Self-hosted MCP governance
Register tool servers once, keep upstream credentials at the gateway, and give each person only the tools and actions they need. Every request is checked at POST /mcp, and tool calls are audited by default.
verified
exact grant
routed
The boundary agents were missing
MCP clients should not each become their own identity store, secret vault, access-control system, and audit boundary. Put those decisions at one server-side control plane instead.
Without a gateway
With MCP Gateway
The request path
Scroll to advance ↓
Register a backend server and discover its namespaced MCP tools.
Grant products or individual tools and choose read, write, or both.
Point a compatible IDE, desktop agent, CLI, or CI worker at one endpoint.
Validate identity, entitlement, health, grant, scope, and safety policy.
Record tool calls, monitor health, and remove access centrally.
Interactive sample
Type anything below. The sample gateway picks a connector, checks policy, and returns a routed result — a local, faked trace, not a live backend call.
A real control plane
Deterministic authorization stays first. Credential brokering, human approval, screening, discovery, and evidence add depth where the operation requires it.
Store backend secrets encrypted or connect provider OAuth accounts. Short-lived credentials can be injected only when an approved tool call needs them.
Every tools/list and tools/call path rechecks the acting identity, enabled source, entitlement, grant, and read/write scope.
Configured destructive actions can require a fresh code, URL-mode elicitation, or a single-use browser approval bound to that exact request.
Tool-call audit records, server health, optional SIEM streaming, and OpenTelemetry make the gateway the shared operational context.
Inspect the controls
The default auth mode requires a scoped gateway token and a browser-approved OAuth grant for the same user. Headless deployments can deliberately choose API Key mode instead.
Read the security overviewUnresolved organization context returns no tenant data. A request that cannot prove which tenant it belongs to is refused rather than answered from a default.
Configured outbound endpoints are resolved and checked before use, so a registered server address cannot be turned into a path into your internal network.
Organizations can require MFA more broadly, but administrators cannot opt out of it for themselves.
Gateway tokens are one-way hashed and stored upstream secrets are encrypted, so credentials are never returned into a model conversation.
Successful, denied, and failed calls share one redacted evidence path, so the record does not depend on the outcome being a happy one.
Browser approval is single-use, identity-bound, and tied to the redacted arguments of that exact request. It cannot be replayed against a different call.
Transparent direction
Public prices are display-only today: paid Stripe plans and self-service checkout are not yet configured in this gateway.
One front door for your MCP fleet
Keep client setup simple without giving up exact access, server-side credentials, human control, or operational evidence.