ENES Sign in Start free
Security model

Your machines, your rules

OpsGates has two modes with two different promises. Here is exactly how each one works, without fine print.

Server mode: nothing leaves your server

The agent runs on your server. It is the MCP server your AI app connects to, and it holds everything sensitive: the login password (as a scrypt hash), OAuth codes and tokens (as SHA-256 hashes), optional static tokens (hashes), the audit log and your configuration.

OpsGates Cloud (this website) manages your account, license keys and billing. It never connects to your server and never receives anything from your tools.

What the agent sends us

Every 30 seconds while in use (and every 5 minutes when idle) the agent sends one small HTTPS request containing:

  • the number of tool calls since the last report,
  • a random agent identifier and a batch identifier (so a retry is never counted twice),
  • the agent version, and your server's public connector URL (shown in your dashboard).

That's all. Never tool names, arguments, file names, paths, command output, database rows or any credential. You can read the code: it is in /opt/opsgate/meter.py on your server.

How the AI signs in

When you add the connector, your AI app opens a login page served by your own server. You type your server's password there; it is checked against the local hash and never sent anywhere else. The app receives short-lived tokens (1 hour, with rotating refresh tokens) issued by your server. PKCE is required, redirect addresses are restricted to known AI apps, and repeated wrong passwords lock the login.

Guard rails on every tool

  • Unprivileged service user. The agent runs as opsgate, never as root, inside a hardened systemd sandbox (read-only system, private /tmp, restricted kernel access).
  • Writes only where you allow. By default the agent can read but not write. You allow specific folders with sudo opsgate allow-write /path.
  • Restarts only what you allow. sudo opsgate allow-restart nginx adds an exact sudo rule for that service. Nothing else can run as root.
  • Preview, then confirm. Writes, edits, restarts and state-changing commands return a preview; they run only when the assistant calls again with confirm=true — after asking you.
  • No shell. Commands run from an allow-list without a shell, so pipes, redirects and substitutions are not interpreted.
  • Secrets masked. Passwords, API keys, private keys and tokens are replaced by *** in all output, and files like .env, *.pem, id_rsa and /etc/shadow cannot be read at all.
  • Backups and audit log. Every write makes a timestamped backup first, and every call is recorded locally in /var/log/opsgate/audit.jsonl.

Computer mode: easy, and honest about the relay

A personal computer is usually behind a home router and cannot receive connections from the internet. So the small OpsGates app on your computer opens a connection to our cloud, and your AI app reaches it through us. This is how every product of this kind works; here is what that means in practice:

  • Requests and answers pass through our cloud on the way between your AI app and your computer, encrypted with HTTPS. They are held in memory only for as long as the call takes and are never written to disk.
  • What we keep: which tool ran, when, how long it took and whether it worked — never file contents, paths, commands or output. You see the same list on the computer's page.
  • You choose the folders the AI may use (your user folder by default) and the permission level: read only, files only, or files and commands. The computer checks every request against these rules itself.
  • Always protected: SSH and GPG keys, cloud credentials (AWS, Azure, Google Cloud, Kubernetes), saved browser passwords and cookies, and the app's own secret — even inside a shared folder.
  • No administrator rights. The app runs as your user, installs only in your user folder, and its updates are signed with our offline release key: it refuses anything else.
  • Sign-in with your account. AI apps connect with OAuth: you approve each app with your OpsGates account (and two-step verification if you turned it on). Tokens are bound to one computer, stored only as hashes, and you can disconnect any app or remove the computer at any time.

If you do not want any of your data to pass through us, use Server mode on a machine you control.

Your account on OpsGates Cloud

  • Passwords are stored as scrypt hashes; sessions, license keys, computer secrets and email links only as SHA-256 hashes.
  • Two-step verification (authenticator app) is available for every account and required for administrators.
  • Payments are handled by Stripe. We never see or store card numbers.

If OpsGates Cloud were compromised

Server mode: an attacker would get email addresses, usage counts, connector URLs and billing status — no way into your servers. The worst they could do is make a license key look invalid, which pauses tool calls.

Computer mode: the relay is the path to your computer, so an attacker controlling our cloud could send requests to connected computers, within the folders and permission level set for each one. That is why we keep this service small, hardened and monitored, why the computer enforces its own limits, and why you can choose read-only or remove a computer with one click.

Reporting a vulnerability

Please write to us. support@opsgates.com We answer quickly and credit researchers who wish to be named.