stoa

STOA
The open-source Agent Gateway for governed AI-to-API traffic
Keep your gateway. Add MCP. Govern every agent call.

Website · Docs · Discussions · Discord · Status

APIs are becoming AI tools. Who governs the calls?

AI agents are starting to call internal systems: billing, CRM, identity, logistics, support, legacy SOAP services, and private REST APIs.

The hard part is not only making an API callable by an agent. The hard part is answering:

Which agent called which API, under which identity, through which policy, with which quota, and with what audit trail?

STOA is an open-source Agent Gateway that sits next to your existing API gateway and exposes enterprise APIs as governed Model Context Protocol (MCP) tools.

No gateway replacement. No duplicated API catalog. No untracked agent traffic.

What you can do with STOA

Quick start

Run the full local stack with Docker Compose.

# Clone
git clone https://github.com/stoa-platform/stoa.git
cd stoa/deploy/docker-compose

# Start the demo stack
cp .env.example .env
docker compose up -d

# Wait for services to become healthy
../../scripts/demo/check-health.sh --wait

# Seed demo data
../../scripts/demo/seed-all.sh --skip-traffic

Open http://localhost and log in with:

username: halliday
password: readyplayerone

For local component-by-component development, see DEVELOPMENT.md.

From API to agent tool in 3 steps

graph LR
  A[Import or define an API] --> B[Attach auth, quotas, policies]
  B --> C[Publish REST + MCP]
  C --> D[Agents discover tools]
  C --> E[Humans keep using REST]
  D --> F[Audit, metrics, traces]
  E --> F

1. Define once — import OpenAPI or describe the API through STOA's Universal API Contract.
2. Govern once — attach identity, plans, rate limits, scopes, and tenant policies.
3. Expose everywhere — publish for human developers through REST and for AI agents through MCP.

Why teams choose STOA

MCP-native, not MCP as an afterthought

STOA is built for AI agents that need to discover and call enterprise APIs safely. Agents connect through MCP; platform teams keep control over identity, authorization, rate limiting, and audit.

Sidecar by design

STOA does not force a big-bang gateway migration. Existing REST traffic continues through your current gateway while STOA adds a governed MCP path for agents.

Open source and self-hostable

The core platform is Apache 2.0. Run it locally, in Kubernetes, on-premise, or in a hybrid setup. Fork it, inspect it, extend it, or contribute back.

Built for European and regulated environments

STOA is designed for teams that care about sovereignty, auditability, data residency, and operational control. It supports self-hosted deployments and keeps governance close to your infrastructure.

Architecture

                         STOA Control Plane
        ┌──────────────────────────────────────────────────┐
        │ Console · Portal · Control Plane API · Keycloak  │
        │ Observability · Tenants · Subscriptions · Audit  │
        └───────────────────────┬──────────────────────────┘
                                │ sync
             ┌──────────────────┴──────────────────┐
             │                                     │
             ▼                                     ▼
┌──────────────────────────┐        ┌─────────────────────────────┐
│ STOA Agent Gateway       │        │ Existing API Gateway         │
│ Rust · MCP · REST bridge │        │ Kong · Gravitee · Apigee     │
│ OAuth · mTLS · quotas    │        │ Azure APIM · AWS · webMethods│
│ Tool discovery · audit   │        │ Existing REST clients stay   │
└─────────────┬────────────┘        └──────────────┬──────────────┘
              │                                    │
              ▼                                    ▼
       AI agents via MCP                    Existing backends

Core idea: STOA adds a governed agent layer without taking ownership of your whole API estate.

Platform capabilities

Demo scenarios

After seeding the demo stack, try these flows:

Who is STOA for?

Platform teams who already run API gateways and want an AI agent layer without replacing their infrastructure.

Integration teams modernizing legacy REST, SOAP, and webMethods APIs for agentic workflows.

AI teams that need real enterprise tools, not toy demos, with authentication, quotas, and audit from day one.

Open-source builders who believe the agentic web needs inspectable, self-hostable, standards-based infrastructure.

Under the hood

Quality and security

STOA is built as infrastructure, not a demo script.

See SECURITY.md, CONTRIBUTING.md, and docs/ for details.

Deploying STOA

Docker Compose

Use Docker Compose for local demos, development, and evaluation.

cd deploy/docker-compose
cp .env.example .env
docker compose up -d

See deploy/docker-compose/README.md.

Kubernetes

Use Helm for Kubernetes deployments.

helm install stoa-platform ./charts/stoa-platform \
  -n stoa-system --create-namespace \
  -f charts/stoa-platform/values.yaml

See the deployment documentation for production and hybrid environments.

Repository map

stoa/
├── control-plane-api/       # FastAPI backend
├── control-plane-ui/        # React admin console
├── portal/                  # React developer portal
├── stoa-gateway/            # Rust gateway + MCP bridge
├── stoa-go/                 # Go CLI and connect agent
├── stoa-operator/           # Kubernetes operator
├── charts/                  # Helm chart and CRDs
├── deploy/docker-compose/   # Local quick start
├── e2e/                     # Playwright BDD tests
├── scripts/                 # Demo, seed, benchmarks
└── docs/                    # Runbooks, ADRs, methodology

Contributing

STOA is early, open, and looking for builders who care about making AI-to-API traffic safe, observable, and self-hostable.

Great places to contribute:

• Gateway adapters — Kong, Gravitee, Apigee, Azure APIM, AWS API Gateway, webMethods, and more.
• MCP examples — agent clients, tool definitions, demo workflows, Claude/Cursor integrations.
• Security hardening — OAuth, mTLS, RBAC, policy evaluation, audit, threat modeling.
• Observability — dashboards, traces, error snapshots, benchmark scenarios.
• Docs and tutorials — quick starts, migration guides, architecture notes, real-world examples.
• Developer experience — stoactl, local setup, test ergonomics, CI, Helm values.

Start with CONTRIBUTING.md, open an issue, or join the community on Discord.

Documentation and community

Related repositories

License

STOA is released under the Apache License 2.0.

Built by CAB Ingénierie — Paris, France.