Agent fleet
Decision stream
waiting for agent activity…
Control
0
ALLOW
0
DENY
0
APPROVAL
Pending approvals
none
Audit chain
not verified yet
GATEHOUSE
DataHub gives agents context.
Gatehouse makes context decide what they may do.
Gatehouse makes context decide what they may do.
An MCP enforcement gateway for data agents. It wraps the official DataHub MCP server
unchanged, adds a governed run_sql, and checks every tool call against policy built from
live graph facts — PII tags, glossary terms, ownership, domains, deprecation, active incidents —
before the call runs. Verdicts are ALLOW, DENY, or REQUIRE_APPROVAL. No LLM sits in the decision path.
Source on GitHub (Apache 2.0)
Run it yourself — 4 commands, no Docker
Real captured output (examples/)
What this page is. A recorded replay of one real run of the offline demo — every decision,
latency, rule id, and graph-fact citation below is verbatim from the gateway, captured off the same
WebSocket the live console listens on. It is a recording, not a live server: the approve and
emergency-stop buttons here are part of the recording. To drive it for real, clone the repo — the
offline path needs no DataHub and no Docker.
GATEHOUSE
the enforcement layer for data agents · powered by DataHub
Act 1 · red team
Five agents try five things they should not be allowed to do.
The moment · 1
An agent finds real corruption
The quality agent scans mart_billing and finds 1,215 negative billing amounts
and 277 impossible stay lengths — the corruption DataHub planted in its own healthcare starter dataset.
It calls the governed report_data_issue tool.
2
The graph inherits the knowledge
Gatehouse checks the agent's scope, then raises a real DataHub Incident on the
dataset, citing the agent, the rule, and the audit id.
3
A different agent is circuit-broken
Seconds later the analytics agent asks a routine revenue question against the same table
and is refused, citing the incident the first agent just wrote. The two agents never exchanged
a message. The catalog was the only channel between them.
What gets written back to DataHub
Agents & sessions
Each registered agent is a
DataJob under a gatehouse/agent-fleet DataFlow; each session is a
DataProcessInstance with real inlets and outlets, visible in lineage.
Violations & issues
Every policy violation raises an
Incident on the offending dataset, citing the rule and the exact graph facts. Confirmed data
issues agents find become Incidents too.
Assertions
Each governed dataset carries a custom
agent access policy assertion with run results in the Validations tab.
Run the real thing
# no DataHub, no Docker — full gateway against a snapshot of real graph facts git clone https://github.com/Aaaaarin/gatehouse && cd gatehouse uv venv --python 3.12 .venv && uv pip install --python .venv -e ".[dev]" .venv/bin/python demo/setup_offline.py .venv/bin/python -m gatehouse.cli --config gatehouse-offline.yaml serve # console on :8484 .venv/bin/python demo/scenario.py redteam # then work, inherit, fix, storm
Stills from the run
