gdsgate

Choose the documentation edition matching your deployment in the header. Documentation versions explains the selector and latest. Changes in 0.11.x covers commands, installation and resources.

gdsgate is an access gateway for catalogued resources: SSH hosts, databases, Kubernetes clusters, web applications, MCP servers, model services, Windows desktops and TCP services. Authority owns the trust, identity, policy, and audit decisions. Proxy is the client-facing data path. Connector runs beside protected resources and dials out to Proxy. Agent host runs declared agents in cages.

gdsgate runs on Linux and Windows. The Linux build is an x86_64 static musl binary. On Windows, the x86_64 client is installed from the vendor-supplied .msi. The administrator of your deployment supplies the client and release verification material. Installation describes acquisition and verification.

The Quickstart picks the deployment page for what you have. After deployment, complete the access checks.

What gdsgate protects

Control	What it does
Policy decisions	Authority evaluates the identity and the request against Cedar policy before the gateway serves a catalogued resource. Kubernetes, web, MCP and model requests and restricted database statements are decided again one by one inside the session.
Protected data path	Connector makes the protected-side connection and opens an outbound tunnel to Proxy. A client request is not an inbound connection to the protected backend.
Short-lived access	An allowed request receives a short-lived certificate. Expiry and later authorization checks are separate from network reachability.
Agents	A person hands an agent part of their own access for a limited time (gdsgate delegations create). An agent host runs agents under their own identity with access declared on Authority. Both run the agent in a cage.
Recorded decisions	The audit store records authorization and session events in a hash chain. Listing rows shows what was recorded; audit-chain verification is a separate integrity check.

A process with its own route or backend credential bypasses the gateway. See the trust boundary in Concepts.

How it fits together

flowchart LR
  idp([Identity provider])
  client["Client<br/>CLI or resident client"]
  proxy[Proxy]
  authority["Authority<br/>policy · CA · audit"]
  connector[Connector]
  agents["Agent host<br/>caged agents"]
  resource[("Resources<br/>SSH · databases · Kubernetes<br/>web · MCP · models · RDP · TCP")]

  idp -.->|identity token| client
  idp -.->|issuer and keys| authority
  client -->|TLS| proxy
  proxy -->|"mTLS: decisions, certificates"| authority
  connector -.->|"reverse tunnel, outbound"| proxy
  connector -->|"mTLS: per-request decisions"| authority
  connector --> resource
  agents -->|"agent sessions, as a client"| proxy
  agents -.->|"faces, reverse tunnel"| proxy
  agents -->|"mTLS: declarations, identities"| authority

1. A client signs in to the identity provider and asks the Proxy for access to a resource. The Proxy takes the decision and a short-lived certificate from Authority.
2. The Proxy relays the session over the reverse tunnel of the connector that serves the resource. The connector reaches the resource from the protected side.
3. Inside a session, the connector asks Authority again for each Kubernetes request, web request, MCP call, model call and restricted database statement.
4. An agent host runs agents declared on Authority. Their sessions go through the Proxy like a client's; their published faces come back through a reverse tunnel like a connector's.

Connectors and agent hosts accept no inbound connections. A connector reaches Authority directly or through the Proxy (authority_transport). The deployment scenarios describe the hosts and ports.

Where to go next

Reader and outcome	Start here
Anyone choosing a deployment scenario	Quickstart
End user: connect to an existing deployment and use a native client	User guide and Resident client
Agent owner: run a program under part of your own access	AI agents
Operator of long-lived agents: declare, cage and publish agents	Agent host
Administrator: enroll roles, configure state, and harden a deployment	Admin guide
Policy author: understand actions, entities, and policy effects	Concepts and Policy
Integrator: connect a resource or identity system	Integrations
Operator: inspect health, sessions, audit, and recovery	Operations

Every key and flag is in Configuration and CLI. Release changes are in the Changelog. Terms are in the glossary.