SolonGate

Quick Verdict

SolonGate is an execution-policy gateway placed between an AI agent and MCP servers or other tools. It inspects proposed file, command, URL, API, or database actions, applies ALLOW/DENY policy before the real tool executes, and records an audit event. Its useful shift is from asking a model not to act dangerously to enforcing a separate control at the tool-call layer.

It fits teams that already expose tools to agents and can maintain explicit policies. It is not an automatic cure for prompt injection. Public architecture material says policies compile to OPA-WASM and evaluate locally. The AI Judge is optional in the Local/self-hosted deployment, not a mandatory decision layer. Commercial cloud pricing is contact-based. The MIT license on the public npm proxy applies only to that package, not automatically to SolonGate Cloud, the dashboard, backend, or every Local component.

Best For

• Agent platform teams exposing filesystem, shell, network, or database tools
• Security engineers translating least privilege into enforceable rules
• Regulated organizations evaluating local policy and isolated deployment
• MCP maintainers adding a proxy without changing a business server
• Not ideal for teams without policy owners, unable to accept a gateway failure point, or expecting an AI Judge to replace permission design

Key Features

• Intercepts MCP stdio, SSE, or HTTP tool calls before execution
• Local OPA-WASM policy matching for tools, paths, commands, URLs, and permissions
• Allowlist and denylist modes, with vendor-described fail-closed behavior in allowlist mode
• Audit events containing decisions, rules, reasons, latency, and potentially full tool arguments
• Dashboard policy authoring, synchronization, versioning, and rollback
• Optional local AI Judge using a Qwen model served through vLLM for ambiguous cases
• Machine-wide, repository-specific, single-server, Local, and air-gapped deployment claims

Use Cases

• Deny reads of credential files, production writes, or destructive commands
• Restrict an agent to approved repositories, domains, tools, and operations
• Observe allow and deny events before progressively tightening policy
• Wrap one high-risk MCP server for an isolated pilot
• Keep sensitive tool arguments inside a Local deployment rather than a cloud audit path

Pricing

As of July 21, 2026, the website did not provide a reliable public self-service price table and primarily offered Get Started and contact-sales flows. This entry is therefore classified as paid. Buyers should confirm billing units, protected machines or servers, audit volume, retention, Local deployment, support, and exit costs instead of assuming a free/enterprise split.

The @solongate/proxy npm package is marked MIT, allowing review and use of that proxy package. The website terms state that the service, documentation, and content belong to the Turkish company ERAENVISION TEKNOLOJİ VE İNOVASYON HİZMETLERİ LİMİTED ŞİRKETİ, while the site says broader open sourcing is “coming soon.” Evaluate the client proxy and proprietary service separately.

Pros

• Enforces policy on actual tool calls rather than relying only on prompts
• Local OPA-WASM decisions can avoid a policy network round trip
• Machine, repository, or server scoping supports gradual rollout
• AI Judge is optional; deterministic policy does not require another model
• MIT npm proxy provides inspectable client-side code

Cons

• Contact-sales pricing leaves package and total-cost boundaries unclear
• Cloud is proprietary; “open source soon” is not current full-source auditability
• Full arguments in audit logs can expose secrets, file content, queries, and personal data
• The privacy policy claims regular security audits without publishing auditor, scope, date, or report
• Insufficient public evidence of SOC 2 or ISO 27001, penetration-test summaries, vulnerability policy, SLA, and disaster-recovery targets
• The subprocessor list is substantial and requires data-flow and transfer review
• The gateway enforces configured rules only; omissions, bypasses, and bad exceptions remain risks

Alternatives

FAQ

Is SolonGate free?

The site did not publish a clear price table. Commercial use is primarily contact-sales, and this review does not assume a permanent free tier.

Is SolonGate fully open source?

No. The npm proxy is MIT-licensed, while the site says the broader product is coming to open source. Treat the dashboard and service as proprietary unless their code is actually released.

Must every call use the AI Judge?

No. Deterministic policy can evaluate locally. The Judge is an optional Local layer for ambiguous cases.

Can audit logs contain sensitive information?

Yes. Official material says audit entries can include full arguments. Test redaction, exclusions, access control, retention, and deletion before production.

Does it eliminate prompt injection?

No. It can block actions covered by policy, but cannot fix missing rules, calls that bypass the proxy, or dangerous actions that look permitted.

What should a production test cover?

Test bypass paths, fail-closed behavior, policy update and rollback, latency, sensitive log fields, cloud outage, subprocessor flows, and incident response.

Bottom Line

SolonGate applies a sensible control at the agent execution layer and can make real tool calls subject to local deterministic policy. Procurement still requires more than accepting zero-trust and prompt-injection claims. Separate the MIT proxy from the proprietary cloud, test bypasses and failure behavior in a low-privilege environment, and contract for audit-argument handling, subprocessors, retention, and assurance. For highly sensitive workflows, evaluate Local policy and the optional Judge before sending full arguments to cloud logging.