Skillgate: OpenAPI to Governed Agent Skills

Author: HazelJS Team

Skillgate turns selected OpenAPI / REST endpoints into curated, governed agent skills — then registers them on Agent OS (ToolRegistry / AgentRuntime) or exports them to MCP. It is a gate, not a magic “learn every API” brain.

Works with any OpenAPI-like document. HazelJS fromModule + @AgentSkill is optional when controllers live in a Hazel app.

---

The problem

Dumping every CRUD route into an LLM tool list produces:

• Tool explosion (models pick poorly past ~12 tools)
• Accidental DELETE / admin calls
• Writes without human approval

Skillgate flips the default: opt-in surface, classify, harden, register.

---

60-second path

import { Skillgate } from '@hazeljs/skillgate';
import { ToolRegistry } from '@hazeljs/agent';

const gate = Skillgate.fromOpenApi(spec, {
  include: { tags: ['agent'] },
  classify: { writeRequiresApproval: true },
  invoke: {
    baseUrl: 'http://127.0.0.1:3000',
    headers: { Authorization: 'Bearer ${API_TOKEN}' },
  },
});

const registry = new ToolRegistry();
gate.register(registry, 'api-concierge');
console.log(gate.report());

CLI preview:

hazel skillgate from-openapi ./openapi.json
hazel skillgate init

---

Safety defaults

Class	Default
GET / HEAD	readOnly, no approval
POST / PUT / PATCH	requiresApproval
DELETE	denied unless allowDestructive
/admin, /internal, health	denied unless allowAdmin
Tool count	warn > 12, fail > 24 (force to override)

---

Agent OS + Gamma

Skillgate decides which skills exist. Agent OS runs the think loop. Gamma makes HITL and runs durable with SQL stores and worker leases.

Together: governed REST skills + crash-safe agent processes.

---

Starter

hazeljs-skillgate-agent-starter — Meridian Commerce ops concierge: REST → Skillgate → agent chat + MCP entrypoint.

---

Learn more

• Skillgate comprehensive guide
• Skillgate package
• What is an Agent OS?
• Agent OS Gamma
• MCP package
• vs NestJS + LangChain

Apache-2.0 · curate the surface, then let Agent OS run the loop.