Individual skill
apigee-agent-gateway-governance
Stands up an Apigee API proxy that a Google Cloud Agent Gateway calls as an ext-proc (Service Extension) callout on an agent's LLM traffic, to meter token usage per model, extract caller identity, and apply Model Armor prompt screening or a semantic cache. Use when wiring Apigee in as an AI gateway behind an Agent Gateway, when an agent's model egress needs governing, or when a callout proxy returns no verdict and you need to find out why. The distinguishing question is whether Apigee forwards the traffic or only inspects it: this skill is inspect-only, and builds the proxy itself. Don't use it when Apigee is meant to receive a request and route it onward to a backend — including hosting an MCP server behind Apigee — which needs a proxy with a target instead. Don't use for governing the agent's calls to tools or MCP servers. Don't use for choosing or switching which model a request goes to. Don't use for creating the Agent Gateway itself, nor for Apigee hybrid.
skills/cloud/apigee-agent-gateway-governance/SKILL.md
Source commit 496fbede89dac1faf0d180a936bfc472b6fbf886
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 23,517
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- google Repository topic
- googlecloud Repository topic
- skills Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesSKILL.mdcore · 26,736 bytesassets/apigee-agent-gateway-governance.example.yamlasset · 21,328 bytesassets/apigee-proxy-template.yamlasset · 9,575 bytesassets/authz-extension.example.yamlasset · 1,729 bytesassets/authz-policy.example.yamlasset · 2,105 bytesassets/feature-identity.yamlasset · 6,150 bytesassets/feature-model-armor.yamlasset · 3,562 bytesassets/feature-normalize.yamlasset · 4,131 bytesassets/feature-semantic-cache.yamlasset · 8,109 bytesassets/feature-token-enforce.yamlasset · 16,726 bytesassets/feature-token-metering.yamlasset · 15,242 bytesreferences/attribution.mddoc · 1,945 bytesreferences/gotchas.mddoc · 44,755 bytesreferences/modes.mddoc · 47,566 bytesreferences/networking-psc.mddoc · 10,244 bytesreferences/recipes.mddoc · 9,640 bytesreferences/setup.mddoc · 7,365 bytesreferences/verify.mddoc · 14,693 bytesscripts/assess_integration.shruns · 36,324 bytesscripts/compile_check.pyruns · 10,143 bytesscripts/deploy_proxy.shruns · 24,261 bytesscripts/ensure_apigee_environment.shruns · 18,249 bytesscripts/ensure_gateway_connectivity.shruns · 21,665 bytesscripts/ensure_vector_search.shruns · 19,407 bytesscripts/read_debug_session.shruns · 15,845 bytesscripts/teardown_vector_search.shruns · 9,242 bytes
Read excerpt
# Apigee as an Agent Gateway Service Extension
Wires an Apigee proxy in as an **ext-proc callout** on a GCP Agent Gateway. The
proxy is a **processor, not an API proxy**: it has no backend, inspects the LLM
request and response the gateway hands it, and returns a verdict.
## Usage Attribution
**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read and follow the instructions in
[Usage Attribution](references/attribution.md).
You build the proxy; the user does not.
