# sanketdhole/torana-gateway architecture

> Architecture diagram of the GitHub repository sanketdhole/torana-gateway, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sanketdhole/torana-gateway
- Repository: https://github.com/sanketdhole/torana-gateway

## Overview

Torana is an enterprise security gateway for AI-agent protocols and access to enterprise tools and assets. Its principal workflow accepts agent traffic through protocol-specific ingress, applies identity and policy controls, routes requests, and brokers access to upstream services; MCP requests additionally support tool discovery filtering and authorization. The repository also contains control-plane configuration, peer synchronization, plugin sandboxing, limits, and telemetry. The README documents broader A2A and gateway capabilities; sampled source confirms MCP authorization/forwarding, policy evaluation, and plugin lifecycle details, but not every runtime connection.

Main entry points: [`internal/pipeline/chain.go`](https://github.com/sanketdhole/torana-gateway/blob/main/internal/pipeline/chain.go) (Filter Pipeline), [`internal/egress/egress.go`](https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/egress.go) (Egress Broker), [`internal/plugins/manager/manager.go`](https://github.com/sanketdhole/torana-gateway/blob/main/internal/plugins/manager/manager.go) (Plugin Manager), [`internal/ingress/ingress.go`](https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/ingress.go) (HTTP and gRPC)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Gateway Runtime"]
  node_gateway["Gateway Entry<br/>[main.go]"]
  node_supervisor["Supervisor<br/>[supervisor.go]"]
  node_ingress["HTTP and gRPC<br/>[ingress.go]"]
  node_mcp["MCP Handler<br/>[handler.go]"]
  node_a2a["A2A Handler<br/>[handler.go]"]
  node_websocket["WebSocket Handler<br/>[handler.go]"]
  node_pipeline["Filter Pipeline<br/>[chain.go]"]
  node_router["Route Matching<br/>[router.go]"]
end

subgraph group_security["Security Controls"]
  node_authn["Identity Resolution<br/>[provider.go]"]
  node_authz["Policy Engine<br/>[engine.go]"]
  node_sts["Token Exchange<br/>[sts.go]"]
  node_limits["Usage Limits<br/>[limiter.go]"]
end

subgraph group_connectors["Upstream Access"]
  node_egress["Egress Broker<br/>[egress.go]"]
  node_mcpup["Remote MCP<br/>[client.go]"]
  node_httpgrpc["HTTP and gRPC<br/>[http.go]"]
  node_postgres["PostgreSQL<br/>[client.go]"]
  node_models["Model Providers<br/>[client.go]"]
end

subgraph group_management["Configuration and Peers"]
  node_control["Snapshot Client<br/>[client.go]"]
  node_config["Gateway Config<br/>[config.go]"]
  node_peers["Peer Mesh<br/>[manager.go]"]
end

subgraph group_extensions["Plugins and Observability"]
  node_pluginmgr["Plugin Manager<br/>[manager.go]"]
  node_wasm["WASM Runtime<br/>[manager.go]"]
  node_process["Process Plugins<br/>[manager.go]"]
  node_observe["Telemetry and Audit<br/>[observe.go]"]
end

node_agents(("Agent Clients"))
node_enterprise(("Enterprise Services"))
node_platform(("Control Plane"))

node_agents -->|"send requests"| node_ingress
node_gateway -->|"starts"| node_supervisor
node_supervisor -->|"serves traffic"| node_ingress
node_ingress -->|"passes requests"| node_pipeline
node_pipeline -->|"resolves identity"| node_authn
node_pipeline -->|"enforces policy"| node_authz
node_pipeline -->|"routes requests"| node_router
node_mcp -->|"authorizes tools"| node_authz
node_mcp -->|"forwards JSON-RPC"| node_mcpup
node_a2a -.->|"discovers agents"| node_peers
node_router -->|"selects upstream"| node_egress
node_egress -->|"dispatches MCP"| node_mcpup
node_egress -->|"dispatches calls"| node_httpgrpc
node_egress -->|"dispatches queries"| node_postgres
node_egress -->|"dispatches prompts"| node_models
node_platform -->|"sends snapshots"| node_control
node_control -->|"updates snapshot"| node_config
node_peers -->|"syncs snapshots"| node_peers
node_pluginmgr -->|"loads WASM"| node_wasm
node_pluginmgr -->|"registers plugins"| node_process
node_pipeline -.->|"runs filters"| node_pluginmgr
node_pipeline -.->|"checks usage"| node_limits
node_pipeline -.->|"emits telemetry"| node_observe
node_authz -->|"audits decisions"| node_observe
node_sts -.->|"issues delegated tokens"| node_agents
node_egress -->|"accesses assets"| node_enterprise

click node_gateway "https://github.com/sanketdhole/torana-gateway/blob/main/cmd/gateway-data/main.go"
click node_supervisor "https://github.com/sanketdhole/torana-gateway/blob/main/internal/supervisor/supervisor.go"
click node_ingress "https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/ingress.go"
click node_mcp "https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/mcp/handler.go"
click node_a2a "https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/a2a/handler.go"
click node_websocket "https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/ws/handler.go"
click node_pipeline "https://github.com/sanketdhole/torana-gateway/blob/main/internal/pipeline/chain.go"
click node_router "https://github.com/sanketdhole/torana-gateway/blob/main/internal/router/router.go"
click node_authn "https://github.com/sanketdhole/torana-gateway/blob/main/internal/security/authn/provider.go"
click node_authz "https://github.com/sanketdhole/torana-gateway/blob/main/internal/security/authz/engine.go"
click node_sts "https://github.com/sanketdhole/torana-gateway/blob/main/internal/security/sts/sts.go"
click node_limits "https://github.com/sanketdhole/torana-gateway/blob/main/internal/limits/limiter.go"
click node_egress "https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/egress.go"
click node_mcpup "https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/mcp/client.go"
click node_httpgrpc "https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/http/http.go"
click node_postgres "https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/postgres/client.go"
click node_models "https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/llm/client.go"
click node_control "https://github.com/sanketdhole/torana-gateway/blob/main/internal/controlplane/client.go"
click node_config "https://github.com/sanketdhole/torana-gateway/blob/main/internal/config/config.go"
click node_peers "https://github.com/sanketdhole/torana-gateway/blob/main/internal/peers/manager.go"
click node_pluginmgr "https://github.com/sanketdhole/torana-gateway/blob/main/internal/plugins/manager/manager.go"
click node_wasm "https://github.com/sanketdhole/torana-gateway/blob/main/internal/plugins/wasm/manager.go"
click node_process "https://github.com/sanketdhole/torana-gateway/blob/main/internal/plugins/process/manager.go"
click node_observe "https://github.com/sanketdhole/torana-gateway/blob/main/internal/observe/observe.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_gateway,node_supervisor,node_ingress,node_mcp,node_a2a,node_websocket,node_pipeline,node_router,node_agents toneBlue
class node_authn,node_authz,node_sts,node_limits toneAmber
class node_egress,node_mcpup,node_httpgrpc,node_postgres,node_models toneMint
class node_control,node_config,node_peers toneRose
class node_pluginmgr,node_wasm,node_process,node_observe,node_enterprise,node_platform toneIndigo
```

## Components

### Gateway Runtime

- [Gateway Entry](https://github.com/sanketdhole/torana-gateway/blob/main/cmd/gateway-data/main.go): `cmd/gateway-data/main.go`
- [Supervisor](https://github.com/sanketdhole/torana-gateway/blob/main/internal/supervisor/supervisor.go): `internal/supervisor/supervisor.go`
- [HTTP and gRPC](https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/ingress.go): `internal/ingress/ingress.go`
- [MCP Handler](https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/mcp/handler.go): `internal/ingress/mcp/handler.go`
- [A2A Handler](https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/a2a/handler.go): `internal/ingress/a2a/handler.go`
- [WebSocket Handler](https://github.com/sanketdhole/torana-gateway/blob/main/internal/ingress/ws/handler.go): `internal/ingress/ws/handler.go`
- [Filter Pipeline](https://github.com/sanketdhole/torana-gateway/blob/main/internal/pipeline/chain.go): `internal/pipeline/chain.go`
- [Route Matching](https://github.com/sanketdhole/torana-gateway/blob/main/internal/router/router.go): `internal/router/router.go`

### Security Controls

- [Identity Resolution](https://github.com/sanketdhole/torana-gateway/blob/main/internal/security/authn/provider.go): `internal/security/authn/provider.go`
- [Policy Engine](https://github.com/sanketdhole/torana-gateway/blob/main/internal/security/authz/engine.go): `internal/security/authz/engine.go`
- [Token Exchange](https://github.com/sanketdhole/torana-gateway/blob/main/internal/security/sts/sts.go): `internal/security/sts/sts.go`
- [Usage Limits](https://github.com/sanketdhole/torana-gateway/blob/main/internal/limits/limiter.go): `internal/limits/limiter.go`

### Upstream Access

- [Egress Broker](https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/egress.go): `internal/egress/egress.go`
- [Remote MCP](https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/mcp/client.go): `internal/egress/mcp/client.go`
- [HTTP and gRPC](https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/http/http.go): `internal/egress/http/http.go`
- [PostgreSQL](https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/postgres/client.go): `internal/egress/postgres/client.go`
- [Model Providers](https://github.com/sanketdhole/torana-gateway/blob/main/internal/egress/llm/client.go): `internal/egress/llm/client.go`

### Configuration and Peers

- [Snapshot Client](https://github.com/sanketdhole/torana-gateway/blob/main/internal/controlplane/client.go): `internal/controlplane/client.go`
- [Gateway Config](https://github.com/sanketdhole/torana-gateway/blob/main/internal/config/config.go): `internal/config/config.go`
- [Peer Mesh](https://github.com/sanketdhole/torana-gateway/blob/main/internal/peers/manager.go): `internal/peers/manager.go`

### Plugins and Observability

- [Plugin Manager](https://github.com/sanketdhole/torana-gateway/blob/main/internal/plugins/manager/manager.go): `internal/plugins/manager/manager.go`
- [WASM Runtime](https://github.com/sanketdhole/torana-gateway/blob/main/internal/plugins/wasm/manager.go): `internal/plugins/wasm/manager.go`
- [Process Plugins](https://github.com/sanketdhole/torana-gateway/blob/main/internal/plugins/process/manager.go): `internal/plugins/process/manager.go`
- [Telemetry and Audit](https://github.com/sanketdhole/torana-gateway/blob/main/internal/observe/observe.go): `internal/observe/observe.go`

### Other components

- **Agent Clients**
- **Enterprise Services**
- **Control Plane**

## Connections

- Agent Clients → HTTP and gRPC: send requests
- Gateway Entry → Supervisor: starts
- Supervisor → HTTP and gRPC: serves traffic
- HTTP and gRPC → Filter Pipeline: passes requests
- Filter Pipeline → Identity Resolution: resolves identity
- Filter Pipeline → Policy Engine: enforces policy
- Filter Pipeline → Route Matching: routes requests
- MCP Handler → Policy Engine: authorizes tools
- MCP Handler → Remote MCP: forwards JSON-RPC
- A2A Handler → Peer Mesh: discovers agents
- Route Matching → Egress Broker: selects upstream
- Egress Broker → Remote MCP: dispatches MCP
- Egress Broker → HTTP and gRPC: dispatches calls
- Egress Broker → PostgreSQL: dispatches queries
- Egress Broker → Model Providers: dispatches prompts
- Control Plane → Snapshot Client: sends snapshots
- Snapshot Client → Gateway Config: updates snapshot
- Peer Mesh → Peer Mesh: syncs snapshots
- Plugin Manager → WASM Runtime: loads WASM
- Plugin Manager → Process Plugins: registers plugins
- Filter Pipeline → Plugin Manager: runs filters
- Filter Pipeline → Usage Limits: checks usage
- Filter Pipeline → Telemetry and Audit: emits telemetry
- Policy Engine → Telemetry and Audit: audits decisions
- Token Exchange → Agent Clients: issues delegated tokens
- Egress Broker → Enterprise Services: accesses assets