TknGate: The Zero-Trust Kubernetes Sidecar for Enterprise AI Agent Credentials

Deploy inside your private K8s cluster in 60 seconds. No API key ever leaves your VPC.

v2.8.1 — Zero-Trust K8s Sidecar & Observability

The Problem • The Solution • K8s Deploy • Quick Start • Features • Comparison • Docs

Enterprise security teams block AI agent deployments because of a single, catastrophic risk:

A prompt injection from an untrusted source (a malicious PDF, a poisoned web page, a compromised tool response) instructs the agent to print(env.STRIPE_API_KEY). The agent complies. The key is exfiltrated. Game over.

Every other "AI gateway" — LiteLLM, Portkey, Helicone, OpenRouter — either:

• Routes your traffic through their cloud (your CISO will never approve this), or
• Runs as a Python/Node process too heavy for sidecar deployment, or
• Offers observability only — they can tell you the key leaked after it happened.

None of them solve the actual problem: your agent should never hold a raw API key in the first place.

TknGate is a statically compiled, zero-dependency Go binary that runs as a Kubernetes sidecar directly inside your isolated private VPC. Your agents never see real credentials — they only hold short-lived, scoped proxy tokens.

┌─────────────────────────────────────────────────────────┐
│  Your Kubernetes Pod                                    │
│                                                         │
│  ┌───────────────┐     ┌──────────────────┐             │
│  │  AI Agent      │────▶│  TknGate Sidecar │──────────▶ │ OpenAI / Anthropic / Groq
│  │  (proxy token) │     │  (real API keys) │             │
│  └───────────────┘     └──────────────────┘             │
│                                                         │
│  ✅ Agent holds: ephemeral proxy token                  │
│  ✅ Keys stored: in-memory, inside your VPC             │
│  ✅ Exfiltration attempt: attacker gets nothing          │
└─────────────────────────────────────────────────────────┘

The pitch: "Deploy TknGate inside your private Kubernetes cluster in 60 seconds. Our zero-dependency Go sidecar isolates agent credentials in-memory within your VPC — so no API key ever touches external cloud infrastructure or your agent's context window."

"LiteLLM routes. Portkey observes. TknGate protects."

TknGate is compiled to a single static binary. No Python runtime. No Node.js. No JVM. It adds <1ms of latency per request and consumes <20MB of memory — perfect for a K8s sidecar that runs alongside your agent without impacting performance.

Your agents authenticate to TknGate with a virtual key (an ephemeral proxy token). TknGate resolves it to the real provider API key in-memory, at request time, executes the LLM call, and strips the credential before returning the response. Even if an attacker achieves full prompt injection RCE, they can't exfiltrate what the agent process never had.

• Cryptographic Audit Trail: Every outbound API request generates an immutable, hashed audit record mapping agent identity → prompt context → token usage → cost.
• ZK-SNARK Attestations: Mathematically prove a prompt is safe without ever reading its content (Groth16 BN254).
• Hard USD Circuit Breakers: The moment a budget is breached, the connection terminates — not after the billing cycle, right now, at the byte level.

helm install tkngate ./charts/tkngate \
  --set config.providers.openai.api_key="sk-proj-YOUR_KEY" \
  --set config.budget.global_limit_usd=50

Add TknGate as a sidecar container to any existing Pod:

apiVersion: v1
kind: Pod
metadata:
  name: my-ai-agent
spec:
  containers:
    # Your AI agent container
    - name: agent
      image: your-org/your-agent:latest
      env:
        - name: OPENAI_API_KEY
          value: "your-tkngate-virtual-key"     # NOT a real API key
        - name: OPENAI_BASE_URL
          value: "http://localhost:7477/v1"       # Points to TknGate sidecar

    # TknGate sidecar — credentials stay in-memory, inside your VPC
    - name: tkngate
      image: ghcr.io/tkngate/tkngate:latest
      ports:
        - containerPort: 7477
      volumeMounts:
        - name: tkngate-config
          mountPath: /app/tkngate.yaml
          subPath: tkngate.yaml
      resources:
        requests:
          memory: "16Mi"
          cpu: "10m"
        limits:
          memory: "64Mi"
          cpu: "100m"
  volumes:
    - name: tkngate-config
      configMap:
        name: tkngate-config

docker compose up -d

# Clone & build
git clone https://github.com/tkngate/tkngate.git
cd tkngate
go build -o tkngate

# Configure
cp tkngate.example.yaml tkngate.yaml
# Edit tkngate.yaml with your provider API keys

# Generate a master key (required for the dashboard)
./tkngate generate-master-key

# Run
./tkngate serve

The proxy starts on localhost:7477. The telemetry dashboard opens at localhost:7478.

Point your existing agent at TknGate using our official SDKs — no code rewrites needed. We support Node.js, Python, Go, Java, Ruby, C#, Rust, and PHP.

// Node.js
const { wrapConfig } = require('tkngate');
const openai = new OpenAI(wrapConfig());

# Python
from tkngate import wrap
client = wrap(OpenAI())

👉 View the full SDK documentation for all languages here

Agents authenticate with virtual keys. Real provider credentials never enter the agent's process memory or context window. Prompt injection attacks exfiltrate nothing.

The only LLM proxy that uses zero-knowledge proofs (Groth16 BN254) to mathematically prove a prompt is safe without reading its content.

mesh:
  strict_zkp_mode: true

Most tools let you monitor spend. TknGate lets you stop it. Per-session and global budgets with GREEN/AMBER/RED zone enforcement — connections terminate at the byte level when breached.

Deterministic cache keys that handle tool-calling payloads correctly — scrubs random tool_call_id fields and sorts tool arrays so identical agent conversations always hit cache, regardless of ID generation or tool ordering.

Fork a percentage of live traffic to a second provider and compare outputs and costs with zero changes to your agent code.

Donate spare API quota into a cryptographically secured pool. Keys are encrypted with AES-256-GCM, never exposed in plaintext. Deficit Round-Robin (DRR) ensures fair allocation and throttles free-riders.

Nodes discover each other via Kademlia DHT and mDNS. Reputation updates broadcast via GossipSub with Ed25519 signatures. Anti-Sybil Decay penalises idle nodes.

React UI served from the binary itself — real-time WAF intercepts, ZKP counts, mesh capacity, budget zones, per-key spend. No separate Node.js deployment needed.

Run ./tkngate with no arguments for a beautiful TUI menu. Manage orgs, budgets, API keys, peers, and demos without memorising flags.

Native export at /metrics for Grafana, Datadog, or New Relic.

TknGate natively exports Prometheus metrics at http://localhost:7478/metrics:

# prometheus.yml
scrape_configs:
  - job_name: 'tkngate'
    static_configs:
      - targets: ['localhost:7478']

Key metrics:

• tkngate_budget_spent_usd_total — total enterprise API cost
• tkngate_virtual_key_spend_usd_total — spend per virtual key
• tkngate_active_connections — in-flight requests
• tkngate_cache_hits_total — semantic cache hits
• tkngate_waf_intercepts_total — requests blocked by the AI-WAF

Apache 2.0