDK; inspectors; policy engine	Dashboard, policy management, agent registry, event viewing
What it sees	Tool calls, results, file contents, SQL queries	Only redacted audit events

What leaves your network?

Tool calls, results, file contents and queries are processed inside the customer network. Only redacted audit events go to the control plane: which tool, redacted arguments, the decision and the rule. This reduces latency and eases KVKK/GDPR compliance. The one exception is the AI Guard: if you point it at a cloud provider (TypeSafe's cloud endpoint is the default provider setting), the content being inspected goes to that provider. A local model (Ollama or vLLM) keeps it inside. The AI Guard is off unless you enable it.

Data flow table

Data	Where it is processed	Sent to the dashboard?	Can it reach a third party?
Tool-call arguments, results, file contents, SQL queries	Customer network (the gateway)	No	Only if the AI Guard uses a cloud provider (see below)
Audit event (tool, decision, rule, reason)	The gateway, local audit log	Yes; arguments redacted	No
AI Guard: inspected content	Off by default. With a local model (Ollama/vLLM) inside your network; with a cloud provider, at the provider	No	Yes, the content goes to the provider if you choose a cloud one
Slack approval message	From the gateway to Slack	No	Yes; arguments are written to Slack unredacted
Policy	Managed in the dashboard, fetched by the gateway at start	Dashboard to gateway	No

Slack approvals do not redact argumentsThe approval message shows the call's arguments as they are, so the approver sees what they are approving. If you put tools whose arguments may carry personal data or secrets (for example send_email) behind approval, restrict the Slack channel accordingly.

Policy and event flow

At boot the gateway calls GET /api/gateway/resolve with the agent key to fetch that agent's policy.
At runtime events are sent in batches (up to 100) to POST /api/events/ingest.
When a policy changes in the dashboard the gateway picks up the new version.

You can also run fully local without a cloud connection: a local file via POLICY_PATH and a local SQLite audit log.

Delivery formats

Standalone executable: built for the operating system it is compiled on (avertgate.exe on Windows, avertgate on macOS and Linux). Each OS and CPU architecture needs its own build; contact sales for ready-made packages.
Enterprise Docker image avertgate/gateway.
npx @avertgate/cli for quick POCs.

Air-gapped environments

For the AI Guard you can use local Ollama or vLLM instead of a cloud model, keeping the entire path inside your network.