Docs/CLI Reference

CLI Reference

Command-line tools for running and managing SatGate.

satgate (Gateway Server)

satgate --config gateway.yaml

Start the SatGate gateway with the specified configuration file.

--config <path>Path to YAML configuration file (required)

--versionPrint version, commit hash, and build date

--helpShow help

satgate-cli (Management CLI)

satgate-cli init

Interactive setup wizard. Configures Cloud URL, API key, and validates connection. Saves to ~/.satgate/config.json.

satgate-cli status

Show gateway health, tenant info, active agents, and spend summary.

satgate-cli mint

Mint a capability token (macaroon) for an agent. Gets a JWT from the Identity Provider and exchanges it at SatGate Mint.

--subject, -s <name>Agent identity subject (required)

--audience, -a <aud>JWT audience claim (default: "satgate")

satgate-cli wrap

Run any command through a local SatGate proxy. Sets HTTP_PROXY/HTTPS_PROXY so all outbound traffic from the child process is routed through SatGate with the token injected.

--token, -t <macaroon>SatGate capability token (or set SATGATE_TOKEN env var)

--gateway, -g <url>Gateway URL to route through (optional, uses config default)

-- <command> [args]Command to run (everything after --)

satgate-cli token validate <macaroon>

Validate a macaroon token and display its caveats, budget, and expiry.

satgate-cli version

Print version, commit hash, and build date.

satgate-mcp (MCP Proxy)

satgate-mcp

Start the SatGate MCP proxy. Wraps MCP-compatible upstream servers with budget enforcement, cost attribution, and delegation.

--config <path>Path to MCP proxy configuration file

--root-key <key>Root macaroon key for token verification

--upstream <url>Upstream MCP server URL(s)

--listen <addr>Listen address (default: :8080)

--admin-listen <addr>Admin API listen address

--redis-url <url>Redis URL for spend tracking

--database-url <url>Postgres URL for persistence

Examples

Quick Start — Protect an API in 60 seconds

# Install
curl -L https://github.com/satgate-io/satgate/releases/latest/download/satgate-darwin-arm64 -o satgate
chmod +x satgate

# Create minimal config
cat > gateway.yaml << 'EOF'
version: 1
admin:
  rootKey: "my-admin-key"
upstreams:
  my-api:
    url: "https://api.example.com"
routes:
  - path: /
    upstream: my-api
    policy:
      kind: capability
EOF

# Start
./satgate --config gateway.yaml

Mint a token and wrap an agent

# Setup CLI
satgate-cli init

# Mint a token for your agent
satgate-cli mint --subject research-bot

# Run your agent through SatGate
satgate-cli wrap --token <macaroon> -- python my_agent.py