What Ambit is
Ambit is a self-hosted gateway, built on agentgateway, ToolHive and other open-source projects, that controls a company's use of AI. It decides who may use which AI models and which work apps (through MCP), sets spending limits, keeps an audit record, and removes access when someone leaves the company.
agentgateway handles the traffic and ToolHive runs the MCP servers. Ambit adds identity-provider access rules, a console, per-person app sign-in, budgets, audit and offboarding, in one Helm chart.
Why Ambit
| Without Ambit | With Ambit |
|---|
| Each team shares one provider API key, copied into scripts and laptops. | People sign in, or use a personal API key. Provider keys stay inside Ambit. |
| Anyone who has the key can use any model. | Access rules based on your identity provider's groups decide which models and MCP servers each team may use. |
| AI agents connect to work apps on their own, often through one shared service account. | Every MCP call passes one gateway. People connect their own app accounts, tools are checked, and personal data in results is masked. |
| The cost shows up on next month's bill. | Daily limits per group and per person, in requests or in dollars. |
| Nobody can say who sent what to which model. | Every call is recorded, refusals included. Model refusals do not yet show who made them (an agentgateway bug; see Known limitations). |
| Someone leaves, and their keys work until someone remembers to rotate them. | The identity provider disables them, and their keys, sessions and app sign-ins stop at once. |
Architecture
Blue is the path every request takes; grey is how admins and your identity provider set things up.
Features
- Approved models for coding tools. Claude Code, Cursor and SDKs call your models through one address, with a personal API key or a token from your identity provider.
- Models per team. Access rules map identity-provider groups to models. Access is denied unless a rule allows it.
- MCP servers with per-person sign-in. People connect their own account to an app (for example GitHub or Slack). An admin chooses which tools of each MCP server a group may call.
- Budgets. Daily limits per group and per person, in requests and in estimated dollars.
- Offboarding. When the identity provider deactivates someone, Ambit revokes their sessions, API keys and stored app grants.
Every call is kept in an audit log, refusals included, and shown in the console. Model refusals do not yet show who made them (an agentgateway bug; see Known limitations).
Quick start
On a laptop with Docker (macOS, Linux, or Windows with WSL 2):
brew install craftsman-apps/tap/ambit # or: curl -fsSL https://ambitproject.dev/install.sh | sh
ambit local up
ambit local up creates a local kind cluster, installs Ambit for testing only (plain HTTP, one gateway replica), adds a model and an access rule, makes a first call, and prints the console address and the sign-in.
The full guide has the other install methods (PowerShell, npm, go install) and the next steps.
Status: Alpha
Ambit is pre-1.0. The API is ambitproject.dev/v1alpha1 and can change between releases.
| Tested | Not tested yet |
|---|
| Install and all features on kind, in CI on every pull request | Azure OpenAI, Amazon Bedrock and Vertex AI with real cloud accounts |
| Company sign-in through a test Keycloak, external ClickHouse and Valkey, GitOps with Argo CD | A 24-hour soak test (CI runs a 5-minute soak) |
When not to use Ambit
- You need a hosted service. Ambit runs only in your Kubernetes cluster.
- You do not run Kubernetes. Ambit is installed with Helm and has no other install method.
- You need a stable API today. Wait for a release after
v1alpha1.
- You need one proxy for a single team or one provider. A plain proxy is simpler.
Documentation
Credits
Ambit is built on these projects. Each keeps its own licence.
| Project | Use in Ambit | Licence |
|---|
| agentgateway | LLM and MCP traffic | Apache-2.0 |
| ToolHive | Runs MCP servers | Apache-2.0 |
| Dex | Sign-in and tokens | Apache-2.0 |
| Gateway API | Routing objects | Apache-2.0 |
| ClickHouse | Audit storage | Apache-2.0 |
| OpenTelemetry Collector | Audit pipeline | Apache-2.0 |
| Valkey | Budget counters | BSD-3-Clause |
| envoyproxy/ratelimit | Budget enforcement | Apache-2.0 |
| MCP Go SDK | Preset checks and test MCP servers | Apache-2.0 (older code MIT) |
| Kubernetes client libraries, controller-runtime, CEL-go | Controller and rules | Apache-2.0 |
| React, TanStack, Tailwind CSS, Radix UI | Console front end | MIT |
| IBM Plex (Fontsource) | Console fonts | SIL OFL 1.1 |
Contributing, security, licence
