# Gateway endpoints

Skimmable directory of every goose AgentGateway URL: what it does, where to
type it, and whether it needs Entra.

**Human page:** [goose.maniak.ai/gateways.html](https://goose.maniak.ai/gateways.html)

Worker `172.16.10.155`. All access is NodePort — LoadBalancers stay pending on
this bare-metal lab. Gateway class: `enterprise-agentgateway`.

> **Don’t mix these up.** Claude Desktop ≠ `:30398/anthropic`. Codex ≠
> `:30160/openai`. Grok Build ≠ `:31397/grok`. Dedicated client gateways take
> Entra JWT. The open paths are for kagent / curl.

Workshop deep-dive (features, CRDs, scenarios) stays on
[llm-gateway.html](https://goose.maniak.ai/llm-gateway.html). This page is the
URL directory only.

## Desktop / CLI clients (Entra JWT)

Dedicated Gateways, PathPrefix `/`, so the client’s `/v1/…` lands at the
NodePort root.

| Name | What it does | URL | Auth |
|------|--------------|-----|------|
| Claude Desktop | Claude Desktop → Anthropic | `http://127.0.0.1:18789/` | Entra JWT |
| Codex | Codex CLI → OpenAI Responses | `http://172.16.10.155:31928/v1` | Entra JWT |
| Grok Build | Grok Build → xAI Responses | `http://172.16.10.155:31918/v1` | Entra JWT |

Alts (not a fifth column):

- Claude Desktop: `scripts/claude-desktop-lab-proxy.py` → HTTP `:31938`. HTTPS `:31211`. Posts `/v1/messages`. [claude-desktop.html](https://goose.maniak.ai/claude-desktop.html)
- Codex: `base_url` **must end in `/v1`**. Loopback `:18790`. HTTPS `:31540`. Posts `/v1/responses`. [codex.html](https://goose.maniak.ai/codex.html)
- Grok Build: `base_url` **must end in `/v1`**. Loopback `:18791`. HTTPS `:31987`. Posts `/v1/responses`. [grok-build.html](https://goose.maniak.ai/grok-build.html)

## Open LLM paths (kagent / curl, no Entra)

| Name | What it does | URL | Auth |
|------|--------------|-----|------|
| OpenAI gpt-5.5 | kagent default model | `http://172.16.10.155:30160/openai` | open |
| xAI grok-4.5 | kagent grok | `http://172.16.10.155:31397/grok` | open |
| Anthropic claude-fable-5 | kagent claude | `http://172.16.10.155:30398/anthropic` | open |
| Gemini 2.5 Flash | kagent gemini | `http://172.16.10.155:32637/gemini` | open |
| Bedrock Sonnet 4.5 | dedicated Bedrock path | `http://172.16.10.155:30275/bedrock` | open |
| OpenAI gpt-5.6 | dedicated gpt-5.6 | `http://172.16.10.155:30536/gpt56` | open |
| DGX Spark Qwen3.8-27B (NVFP4) | local vLLM | `http://172.16.10.155:31944/spark` | open |

Alts:

- xAI unpinned: `http://172.16.10.155:31397/grok-flex`
- Anthropic unpinned: `http://172.16.10.155:30398/anthropic-flex`
- Bedrock is **not** on `:30160` (LB / failover demos are; the provider path is `:30275`)
- Spark upstream: `172.16.10.173:8000`

## Demos on the shared proxy (`:30160`)

All on `agentgateway-proxy`.

| Name | What it does | URL | Auth |
|------|--------------|-----|------|
| OpenAI flex | unpinned OpenAI | `http://172.16.10.155:30160/openai-flex` | open |
| LLM load balance | gpt-5.5 + grok-4.5 | `http://172.16.10.155:30160/llm-lb` | open |
| LLM failover | OpenAI → xAI → Anthropic | `http://172.16.10.155:30160/llm-failover` | open |
| Bedrock LB | Nova Pro + Lite + Llama | `http://172.16.10.155:30160/bedrock-lb` | open |
| Bedrock failover | Sonnet → Nova → Llama | `http://172.16.10.155:30160/bedrock-failover` | open |
| Route by model | body.model routing | `http://172.16.10.155:30160/route-by-model` | open |
| Embeddings | OpenAI embeddings | `http://172.16.10.155:30160/embeddings` | open |
| Guard demo | promptGuard | `http://172.16.10.155:30160/guard-demo` | open |
| Enrich demo | prompt enrichment | `http://172.16.10.155:30160/enrich-demo` | open |
| Token rate limit | token RL | `http://172.16.10.155:30160/token-rl` | open |
| WAF demo | WAF first-pass | `http://172.16.10.155:30160/waf-demo` | open |
| Secure OpenAI | Entra JWT on LLM | `http://172.16.10.155:30160/secure-openai` | Entra JWT |
| Virtual key | virtual key + team budget | `http://172.16.10.155:30160/vk-openai` | virtual key |
| Budget demo | budget 429 path | `http://172.16.10.155:30160/budget-demo` | open |

## MCP

Virtual MCP on `:31606`. GitHub elicit is a **different** Gateway — not `:30160`.

| Name | What it does | URL | Auth |
|------|--------------|-----|------|
| Virtual MCP | open federation | `http://172.16.10.155:31606/mcp` | open |
| MCP secure | Entra JWT + tool RBAC | `http://172.16.10.155:31606/mcp-secure` | Entra JWT |
| MCP RBAC | group-filtered catalog | `http://172.16.10.155:31606/mcp-rbac` | Entra JWT |
| GitHub MCP | shared PAT | `http://172.16.10.155:31606/github` | open |
| Drone MCP | Tello/RMTT tools | `http://172.16.10.155:31606/drone` | open |
| Composable | account-brief | `http://172.16.10.155:31606/composable` | open |
| OpenAPI MCP | Open-Meteo | `http://172.16.10.155:31606/openapi-mcp` | open |
| GitHub elicit | per-user STS elicit | `http://172.16.10.155:31025/github-elicit` | Entra JWT |
| AgentRegistry | published MCP | `http://172.16.10.155:32394/registry` | open |

Alts:

- Drone tool modes: `/drone-search` · `/drone-code` · `/drone-codesearch` (same `:31606`)
- Shared PAT GitHub stays on `:31606/github`. Elicit is `:31025/github-elicit`.

## Identity + kagent agents

On `:30160`.

| Name | What it does | URL | Auth |
|------|--------------|-----|------|
| Passthrough | Entra JWT as-is | `http://172.16.10.155:30160/identity/passthrough` | Entra JWT |
| Impersonate | STS mint, no act | `http://172.16.10.155:30160/identity/impersonate` | Entra JWT |
| Graph /me | Entra OBO → Graph | `http://172.16.10.155:30160/graph-me` | Entra JWT |
| Hello agent | A2A hello | `http://172.16.10.155:30160/agents/hello` | Entra JWT |
| K8s agent | A2A k8s | `http://172.16.10.155:30160/agents/k8s` | Entra JWT |
| GitHub agent | A2A github | `http://172.16.10.155:30160/agents/github` | Entra JWT |

Deep-dives: [identity.html](https://goose.maniak.ai/identity.html) ·
[kagent.html](https://goose.maniak.ai/kagent.html).

## Source

GitOps under `config/` via Argo `agentgateway-config`. Client / workshop pages:

- [claude-desktop.html](https://goose.maniak.ai/claude-desktop.html)
- [codex.html](https://goose.maniak.ai/codex.html)
- [grok-build.html](https://goose.maniak.ai/grok-build.html)
- [llm-gateway.html](https://goose.maniak.ai/llm-gateway.html)
- [mcp-gateway.html](https://goose.maniak.ai/mcp-gateway.html)
- [identity.html](https://goose.maniak.ai/identity.html)
- [kagent.html](https://goose.maniak.ai/kagent.html)

## Appendix — GitOps files

Not on the HTML page. Useful when you need the YAML.

| Group | Gateway / route files |
|-------|------------------------|
| Claude Desktop | `config/gateway/claude-desktop-gateway.yaml` · `config/routes/claude-desktop-route.yaml` |
| Codex | `config/gateway/codex-gateway.yaml` · `config/routes/codex-route.yaml` |
| Grok Build | `config/gateway/grok-build-gateway.yaml` · `config/routes/grok-build-route.yaml` |
| OpenAI / demos | `config/gateway/gateway.yaml` (`agentgateway-proxy`) · `config/routes/openai-route.yaml` · `openai-flex-route.yaml` · `llm-lb-route.yaml` · `llm-failover-route.yaml` · `bedrock-lb-route.yaml` · `bedrock-failover-route.yaml` · `body-model-route.yaml` · `embeddings-route.yaml` · `guard-demo-route.yaml` · `enrich-demo-route.yaml` · `token-rl-route.yaml` · `waf-demo-route.yaml` · `secure-openai-route.yaml` · `openai-vk-route.yaml` · `budget-demo-route.yaml` |
| xAI | `config/gateway/xai-grok-gateway.yaml` · `config/routes/xai-grok-route.yaml` · `xai-flex-route.yaml` |
| Anthropic | `config/gateway/anthropic-claude-gateway.yaml` · `config/routes/anthropic-claude-route.yaml` · `anthropic-flex-route.yaml` |
| Gemini | `config/gateway/google-gemini-gateway.yaml` · `config/routes/google-gemini-route.yaml` |
| Bedrock | `config/gateway/bedrock-gateway.yaml` · `config/routes/bedrock-route.yaml` |
| gpt-5.6 | `config/gateway/gpt-5-6-gateway.yaml` · `config/routes/openai-gpt-5-6-route.yaml` |
| Spark | `config/gateway/dgx-spark-gateway.yaml` · `config/routes/dgx-spark-llm-route.yaml` |
| MCP | `config/gateway/virtual-mcp-gateway.yaml` · `config/routes/mcp-route.yaml` · `mcp-secure-route.yaml` · `mcp-rbac-route.yaml` · `github-mcp-route.yaml` · `drone-mcp-route.yaml` · `composable-mcp-route.yaml` · `openapi-mcp-route.yaml` |
| GitHub elicit | `config/gateway/agentgateway-elicit.yaml` · `config/routes/github-mcp-elicit-route.yaml` |
| AgentRegistry MCP | `config/gateway/agentregistry-mcp-gateway.yaml` · `config/routes/agentregistry-mcp-delegate.yaml` |
| Identity | `config/routes/identity-hops-routes.yaml` · `config/routes/graph-me-mcp-route.yaml` |
| kagent agents | `config/kagent-access/httproute-agents.yaml` |