Skip to content
Get packs

Guide · Agent skill

How to use the Apigee Agent Gateway Governance agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the apigee-agent-gateway-governance agent skill, a skill for Claude that teaches an AI agent to build an Apigee proxy sitting beside a Google Cloud Agent Gateway. The proxy inspects each LLM request and response the gateway sends it and returns a verdict, without forwarding traffic to a backend. By the end you will know what the skill does, how to install it, how to phrase requests that trigger it, and what safety checks to keep in place.

Apigee Agent Gateway Governancegoogle/skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from the listing page and unzip it into ~/.claude/skills/ or the project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills.
  2. 2Confirm your tools. Check the gcloud version and install the Python packages listed in the skill's requirements.
  3. 3Describe the outcome. Ask for the governance you need in plain language, such as metering tokens per model or adding identity to model calls.
  4. 4Compile-check the template. Run the compile check on the proxy template to confirm it is valid before deploying.
  5. 5Review the plan. Run the deployment script without --yes, read the plan, and check every yellow ACTION row.
  6. 6Deploy after approval. Re-run the deployment script with --yes once you agree, then confirm the deployment comes up EXTENSIBLE.

What an agent skill is and what this one makes the agent do

An agent skill is a folder of instructions, reference notes, templates and scripts that an AI agent loads when a task matches the skill's description. This skill covers one job: putting Apigee in front of an agent's model traffic as a processor, so you can meter token use per model, extract caller identity, and apply Model Armor prompt screening or a semantic cache.

The proxy is a processor, not an ordinary API proxy. It has no backend and does not route requests onward. The skill is inspect-only by design.

  • Meters token use per model
  • Extracts caller identity
  • Applies Model Armor prompt screening or a semantic cache
  • Generates the proxy from a template and runs deployment scripts
  • Presents a planning and approval step before changes

Install the skill: download, unzip, or upload

Download the ZIP of the skill from the listing page. Then choose one of two routes. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

  • Personal: unzip into ~/.claude/skills/
  • Project only: unzip into .claude/skills/ inside the project
  • Claude apps: Settings → Capabilities → Skills, then upload

Check the requirements before you ask for anything

The skill assumes you already run a working Google Cloud Agent Gateway and a working agent. It needs a Google Cloud project with Apigee and Agent Gateway, and an Agent Runtime agent bound to the gateway. Use the minimum gcloud version listed in the skill's SKILL.md and check it first.

You also need Python 3 with PyYAML, the Agent Runtime client, and google-adk if you build a test agent. Bash is needed to run the deployment script. Run the commands below to confirm your tools and install the Python packages. The skill's own scripts need network access and do run.

  • Google Cloud SDK (gcloud) at the minimum version in SKILL.md
  • Python 3 with PyYAML
  • google-cloud-aiplatform[agent_engines,adk] and, for a test agent, google-adk
  • A Google Cloud project with Apigee and Agent Gateway
  • An Agent Runtime agent bound to the gateway
  • Bash shell for the deployment script
gcloud version | head -1 gcloud components update pip install "google-cloud-aiplatform[agent_engines,adk]>=2.1,<3" "google-adk>=2.9,<3"

Trigger the skill with plain requests

You do not need to name the skill. Describe the outcome in plain language and the agent will match it against the skill's description. The skill also says when not to use it, so state clearly whether Apigee should inspect traffic or route it to a backend.

Requests that fit the skill describe governing model traffic. Requests that do not fit describe routing to a backend, hosting an MCP server behind Apigee, switching which model a request goes to, governing tool or MCP calls, Apigee hybrid, or creating the Agent Gateway itself.

  • 'Wire Apigee in as an AI gateway behind my Agent Gateway and meter tokens per model.'
  • 'Add caller identity and Model Armor prompt screening to my agent's LLM traffic through Apigee.'
  • 'My Apigee callout proxy returns no verdict. Find out why.'
  • 'Set up the Apigee proxy for model egress on my existing Agent Gateway, with a plan first.'

Review the plan and approve before anything changes

The skill works in two modes. If you supply an input file, it treats that file as the contract and refuses to guess missing values. If you describe an outcome without a file, it applies documented defaults, shows a plan with durations, and asks for approval. In that case it starts with identity and metering only and writes an apigee-agent-gateway-governance.yaml handoff file at the end.

In the plan, a yellow ACTION entry means a resource you already own will be changed. Read that row carefully before you approve it.

The deployment script prints the plan without changing anything when you omit --yes. Review it, then run it again with --yes only when you agree.

  • Without --yes, the script only prints the plan
  • Yellow ACTION rows change resources you already own
  • Do not hand-edit the generated proxy; regenerate it from the template
python3 scripts/compile_check.py assets/apigee-proxy-template.yaml scripts/deploy_proxy.sh --org "$ORG" --env "$ENV" --proxy "$PROXY" --template assets/apigee-proxy-template.yaml [--service-account "$SA"] --yes

Avoid the two failures that fail silently

Set GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES to False in the agent's env_vars. Without it, every invocation returns 401 on the agent's own sessions.create, before your code runs.

Keep the environment hosting the proxy in exactly one envgroup. If it is attached to more than one, every agent request returns 404 once you attach the AuthzPolicy, and the extension is never invoked. Keep every feature's uid and never declare endpoints or targets in the template. Removing these still compiles and deploys but reports nothing.

  • Set GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES to False in env_vars
  • Attach the proxy environment to exactly one envgroup
  • Keep each feature's uid; never declare endpoints or targets

What people use it for

  • Metering token use per model for an agent that calls several LLMs
  • Recording caller identity on every model call made through an Agent Gateway
  • Screening prompts with Model Armor before they reach the model
  • Debugging a callout proxy that returns no verdict

Frequently asked questions

Is the apigee-agent-gateway-governance skill free?

The skill is published under the Apache-2.0 licence. Running it creates and changes Google Cloud resources, which are billed under your own Google Cloud account; the skill's source does not give prices, so check Google Cloud's pricing pages.

What do I need before I can use this skill?

You need a working Google Cloud Agent Gateway, a project with Apigee and Agent Gateway, and an Agent Runtime agent bound to the gateway. You also need gcloud, Python 3 with PyYAML and the Agent Runtime client, and a Bash shell.

How do I install the skill in Claude?

Download the ZIP from the listing page and unzip it into ~/.claude/skills/ for personal use or .claude/skills/ inside a project. In the Claude apps, you can instead upload it under Settings, Capabilities, Skills.

Can this skill route requests to a backend or host an MCP server?

No. The proxy is inspect-only and has no backend. For routing a request to a backend, or hosting an MCP server behind Apigee, you need an Apigee proxy with a target instead.

Why does my Apigee callout proxy return no verdict?

Start with the environment: it must be attached to exactly one envgroup. Then check that the agent's env_vars sets GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES to False, since missing it causes 401 errors on every call.

Does the skill change anything without my permission?

The deployment script changes nothing unless you pass --yes, and the skill shows a plan first. The connectivity script changes an existing gateway resource only with --yes too, so review any yellow ACTION rows before approving.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you already run a Google Cloud Agent Gateway and need to meter, identify, or screen agent-to-LLM traffic with Apigee in an inspect-only design. Pick something else if you need Apigee to route requests to a backend, host an MCP server, govern tool calls, or set up the Agent Gateway or Apigee hybrid itself.

Download the skill