Skip to main content

Ambit documentation

Ambit is the AI access layer for enterprises.

Ambit is a self-hosted gateway, built on agentgateway, ToolHive and other open-source projects, that controls a company's use of AI. It decides who may use which AI models and which work apps (through MCP), sets spending limits, keeps an audit record, and removes access when someone leaves the company.

agentgateway handles the traffic and ToolHive runs the MCP servers. Ambit adds identity-provider access rules, a console, per-person app sign-in, budgets, audit and offboarding, in one Helm chart.

Why Ambit​

Without Ambit: Alice, Dan and Bob share one team API key and call models directly, an AI agent reaches work apps through a shared service account, Bob’s key still works after he left, there is no record and the cost appears on next month’s bill. With Ambit: everyone passes the Ambit gateway, which checks who they are, what they may use and their daily limit, records every call, and refuses Bob. Without Ambit: Alice, Dan and Bob share one team API key and call models directly, an AI agent reaches work apps through a shared service account, Bob’s key still works after he left, there is no record and the cost appears on next month’s bill. With Ambit: everyone passes the Ambit gateway, which checks who they are, what they may use and their daily limit, records every call, and refuses Bob.

Without AmbitWith Ambit
Each team shares one provider API key, copied into scripts and laptops.People sign in, or use a personal API key. Provider keys stay inside Ambit.
Anyone who has the key can use any model.Access rules based on your identity provider's groups decide which models and MCP servers each team may use.
AI agents connect to work apps on their own, often through one shared service account.Every MCP call passes one gateway. People connect their own app accounts, tools are checked, and personal data in results is masked.
The cost shows up on next month's bill.Daily limits per group and per person, in requests or in dollars.
Nobody can say who sent what to which model.Every call is recorded, refusals included. Model refusals do not yet show who made them (an agentgateway bug; see Known limitations).
Someone leaves, and their keys work until someone remembers to rotate them.The identity provider disables them, and their keys, sessions and app sign-ins stop at once.

Architecture​

Request path: clients call one Ambit gateway, built on agentgateway, which checks the caller and their access, asks the budget service, guard, token broker and router as needed, then forwards to AI models or MCP servers and sends audit records through the OpenTelemetry Collector to ClickHouse. Setup: your identity provider signs people in through Dex and reports leavers to the console by SCIM; admins use the console, which stores Ambit objects; ambit-controller turns them into gateway configuration. Request path: clients call one Ambit gateway, built on agentgateway, which checks the caller and their access, asks the budget service, guard, token broker and router as needed, then forwards to AI models or MCP servers and sends audit records through the OpenTelemetry Collector to ClickHouse. Setup: your identity provider signs people in through Dex and reports leavers to the console by SCIM; admins use the console, which stores Ambit objects; ambit-controller turns them into gateway configuration.

Blue is the path every request takes; grey is how admins and your identity provider set things up.

Status: Alpha​

Ambit is pre-1.0. The API is ambitproject.dev/v1alpha1 and can change between releases.

TestedNot tested yet
Install and all features on kind, in CI on every pull requestAzure OpenAI, Amazon Bedrock and Vertex AI with real cloud accounts
Company sign-in through a test Keycloak, external ClickHouse and Valkey, GitOps with Argo CDA 24-hour soak test (CI runs a 5-minute soak)

Known limitations​

When the model router refuses a request (status 403 or 404), Ambit records the refusal but not who made it. This is a bug in agentgateway v1.6.0, which answers before it takes the request snapshot that holds the caller's identity. A fix is being reported to agentgateway.

When not to use Ambit​

  • You need a hosted service. Ambit runs only in your Kubernetes cluster.
  • You do not run Kubernetes. Ambit is installed with Helm and has no other install method.
  • You need a stable API today. Wait for a release after v1alpha1.
  • You need one proxy for a single team or one provider. A plain proxy is simpler.

Next steps​