SatGate
Budgets and signed receipts for your agents' MCP tool calls. Use when connecting OpenClaw to SatGate Cloud.
matt-dean-git
@matt-dean-git
Install
$ openclaw skills install @matt-dean-git/satgateSatGate MCP
SatGate Cloud puts a credit budget on an agent token and writes a signed receipt when it allows a tool call or refuses one for budget.
Mint the token in cloud.satgate.io. Each token has its own budget. When the credits run out, SatGate refuses that agent's calls. This skill connects OpenClaw to that MCP server. It does not mint tokens, change policy, or spend credits by itself.
When to use
Use this when someone wants SatGate on an OpenClaw agent, a budget on tool calls, or a receipt they can check.
Connect
Use Streamable HTTP.
openclaw mcp set satgate '{"url":"https://satgate-mcp-saas.fly.dev/mcp","transport":"streamable-http","headers":{"Authorization":"Bearer <your agent token>"}}'
openclaw mcp probe satgate
Pass that JSON object alone. Do not wrap it in mcp.servers or mcpServers. A wrapped object can save and still leave the agent with no SatGate tools.
<your agent token> is a placeholder. Replace it with a token from cloud.satgate.io. Keep the JSON in single quotes so the shell does not expand it. Do not print the token, and do not commit the OpenClaw config that holds it.
SSE is the other transport, at https://satgate-mcp-saas.fly.dev/sse. New configs should use /mcp.
If you edit ~/.openclaw/openclaw.json by hand, that file does use a wrapper. Put the same url, transport, and headers under mcp.servers.satgate. Do not paste that wrapper into openclaw mcp set.
What the agent can do
satgate_budget_check returns the token's remaining credits and costs no credits. SatGate rate limits it per token.
The other tools are the ones configured for that token. They draw on its credit budget. A call refused for budget still gets a receipt.
One saved server named satgate is one token, and one budget. Mint a separate token for each agent.
Receipts
Allowed calls and calls refused for budget get a signed receipt. Anyone can check it against SatGate's published keys. The check does not need a SatGate login.
MCP public keys: https://satgate-mcp-saas.fly.dev/.well-known/jwks.json
The browser check is satgate.io/verify-evidence-pack.
The open-source verifier is in the public repo. Clone it, then pass the evidence pack URL. Do not pipe a downloaded script into Python.
git clone https://github.com/SatGate-io/satgate.git
python3 satgate/demo/verify_evidence_pack.py '<evidence pack url>'
A valid receipt shows the decision SatGate recorded. It does not show what an upstream tool did after an allow.
Clients that only run a local command
Some clients cannot take a URL and a header. They run a local command. Pin the bridge. It needs Node 18 or newer.
{
"command": "npx",
"args": ["-y", "satgate-mcp-bridge@1.0.5"],
"env": {
"SATGATE_URL": "https://satgate-mcp-saas.fly.dev",
"SATGATE_TOKEN": "<your agent token>"
}
}
SATGATE_URL is the origin only. The bridge adds its own path. Do not append /mcp.
Safety
- Do not invent a token, and do not reuse one found in a workspace file.
- Do not send the token to any host other than
satgate-mcp-saas.fly.dev. - Do not say the budget is unlimited, or that a receipt proves what the upstream tool did.
Top skills in this category
Stripe
@byungkyuStripe API integration with managed OAuth. This is a write-capable financial integration for customers, subscriptions, invoices, products, prices, and payments. Install only if you need Stripe administration. Connect with the least-privileged Stripe account and OAuth scopes available, verify the intended connection ID before each request, and revoke unused connections promptly. All write operations require explicit user approval showing the exact endpoint, target resource, object IDs, amounts, and test/live mode before execution. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI after `maton login`; the Stripe credential stays in the gateway and is never handled locally. Only your own Maton credential is used locally — held by the CLI, or supplied as `MATON_API_KEY` in the appendix fallback. Default to read and list calls, stay on the endpoints this skill documents, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Stripe connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Stripe action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Stripe examples; they add no Stripe capability - Stripe is itself an event source, so its own events are in `references/stripe/triggers.md`, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
xero
@byungkyuXero API integration with managed OAuth. Manage contacts, invoices, payments, accounts, and run financial reports. Use this skill when users want to interact with Xero accounting data. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Xero connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Xero action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Xero examples; they add no Xero capability - Xero is not an event source, a trigger cannot read Xero data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
QuickBooks
@byungkyuQuickBooks API integration with managed OAuth. Install only if you need QuickBooks accounting administration. Connect with a least-privileged QuickBooks account, verify the intended connection ID before each request, and revoke unused connections promptly. This integration can mutate accounting records — approve only specific write actions after checking the exact endpoint, account, resource ID, amounts, and consequence. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a QuickBooks connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a QuickBooks action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with QuickBooks examples; they add no QuickBooks capability - QuickBooks is not an event source, a trigger cannot read QuickBooks data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
zoho-books
@byungkyuZoho Books API integration with managed OAuth. Manage invoices, contacts, bills, expenses, and other accounting data. Use this skill when users want to read, create, update, or delete invoices, contacts, bills, expenses, or other financial records in Zoho Books. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Requires network access and valid Maton API key. Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Zoho Books connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Zoho Books action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Zoho Books examples; they add no Zoho Books capability - Zoho Books is not an event source, a trigger cannot read Zoho Books data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Gog
@steipeteGoogle Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.