Standards
Built on standards, not on a proprietary handshake
Everything the gateway speaks is a published specification, so nothing here locks you in. If you replace the gateway tomorrow, the clients you configured against it still work.
Identity and authorization
How callers prove who they are
| Specification | What it is | How the gateway uses it |
|---|---|---|
| OAuth 2.1 | Authorization framework | Full proxy, and a gateway authorization-server mode. Guide |
| RFC 7591 | Dynamic Client Registration | Clients register themselves, which is what makes zero-config MCP clients work. Guide |
| RFC 8414 | Authorization Server Metadata | Discovery endpoints published so clients configure from the URL alone. Guide |
| RFC 7636 | PKCE | Enforced on authorization-code flows. Guide |
| RFC 9449 | DPoP proof-of-possession | Verified end to end, with request binding, freshness, and single-use proofs. Guide |
| SPIFFE / SVID | Workload identity | JWT-SVIDs and X.509-SVIDs over mTLS, scoped by trust domain. Guide |
| W3C DID | Decentralized identifiers | did:key and did:web, with registration required before a DID verifies. Guide |
| X.509 / mTLS | Certificate identity | Root bundles validated at save time, with scoped refresh. Guide |
| ID-JAG draft-04 | Identity Assertion Authorization Grant | Cross App Access: an IdP such as Okta authorizes 1 app's agent to reach another. Single-use grants, signed audience-bound tokens, verified against the xaa.dev reference. Experimental Guide · Scenarios |
| RFC 9470 | Step-up authentication challenge | Per-proxy step-up requirements, so sensitive proxies can demand a stronger or fresher authentication before access. Guide |
| RFC 9207 | Issuer identification | The iss parameter is issued and validated on authorization responses, in both proxy directions, closing mix-up attacks. Guide |
| Client ID Metadata Documents | URL-based client identity | A client may present an HTTPS URL as its client_id; the gateway fetches and validates the metadata document it serves. Guide |
Protocols
What it speaks on the wire
| Protocol | What it is | How the gateway uses it |
|---|---|---|
| MCP 2026-07-28 + 2024-11-05 | Model Context Protocol, both eras | Both spec eras proxied over HTTP, WebSocket, and SSE, with conformance enforcement, a legacy compatibility bridge, and 3 built-in MCP servers of its own. Guide · Built-in servers |
| A2A spec v1.0 | Agent-to-agent protocol | Native support via the a2a-go v2 SDK, with AgentCard discovery and task lifecycle. Guide |
| ARD catalog | Agentic Resource Discovery | Publishes /.well-known/ai-catalog.json with search, explore, and federation. Guide |
Risk frameworks
What it reports against
| Framework | What it is | How the gateway uses it |
|---|---|---|
| OWASP LLM Top 10 (2025) | Risk taxonomy for LLM applications | Every item maps to a control, and guardrails evaluation scores your deployment against the list. Mapping |
| NIST AI RMF | AI risk management framework | Evaluation results map to the GOVERN, MAP, MEASURE, and MANAGE functions. Guide |
Compliance
Evidence, not certification
An important distinction: software cannot make you compliant, and the gateway is not certified against any of these. What it does is produce the records an assessor asks for, in a form you can export.
| Programme | What the gateway contributes |
|---|---|
| SOC 2 | Audit trail of access, changes, and security events, exportable for evidence collection |
| ISO 27001 | Access control, logging, and change records for the controls that touch AI systems |
| HIPAA | Redaction of identifiers before they reach a provider, with an audit record of every request |
| GDPR | Data minimisation through redaction, self-hosting so data stays in your jurisdiction, and retention control |
Check it against your own requirements
Every specification above links to the guide that documents how it is implemented.