Question 1

What is Ingate?

Accepted Answer

Ingate is an all-in-one LLM gateway that sits between your applications, agents, and LLM providers. It combines a transparent proxy, full observability, prompt versioning, automated evaluations, provider fallback, response caching, guardrails, budget controls, a skill marketplace, trace exports, and an MCP server for agent-driven management. It runs as a managed service (Ingate Cloud) or self-hosted via Docker or a single Go binary.

Question 2

Can my coding agent manage Ingate?

Accepted Answer

Yes. Ingate serves a Model Context Protocol (MCP) endpoint at /mcp with 63 tools, so agents like Claude Code, Cursor, Windsurf, VS Code, and Codex can add providers, create keys, inspect logs and usage, run evals, publish skills, and wire up exports as tool calls. An agent can even onboard with zero credentials: the ingate_setup tool creates an org, app, provider configs, and API key in one call. Every tool call goes through the same RBAC and entitlement checks as the REST API.

Question 3

Why use an AI gateway instead of separate tools?

Accepted Answer

Most AI infrastructure requires stitching together separate tools for observability, prompt management, evaluation, and request routing. Each tool adds its own SDK, configuration, and data silo. An all-in-one gateway like Ingate gives you a single integration point: one base URL change, and you get logging, evals, prompts, caching, guardrails, and budget controls working together. No SDK, no glue code, no data fragmentation.

Question 4

Does Ingate require an SDK?

Accepted Answer

No. Ingate works with any HTTP client in any language. Change your base URL to point at Ingate and your existing OpenAI, Anthropic, or custom LLM code works unchanged. Ingate auto-detects the provider from the request path, so most integrations don't even need an extra header. For apps that can't proxy, optional lightweight SDKs for Python, TypeScript, Go, and Elixir ship traces to the ingest API instead.

Question 5

What features does Ingate include?

Accepted Answer

Ingate includes: transparent proxy with SSE streaming and provider auto-detection, auth passthrough for subscription tools, provider fallback, format translation, response caching, PII redaction, prompt injection detection, 14 built-in evaluators, external eval verdict ingest, versioned prompt registry, interactive playground, datasets, a skill marketplace with publish gating, trace exports (OTLP and signed webhooks), an MCP server with 63 tools, session tracking, cost tracking, budget controls, audit logging, HMAC-signed webhooks, scoped API keys with rotation, multi-tenant RBAC, REST ingestion API, and an OpenTelemetry receiver.

Question 6

How does Ingate handle security?

Accepted Answer

Provider API keys are encrypted with AES-256-GCM at rest. API keys are stored as SHA-256 hashes and never logged. Ingate supports scoped keys with per-provider and per-model restrictions, zero-downtime key rotation, PII redaction on request bodies, prompt injection detection, SSRF protection on outbound requests, and a complete audit log of administrative actions. Auth endpoints are rate-limited to prevent brute-force attacks.

Question 7

What plans does Ingate offer?

Accepted Answer

Ingate offers two plans. The Free plan includes the transparent proxy, SSE streaming, request logging, a built-in dashboard, multi-org support with teams and apps, usage analytics, the MCP server, the setup wizard, 7-day log retention, and up to 5 API keys per org. The Enterprise plan adds prompt versioning, evaluations, datasets, playground, provider fallback, format translation, response caching, PII redaction, guardrails, webhooks, audit log, budget controls, cost tracking, the skill marketplace, trace exports, external eval ingest, Prometheus metrics, per-key rate limits, configurable retention, and up to 100 API keys per org.

Field	Type	Required	Default	Description
`name`	string	yes	none	Unique per org
`kind`	string	yes	none	`otlp` or `webhook`
`endpoint`	string	yes	none	Destination URL
`headers`	object	no	`{}`	Static headers sent with every delivery (e.g. `Authorization`)
`secret`	string	no	none	Webhook kind only: HMAC signing secret
`include_sources`	string[]	no	`["proxy", "api"]`	Must be a subset of `proxy`, `api`, `otel`
`enabled`	bool	no	`true`	Whether the config is live immediately

Status	`error_code`	Cause
`400`	`invalid_config`	`kind` is not `otlp`/`webhook`, or `include_sources` has an unrecognized value
`409`	`duplicate_name`	An export config with this name already exists in the org
`400`	`invalid_id`	The `:id` path parameter is not a valid ID (get/update/delete)
`404`	`not_found`	No export config with that ID (get/update/delete)
`400`	`invalid_body`	Malformed update request body

Exports API

List Export Configs

Create Export Config

Get Export Config

Update Export Config

Delete Export Config

Errors