diff --git a/agent/agent.go b/agent/agent.go
index 4deb5611..9b1b23e1 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -1,6 +1,8 @@
 package agent
 
 import (
+	"context"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/openziti/zrok/agent/agentGrpc"
 	"github.com/openziti/zrok/agent/proctree"
 	"github.com/openziti/zrok/environment/env_core"
@@ -8,7 +10,9 @@ import (
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
 	"net"
+	"net/http"
 	"os"
 )
 
@@ -44,7 +48,6 @@ func (a *Agent) Run() error {
 	if err := proctree.Init("zrok Agent"); err != nil {
 		return err
 	}
-	go a.manager()
 
 	agentSocket, err := a.root.AgentSocket()
 	if err != nil {
@@ -56,6 +59,9 @@ func (a *Agent) Run() error {
 	}
 	a.agentSocket = agentSocket
 
+	go a.manager()
+	go a.gateway()
+
 	srv := grpc.NewServer()
 	agentGrpc.RegisterAgentServer(srv, &agentGrpcImpl{agent: a})
 	if err := srv.Serve(l); err != nil {
@@ -81,6 +87,23 @@ func (a *Agent) Shutdown() {
 	}
 }
 
+func (a *Agent) gateway() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	mux := runtime.NewServeMux()
+	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
+	endpoint := "unix:" + a.agentSocket
+	logrus.Infof("endpoint: %v", endpoint)
+	if err := agentGrpc.RegisterAgentHandlerFromEndpoint(ctx, mux, "unix:"+a.agentSocket, opts); err != nil {
+		logrus.Fatalf("unable to register gateway: %v", err)
+	}
+
+	if err := http.ListenAndServe(":8888", mux); err != nil {
+		logrus.Error(err)
+	}
+}
+
 func (a *Agent) manager() {
 	logrus.Info("started")
 	defer logrus.Warn("exited")