Build an agent.
Govern every call.

Working code for agents that call tools and models through Magertron™ — every call authorized against the agent and the person it acts for, metered, and audited. Your agent holds no vendor API keys.

View on GitHub → Read the Agent Developer Guide

$ git clone https://github.com/magertron/agent-examples && cd agent-examples

$ go test ./...

ok github.com/magertron/agent-examples/magertron

$ MAGERTRON_URL=https://mcp.acme.com MAGERTRON_SA_TOKEN=… go run ./cmd/chat-agent

chat-agent ready — Path A (Magertron-issued service account), acting as itself.

> what time is it in UTC?

· mcp-prod/time/get_system_time → ok

It's 14:02 UTC.

Two identities, one call

The agent acts.
The person is accountable.

Every delegated call carries both identities, signed together by the platform. It can never reach further than the agent or the person could alone, an agent can never act for an administrator, and the bill goes to the person who asked.

Swipe to see the full diagram →

Magertron™ is not another agent framework. It sits underneath the one you already use — anything that can make an HTTPS call.

Claude Code Cursor VS Code Devin your own Go, Python or TypeScript

Three calls

Credential. Catalogue.
Tool call.

That is the whole integration. The gateway decides, per call, whether it may proceed — the agent is free of this responsibility.

Get a credential

Trade your agent's token for a five-minute Magertron™ token. Cache it; refresh before it expires.

Read the catalogue

Ask what may be called. Each tool comes with the platform's verdict for the principal asking.

Call the tool

JSON-RPC over HTTP, with an Idempotency-Key so a retry is never billed twice.

mc, _ := magertron.New(magertron.Options{GatewayURL: "https://mcp.acme.com"})

// 1 · a credential: your agent's token, exchanged for five-minute ones
agent := &magertron.Exchange{Client: mc, Subject: magertron.StaticToken(saToken)}

// 2 · what may you call?
tools, err := mc.Catalog(ctx, agent)

// 3 · call it — authorized, metered, audited, and retried safely
out, err := mc.CallTool(ctx, agent, tools[0], json.RawMessage(`{"timezone":"UTC"}`))

var r *magertron.Refusal
if errors.As(err, &r) && r.Kind == magertron.KindSpendLimit {
    // a human must lift the limit — tell someone, do not retry
}

# 1 · trade the long-lived token for a five-minute one
TOKEN=$(curl -s -X POST "$GW/api/v1/token/exchange" -H 'Content-Type: application/json' \
  -d "{\"grant_type\":\"urn:ietf:params:oauth:grant-type:token-exchange\",
       \"subject_token\":\"$SA_TOKEN\",
       \"subject_token_type\":\"urn:ietf:params:oauth:token-type:jwt\"}" \
  | python3 -c 'import sys,json; print(json.load(sys.stdin)["access_token"])')

# 2 · what may you call?
curl -s "$GW/api/v1/portal/catalog" -H "Authorization: Bearer $TOKEN"

# 3 · call a tool (after initialize — see the guide, §3)
curl -s -X POST "$GW/mcp/mcp-prod/time/" \
  -H "Authorization: Bearer $TOKEN" -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"get_system_time","arguments":{"timezone":"UTC"}}}'

// Acting for a person: the subject is the PERSON, the actor is YOUR agent.
forJane := &magertron.Exchange{
    Client:  mc,
    Subject: magertron.StaticToken(janeToken), // who it is FOR
    Actor:   magertron.StaticToken(saToken),   // who is ACTING
}

// "What can Jane do?" — asked with Jane's credential alone
tools, err := mc.Catalog(ctx, &magertron.Exchange{Client: mc, Subject: magertron.StaticToken(janeToken)})

// Allowed only where BOTH Jane and the agent are permitted.
// Billed to Jane, with the agent shown alongside: "jane · via support-agent".
out, err := mc.CallTool(ctx, forJane, tool, args)

Identity

Bring a directory —
or don't.

Either way, every credential that can call a tool was put there by someone accountable for it.

PATH A

Magertron™ issues the tokens

No identity provider needed. An administrator creates the service account — in the console, through SCIM or with Terraform — and Magertron™ signs its token.

One service-account token, held in your secrets manager
Exchanged for five-minute tokens, cached and refreshed before they expire
Acting for a person: an admin issues the person's token, and the same exchange binds the two

PATH B

Your directory issues them

Already on Auth0, Entra ID or another OIDC directory? Your agent gets a token from it with client credentials, and Magertron™ exchanges it.

Long-lived secrets stay in your directory
Exchanged Magertron™ tokens last five minutes
Acting for a person: their directory token is the subject, yours the actor

Build an agent.Govern every call.