A gateway only governs the calls that reach it
Hosted Gateway can flag or block a routed tool call. An agent that still has the upstream URL and credential never presents that call for a decision.
The policy never saw the request
A team puts Foo Guard between an MCP client and a tool server, writes an allowlist, and turns on Enforcement. A week later the tool server logs show calls that never appear in Gateway history.
The agent still had the upstream address. The gateway is not on that path, so the allowlist never runs. The control you configured and the traffic the agent sent are two different systems until you close the direct route.
One tool call routed through Gateway and one sent directly to the tool server
Monitoring and enforcement are different promises
Gateway checks each routed tool call against the policy you reviewed. The decision is deterministic. A model does not allow, flag, or block the call.
Monitoring records policy violations and still forwards them, so you can see what agents attempt. Enforcement stops the violating call before it is sent. Invalid credentials, discovery failures, and capacity limits stop forwarding in both modes. Monitoring is not a fail-open back door for those failures.
Pro includes one personal monitored connection and flags violations rather than enforcing them. Team workspaces can share administration, deny rules, and enforcement. The hosted beta expects a public HTTPS tool server on the default port.
History is a decision record, not a transcript
Request history keeps the workspace, agent, tool name, decision, rule, policy, mode, and outcome. It does not keep arguments, responses, or credentials. You can investigate which tool was attempted and how Gateway classified it. You cannot reconstruct the prompt or the tool result from that row.
That limit is deliberate. It also means Gateway is the wrong place to look for a full audit of what the tool server returned. The row answers whether the routed call was allowed to proceed.
Close the path around the proxy
Point the agent at the Gateway URL and credential. Then remove the agent’s direct route to the upstream, including any copy of the upstream secret that still sits in a local MCP config.
Scan that config as well. A static scan shows the servers and permissions the file declares. Gateway shows what happened to calls that actually arrived. Neither one substitutes for the other, and neither one sees a call that went somewhere else.