Skip to main content
TrustGate is one Go binary plus Postgres, Redis, and Kafka. Pick the workflow that fits.

​
One-line install

Clones the repo, seeds .env, brings up the full stack in Docker, and (when Go is installed) builds and installs the trustgate CLI on your PATH: 
curl -fsSL https://raw.githubusercontent.com/NeuralTrust/AgentGateway/main/scripts/install.sh | bash
Requires git, docker, and Docker Compose (plus Go to build the CLI). Re-running updates the checkout and never overwrites your .env. Useful overrides:
VariableEffect
AG_REF=developInstall a different branch / tag / commit.
AG_DIR=/path/to/dirWhere to clone.
AG_BIN_DIR=~/.local/binWhere to install the trustgate CLI.
AG_INSTALL_CLI=0Skip building the CLI.
AG_NO_START=1Skip docker compose up.

​
Docker Compose

git clone https://github.com/NeuralTrust/AgentGateway.git
cd AgentGateway
cp .env.example .env          # adjust as needed

make up                       # Postgres, Redis, Kafka + admin, proxy & mcp
make logs                     # tail
make down                     # tear down
Check the health probes: 
curl localhost:8080/healthz       # admin
curl localhost:8081/healthz       # proxy
curl localhost:8082/healthz       # mcp
curl localhost:8080/__/version    # build info (version, commit, date)
The image is pinned to linux/amd64 because confluent-kafka-go only bundles an amd64 librdkafka; on Apple Silicon the build runs under emulation out of the box.

​
Local development

Run the infra in Docker and the binary on your machine so you can attach a debugger: 
make compose-up     # boot Postgres, Redis, Kafka, Zookeeper

make run-all        # admin :8080 + proxy :8081 in one process (simplest)
# ...or each plane in its own terminal (closer to production):
make run-admin      # applies migrations, admin on :8080
make run-proxy      # proxy on :8081
make run-mcp        # MCP server on :8082

make compose-down   # stop infra (add -v to wipe volumes)

​
Kubernetes

Manifests live under k8s/ (kustomize); each plane is its own Deployment: 
kubectl apply -k k8s/

​
Configuration

All configuration is read from environment variables — in dev, .env is loaded automatically; in production, inject them via Helm values, ECS task definitions, or a k8s ConfigMap + Secret. See Configuration for the full reference, and Deployment for production topology.

​
Run the tests

make test            # unit
make test-race       # unit + race detector
make test-cover      # unit + coverage
make test-functional # functional tests against a real admin server