Enforgate
Start free
Browse documentation

How do I guard my first tool call?

Three steps: get a key, set a policy, send a check request. Under 60 seconds.

Step 1: Get an API key with a policy

Sign in → Policies → create a policy → API Keys → create a key and attach the policy. Copy the full enf_… key (shown once).

Start with these three rules: they block destructive calls and hold email for review.

starter policy rules
[
  { "tool": "delete_*", "action": "deny",             "reason": "never delete in prod" },
  { "tool": "send_*",   "action": "require_approval", "reason": "human reviews outgoing mail" },
  { "tool": "*",        "action": "allow" }
]

Step 2: Send a check request

POST /v1/check evaluates a tool call against your policy and writes an audit row. Replace enf_your_key with your key:

cURL
curl -s https://api.enforgate.com/v1/check \
  -H "Authorization: Bearer enf_your_key" \
  -H "Content-Type: application/json" \
  -d '{"serverName":"demo","toolName":"delete_file","args":{"path":"/prod/db"}}'
response
{"decision":"deny","reason":"delete_file is blocked by policy","latencyMs":4}

Open the live feed; you'll see the blocked call appear instantly.

Try it without cURL: the Playground runs the same check in your browser and shows the verdict, the matched rule, and the full audit trail.

Step 3: Guard calls in code

The TypeScript SDK wraps the check API. guard() throws unless the decision is allow, so guarding a call is a single await:

TypeScript
import { EnforgateClient } from "@enforgate/sdk";

const enforgate = new EnforgateClient({ apiKey: process.env.ENFORGATE_API_KEY! });

// guard() throws unless the decision is "allow": inline protection.
await enforgate.guard({ serverName: "demo", toolName: "delete_file", args: { path } });

Run the built-in quickstart example to see both check() and guard() in action:

run the example
ENFORGATE_API_KEY=enf_your_key npm run quickstart

Connect an MCP agent (optional)

To guard an agent end-to-end without changing its code, register your MCP servers as Connected Tools and point the agent at /mcp. Claude Desktop config:

Claude Desktop
// claude_desktop_config.json
{
  "mcpServers": {
    "enforgate": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.enforgate.com/mcp",
               "--header", "Authorization: Bearer enf_your_key"]
    }
  }
}

Every tool call now flows through your policy before it reaches the connected tool. See integration guides for LangChain, Python, and LangGraph.

What's next