Sign inSign up

imshakil/dwarix-gateway

By imshakil

•Updated 5 months ago

Dwarix is an AI Agent Identity and Access Platform that sits between agents and the tools they use.

Image
Security
Machine learning & AI
Developer tools
0

294

imshakil/dwarix-gateway repository overview

⁠Dwarix Gateway

MCP-native IAM gateway for AI agents. Sits between agents and MCP tool servers — enforces identity, policy, credential injection, and audit on every tool call.

AI Agent → [ Dwarix Gateway ] → MCP Tool Servers
              ↓ verify JWT
              ↓ evaluate policy (OPA/Rego)
              ↓ inject credentials
              ↓ audit log

⁠What It Does

Four enforcement layers on every call:

  1. Identity — RS256 JWT verification. Agents enroll once, get signed token. No valid token = no call.
  2. Policy — OPA/Rego authorization with JSON glob fallback. Per-agent allow/deny rules (github/*, notion/read_page). Deny always wins.
  3. Credential Broker — Agents never hold real secrets. Vault fetches at call time (Fernet / HashiCorp / AWS), injects as upstream headers.
  4. Audit — Every call → structured NDJSON entry (outcome, latency, agent, tool). Fan-out to Datadog, Splunk, or webhook built in.

⁠Quick Start

docker run -d \
  -p 8080:8080 \
  -v $(pwd)/data:/app/data \
  -e DWARIX_ADMIN_KEY=your-secret-key \
  imshakil/dwarix-gateway:latest

Control plane dashboard → http://localhost:8080

⁠With OPA (Recommended)

DWARIX_ADMIN_KEY=your-secret-key docker compose up

Starts:

  • gateway on port 8080
  • opa on port 8181

⁠Environment Variables

VariableDefaultDescription
DWARIX_ADMIN_KEYdev-admin-key-...Admin API key — change in production
DWARIX_PORT8080Listen port
DWARIX_DATA_DIR/app/dataRuntime state directory
DWARIX_POLICY_ENGINEopaopa or json
DWARIX_OPA_URLhttp://localhost:8181OPA server URL
DWARIX_VAULT_BACKENDfernetfernet, hashicorp, or aws
DWARIX_VAULT_KEY(auto-generated)Fernet vault master key
DWARIX_EXPORT_DATADOG—true to enable Datadog export
DWARIX_DD_API_KEY—Datadog API key
DWARIX_EXPORT_SPLUNK—true to enable Splunk HEC
DWARIX_EXPORT_WEBHOOK—true to enable webhook export

⁠Persisted Data

Mount /app/data to volume:

data/
  agents.json       # agent identities
  policies.json     # allow/deny rules
  tools.json        # MCP server registry
  bindings.json     # credential-to-agent bindings
  audit.ndjson      # append-only audit log
  vault.enc         # encrypted credential store
  keys.json         # RSA keypair for JWT signing

⁠API Reference

EndpointAuthDescription
POST /callBearer JWTAgent tool call proxy
POST /mcpBearer JWTMCP JSON-RPC 2.0 (initialize / tools/list / tools/call)
POST /auth/token—Exchange agent credentials for JWT
GET /health—Health check
GET /—Control plane dashboard
POST /admin/agents/enrollAdmin keyRegister agent
POST /admin/policiesAdmin keySet agent policy
POST /admin/credentialsAdmin keyStore credential
POST /admin/tools/registerAdmin keyRegister MCP server
GET /admin/audit/logsAdmin keyQuery audit log
WS /ws/audit-stream—Real-time audit stream

Admin endpoints require X-Admin-Key header.

⁠Vault Backends

BackendUse Case
fernetDev / single-node (AES-encrypted local file)
hashicorpProduction (HashiCorp Vault KV v2)
awsProduction (AWS Secrets Manager)

⁠SIEM Export

NDJSON file always active. Enable additional destinations:

DestinationEnv Vars Required
DatadogDWARIX_EXPORT_DATADOG=true + DWARIX_DD_API_KEY
SplunkDWARIX_EXPORT_SPLUNK=true + DWARIX_SPLUNK_URL + DWARIX_SPLUNK_TOKEN
WebhookDWARIX_EXPORT_WEBHOOK=true + DWARIX_WEBHOOK_URL

⁠Source & Docs

⚠️ Alpha. Pin to specific image tag for stability. APIs may change between releases.

Tag summary

Content type

Image

Digest

sha256:8378dbeae…

Size

93.1 MB

Last updated

5 months ago

docker pull imshakil/dwarix-gateway