AI 服務暫時不可用，以下為來源正文，待恢復後補全翻譯。
Apache-2.0 · one Go binary · no server-held key Every agent call, through a door you own. Zerker sits in front of your agent traffic and turns raw calls — plain HTTP or MCP — into something you can catalog, route, guard, watch, and charge for. You run it. It never holds a key. $ git clone https://github.com/zerkerlabs/gateway.git $ cd gateway && make dev-auth Quickstart → Watch a request No signup. No account. Nothing phones home. ingress → gateway → upstream simulated forwarded 0 402 held 0 guard blocked 0 The wire One request. Six checkpoints. Nothing skipped. A call enters the gateway and leaves as an invocation record. Every stage below is enforced in-process, at request time — not configured once and trusted forever. Authenticate The gateway refuses to start without an OIDC issuer and audience. Not a warning — the process exits. $ ZERKER_OIDC_ISSUER= make run fatal: OIDC issuer and audience are required There is no bypass flag and no dev-mode shortcut in the binary. Local development gets a throwaway mock issuer instead, booted by make dev-auth. Sovereignty Two things a hosted gateway structurally can't give you. Not features someone else will ship next quarter — consequences of where the software runs and who holds the key. It runs where you run One binary, one process, your hardware. On-prem, inside your own VPC, or air-gapped. No JVM, no Python runtime, no sidecar, no agent to install next to it. Back it with Postgres when you want agents to survive a restart. It never holds your key Verify is not custody. The payment gate checks that a valid authorization exists before it forwards a call. It does not hold a private key to do that. If you later want to actually settle on-chain, you run the facilitator yourself — with your own gas key, on your own hardware. Your infrastructure ⚿ signing key → Someone else's cloud ⚿ signing key The key never leaves. Zerker verifies the authorization a caller presents and forwards, or doesn't. Nothing to hand over, nothing to breach. Self-host it. Charge for it. Hold no keys. Nobody else does all three. ContextForge and Lunar self-host but can't charge for a call. Cloudflare charges but cannot be self-hosted. MCPay does both — in TypeScript, with settlement delegated to a facilitator service. That's the whole field, and we show our working: vs MCPay, vs Cloudflare, vs ContextForge. Payment required What's free, and what isn't. We put the answer behind the exact mechanism this page is selling. Present a payment authorization to read it. (It's a demo. Nothing is charged, and there is no wallet involved.) HTTP/1.1 402 Payment Required GET /pricing X-Payment-Required: x402 scheme: exact network: base amount: 0.00 USDC (demo) resource: /pricing ⌁ withheld pending payment the gateway is holding this response OSS verifies and captures. Commercial collects, bills, and governs. Capability Tier Gateway, catalog, MCP transport, proxy, auth, SSRF, per-tenant credential isolation OSS The x402 payment gate — verify an authorization before forwarding OSS Raw invocation and payment capture, readable over the API OSS Self-hosting a facilitator — the /settle server OSS Settlement and collection, fee modes, a managed facilitator Commercial Usage and revenue dashboard, quotas, spend limits, invoicing Commercial Multi-tenant control plane and governance Commercial The full boundary → That gate you just walked through is the open-source half, and so is the settle server behind it — you can run the whole path yourself. What we sell is not permission to take money. It's not having to run the part that holds the key. Run it Up in one command. Yours in two. Local development boots a throwaway mock issuer alongside the gateway and writes you a bearer token. Production points at your own IdP — Auth0, Okta, Google, whatever you already run. The stack One of three parts. Each useful alone. Zerker carries the traffic. The other two carry the trust and the memory. Zerker The gateway in front of agent traffic — routing, policy, observability, payment metering. Treeship ↗ Portable trust receipts for agent work. Zmem ↗ Verifiable memory for agents.