Installation

flowgate is the gateway you put in front of your coding agent so it can’t make moves you didn’t allow. Install the binary, then wire it into your editor (Claude Code, Cursor, or any MCP host).

Pick whichever method fits your setup. They all give you the mcp-flowgate gateway binary. The pre-built bundle also ships mcp-flowgate-plan — a deterministic critical-path-method (CPM) planning MCP server — alongside the gateway.

Pre-built binary (recommended)

Download the latest release for your platform from GitHub Releases. Each release includes a checksums.sha256 file so you can verify the download.

# Linux x86_64 example
curl -LO https://github.com/matt-cochran/mcp-flowgate/releases/latest/download/mcp-flowgate-x86_64-unknown-linux-gnu.tar.gz
curl -LO https://github.com/matt-cochran/mcp-flowgate/releases/latest/download/checksums.sha256

# Verify
sha256sum -c checksums.sha256 --ignore-missing

# Extract — the archive contains both binaries
tar xzf mcp-flowgate-*.tar.gz
./mcp-flowgate --help          # the gateway CLI
# ./mcp-flowgate-plan          # the bundled CPM planning MCP server (speaks MCP over stdio)

Available targets

Platform	Target
Linux x86_64	x86_64-unknown-linux-gnu
Linux ARM64	aarch64-unknown-linux-gnu
macOS Intel	x86_64-apple-darwin
macOS Apple Silicon	aarch64-apple-darwin
Windows x86_64	x86_64-pc-windows-msvc

Move the binary somewhere on your PATH (e.g., /usr/local/bin) and you’re set.

Cargo

If you have a Rust toolchain installed:

cargo install mcp-flowgate          # the gateway
cargo install mcp-flowgate-plan     # the CPM planning MCP server (optional)

This builds from source, so it takes a couple of minutes. The binaries land in ~/.cargo/bin/, which is usually already on your PATH.

Docker

docker run -v $(pwd)/gateway.yaml:/config/gateway.yaml ghcr.io/matt-cochran/mcp-flowgate

Mount your config file into /config/gateway.yaml and the container handles the rest. This works well for server deployments or if you want to try flowgate without installing anything locally.

Verify the installation

Whichever method you used, confirm it’s working:

mcp-flowgate --help

You should see the CLI help with the serve subcommand listed. That’s the install done — next, wire it into your editor.

Discovering commands

flowgate ships with a full clap-driven CLI. Beyond --help, the subcommands are discoverable per command:

mcp-flowgate help <subcommand>     # long-form description + example per command

Wire flowgate into your editor

This is the next step for almost everyone. Declare mcp-flowgate serve as an MCP server in your editor’s config and the model sees the two fixed tools (flowgate.query, flowgate.command) — every capability you route through the gateway now passes through its gates.

See Wire flowgate into your editor for the full per-editor walkthrough, then quick start to wire up your first guarded capability.

Optional: running flowgate as the loop

The same repo ships a terminal runtime — flowgate’s own chat TUI — where flowgate is the agent loop instead of sitting behind your editor. Most people installing the binary don’t need this first; it’s a different way to run, with tighter enforcement. See How to run it for the three modes and what each one enforces.

Optional: provider API keys

You only need these if you’re running the workflow runtime that calls an LLM directly — the gateway itself doesn’t need them. In that case, set ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, etc. in your shell rc or CI secrets and the LLM client picks them up. See Provider API keys for the supported variables.