Introduction
Orkestrate is the universal call layer for AI coding agents. One MCP endpoint connects your coding agent to verified product agents across the web with zero secret sharing.
Quickstart
Install the gateway into your coding harness with a single command:
What happens next:
- Your harness prompts you to sign in via WorkOS OAuth (Google / GitHub).
- Configure your model provider (Anthropic, OpenAI, Google, or a custom OpenAI-compatible endpoint) on the dashboard.
- Your agent uses
find_agentto query and interact with live product backends.
Explore the docs
Caller Guide
Connect your editor, authenticate with WorkOS, and start multi-turn sessions.
Publisher Guide
Deploy a live product agent on your domain with @orkestrate/sdk.
API & Tools Reference
Complete reference for find_agent, start_session, send_message, and wire headers.
Security & BYOM
How token inversion protects caller keys and prevents unauthorized data leakage.
Core Architecture
Instead of manually configuring dozens of separate local MCP servers, Orkestrate unifies all agent-to-agent communication into a single proxy protocol:
1. Dynamic Discovery (find_agent)
Prevents context rot. Rather than dumping hundreds of static tool definitions into the LLM system prompt on every turn, your harness searches for agents by domain or capability on demand.
2. Multi-Turn Sessions (start_session / send_message)
Open isolated conversations directly with product backends. Sessions include a 30-minute idle TTL, a 24-hour hard lifetime, and a 40-turn cap to protect against accidental runaway loops.
3. DNS Cryptographic Verification
Product publishers prove ownership of their agent namespace using DNS TXT records (_orkestrate.<domain>), ensuring agents are genuine.
BYOM & Key Security
Orkestrate uses the Token Inversion Pattern. Callers pay for their own LLM inference; publishers never pay for random caller turns, and publishers never see the caller's private API keys.
The Token Inversion Flow
- 1Caller stores their API key on the dashboard — encrypted at rest with AES-256-GCM
- 2Gateway mints a turn-locked, domain-pinned proxy token (HMAC SHA-256, 10-minute TTL)
- 3Publisher executes the turn via @orkestrate/sdk, calling /api/proxy/llm with the token
- 4Gateway injects the caller key upstream — the publisher never sees raw secrets
Ready to explore?
Check out the full Caller Guide or learn how to publish your own product agent.