Connect member accounts and MCP capabilities

All Gateway guides

Each member connects their account (Team beta)

For a server that accepts member OAuth tokens, an owner or administrator chooses Each member connects their account under Connection. Register an OAuth application with the provider using https://fooguard.com/api/gateway/account/callback (or the same path on your own Foo Guard origin). Enter the authorization URL, token URL, client ID, client secret, and space-separated scopes. The optional account profile URL supplies a display label only; it never establishes workspace membership.

Save the proposed settings, connect your own provider account, then discover tools, review the selection, and activate. Proposed settings expire after ten minutes. An unfinished proposal does not change the active connection. After returning from consent or reloading, the saved proposal is available to finish discovery. If it expires, save the settings again. Leaving the secret blank retains the saved secret only for the same server alias and client ID.

Each active member connects their own account from Your account for that server. A supported agent can return that server’s account link when access is missing. The agent must sign in to Foo Guard through the /api/gateway/mcp OAuth endpoint with agent:connect and gateway:invoke. Regular members can approve their own client there, but can only access servers configured for member accounts; shared workspace servers and Library permissions are excluded. The hosted /mcp connector still requires owner or administrator approval. A shared agent credential cannot identify a member. Personal Gateway and shared workspace connections are unchanged. A workspace may use both account types on different servers.

Missing or unusable member access stops calls in both Monitoring and Enforcement. The agent receives neither the upstream token nor the client secret. Policy, schema, deny and agent-block checks run before token access. Concurrent refreshes share a database lease; a caller told that refresh is pending can retry after it finishes. An abandoned or rejected refresh requires reconnecting rather than reusing a possibly spent refresh token.

Members can disconnect only their own provider account; owners and administrators can remove a member’s grant for the selected server. Removing workspace membership deletes all that member’s grants. Disconnecting a server or activating changed OAuth settings invalidates its old grants while preserving accounts for other servers. This removes Foo Guard’s local access; revoke consent at the provider too if its authorization must also end. Request history may show the connected provider account label, without arguments, tokens, or tool results.

This remains a beta integration until consent and a harmless routed call have been verified against the intended live provider. An OAuth provider accepting consent does not by itself prove that its MCP endpoint supports the transport and schemas described above.

Advanced provider connections

If you already route model API calls through Gateway, manage those connections under Setup & policy → Advanced settings and administration → Manage provider connections. Provider connection documentation covers keys, usage limits and recovery. This optional path is separate from MCP tool monitoring and enforcement.

Resources and prompts

Discovery includes tools, resources, resource templates, and prompts advertised by the server. Use the capability filter to review each type. Discovery lists definitions only: it does not read resources, retrieve prompts, or execute tools. New and changed definitions need review before activation; discovery itself grants no access.

Resource reads and prompt retrievals use the same credential, workspace membership, reviewed-policy, definition-change, and durable admission checks as tool calls. Monitoring can flag and forward an unselected reviewed capability; Enforcement blocks it. Invalid arguments and changed definitions stop the request in either mode. The connection's member-account requirement also applies to resources and prompts.

Clients can use resources/list, resources/templates/list, resources/read, prompts/list, and prompts/get. The hosted connector offers equivalent list, read, and get actions. Resources use Foo Guard-scoped URIs and prompts use server-qualified names, so requests stay bound to their reviewed connection. A resource URI is passed to that MCP server; Gateway does not fetch arbitrary URLs or local files itself.

Selecting a resource template permits addresses matching that template, not one specific document. Review its scope carefully. Prompt arguments are strings validated against the advertised argument list. Retrieved prompts are returned as untrusted messages; retrieval does not execute their instructions.

Coverage means access control, definition-change detection, input and response validation, and bounded transport. It does not mean that document contents or prompt instructions have passed a semantic security scan. Returned content can change without the definition changing and can contain prompt injection or sensitive information. The client must decide whether to use it.

The combined discovery limit is 64 capabilities and 64 KiB of catalog data per server. Reads and prompt retrievals accept bounded JSON or finite event-stream responses; subscriptions, resource-change notifications, argument completion, and ongoing resource/prompt streams are not supported. Request history records a stable capability identifier and decision, without storing read parameters, prompt arguments, or returned contents.

After an upgrade, refresh discovery, review the newly visible capabilities, and activate the selection. Existing tool selections do not automatically approve resources or prompts. To withdraw access, update the reviewed policy in Enforcement or disconnect the server. Existing connection disconnection and credential revocation apply to every capability type.

GitHub member accounts

Use a GitHub OAuth application with Foo Guard’s account callback and the minimum scopes needed for your selected toolset. For a public-profile test, use https://api.githubcopilot.com/mcp/x/users/readonly with read:user. Repository and write access are separate permissions; this profile test does not validate them. Save the proposed account settings, connect your own account, discover capabilities, select the reviewed tools, then activate. Other members connect their own accounts. The existing server remains active while you review a proposal.

Session expiry or an interrupted upstream response is not automatically retried. Refresh discovery to check connectivity; reconnect your account if authorization has expired. For a call whose outcome is uncertain, check the provider before repeating a write. The Gateway accepts finite responses within its existing 64 KiB and eight-second transport limits; subscriptions and stream resumption remain unsupported.