Connect a server to Gateway

All Gateway guides

Your goal: understand and control MCP access

Gateway sits between an agent's MCP client and an MCP server you connect. It checks each routed tool call, resource read, or prompt retrieval against the policy you reviewed, records its decision, and either forwards or stops it. Use the Requests page to investigate activity and take action without digging through server logs.

Start with Monitoring & Audit to learn which tools your agents use. This is a recommendation, not a requirement: Team workspaces can start with Enforcement immediately. Only traffic routed through Gateway is inspected. An agent that can still reach the upstream directly can bypass it; restrict direct upstream access separately when you need enforced protection.

Pro: one personal monitored connection

Open Personal → Gateway. Pro includes one public HTTPS MCP upstream connection and a scoped Gateway credential. Enter the server URL, choose Discover capabilities, select the tools you expect, then activate monitoring. No manual tool-name list is required. Copy the Gateway URL and credential into your agent's MCP settings. The credential is displayed only once; use Rotate credential if it is lost. Rotation and replacing the connection invalidate the previous credential and end its MCP session. Disconnect remains available even after a downgrade, removes the upstream secret and Gateway credential, and ends that session.

Pro flags policy violations instead of enforcing them. Flagged requests are visible as in-app alerts; signed webhooks, enforcement and shared administration remain Team features. Invalid credentials, protocol errors, unavailable discovery and platform limits can still stop traffic. Routing through a monitoring gateway introduces an availability dependency; it is not a transparent fail-open bypass.

The initial limit is 120 authenticated requests per minute, including protocol requests and connection verification. Exceeding it returns 429 with a retry hint; retry only safe requests and never automatically repeat a tool execution with an uncertain outcome. There is no new monthly allowance in this release. History is bounded to 5,000 requests and seven days, and the UI displays the most recent 100 matching entries. Arguments, source content and upstream results are not stored in request history.

Only an effective Pro subscription grants runtime access. Losing Pro pauses forwarding; the page still lets you inspect recent history and disconnect. Restoring Pro restores access to an enabled connection. Personal credentials do not grant Team or Library access. Keep the original server configuration so you can deliberately remove Gateway routing if you no longer want monitoring.

The administration controls below describe Team Gateway unless explicitly identified as Pro. Pro has no deny rules, exceptions, agent-block controls, or Enforcement mode.

Discover and review tools

Use Discover capabilities to fetch names, descriptions, and input definitions without executing any tools. Review the advertised definitions and select expected tools for Monitoring or allowed tools for Enforcement. Team saves and activates this selection together; there is no separate draft-saving step.

For an existing connection, Refresh tools checks for new, changed, and removed definitions. Review selection keeps unchanged selections and leaves new or changed tools unselected. Activation verifies the definitions again before applying your choices. Reviewing a Personal connection preserves its existing Gateway credential; replacing the connection still rotates it.

The tool inventory refreshes once a minute while the dashboard is visible and no review is open. Team refreshes require an owner or administrator. A failed check preserves the previous timestamp and offers manual retry. These checks do not approve tools or change the active policy. Server descriptions are untrusted information for review, not a security guarantee.

Paginated tool lists are supported within the existing 64-tool limit and a 64 KiB total metadata bound. Discovery is bounded by time and page limits. This uses polling rather than persistent tool-change notifications. Stateless JSON transport requirements still apply.

Connect safely and verify the behavior

1. In Setup & policy, choose a mode, allowed tool names and reason, then save a draft. Saving alone does not change live protection.
2. Enter an authorized public HTTPS MCP server URL and its optional bearer credential. A Team workspace can add up to eight servers. Each server has an alias. Clients call that server as alias/tool. Leave the first alias as server so an existing client can keep using a bare tool name. A bare name still works when exactly one enabled server exposes that tool. If two enabled servers store the same tool name, activation stops until the selection omits that tool or one server is disconnected. Leaving a colliding tool unselected lets the other server keep it. Verify the connection, review the exact saved policy and discovered definitions, then activate. Adding or replacing a server saves a workspace policy revision. Agent behavior comparisons for that revision stay paused until an owner or administrator approves a new baseline.
3. Register an agent and securely store its one-time credential, or let the MCP client sign in with OAuth. Configure its MCP client to use your Foo Guard site's /api/gateway/mcp endpoint. A bearer client sends Authorization: Bearer <agent credential>. An OAuth client discovers the authorization server from the first 401, then an owner or administrator approves agent:connect and gateway:invoke and chooses Personal or an existing Team workspace. A matching email address does not create a membership. tools/list returns the real catalog, using alias/tool when more than one Team server is enabled. The client accepts application/json, text/event-stream. A JSON tool result comes back as JSON. When the tool server streams, Foo Guard forwards that stream and records the outcome only after it finishes. Initialization returns Mcp-Session-Id. Send that header on later requests for this client, and send DELETE with the same header to end the session. The session lasts 24 hours. It records the workspace, agent, and protocol version, and it does not store tool arguments. For a bearer client it is bound to that credential. For an OAuth client it follows the Gateway agent credential, so refreshing the access token keeps the session. Credential rotation and disconnecting the Gateway end it immediately. Disconnecting one of several servers leaves it in place. A request that omits the header still uses the bearer credential or the current OAuth access token. An ended session is rejected; initialize again. Redirect URIs may be the Claude callbacks, a loopback http://127.0.0.1 or http://localhost address with a port, or a private-use app scheme such as cursor://. Other HTTPS callbacks are rejected. The hosted Claude connector at /mcp still lists list_gateway_tools and call_gateway_tool. The sign-in page runs in the browser. Later MCP requests to this URL omit a browser Origin header.
4. Make a harmless allowed tool call and confirm it appears in Requests. Check a harmless disallowed call to verify your chosen mode.

For an inert example, connect https://fooguard.com/api/gateway/demo, allow read_note, and try delete_note. That tool only simulates a deletion. Monitoring should flag and forward the simulation; Enforcement should stop it before forwarding. Never use a destructive production operation as your first enforcement test.

A Team workspace can connect up to eight public HTTPS MCP 2025-06-18 servers. Discovery and connection checks accept bounded JSON or finite event-stream responses, up to 64 combined capabilities, and supported argument schemas. If an object schema omits additionalProperties, Foo Guard restricts it to its declared properties; explicit open schemas and unsupported validation keywords are rejected. A tool call may instead come back as an event stream. Foo Guard forwards that stream to a client that accepts text/event-stream, does not store the events, and records Response received only after the stream finishes with a valid tool result. A break in the stream stays Outcome uncertain and is not retried. The stream is limited to 64 KiB and the same short upstream time limit as a JSON tool call. Pro remains one personal monitored connection. Disconnecting a server keeps its alias and its place in the eight-server limit; use that alias again to replace it. Foo Guard can keep a client MCP session for 24 hours, with at most 32 live sessions for one agent. Clients can authorize /api/gateway/mcp with OAuth or keep using an agent credential. Team member accounts support a public authorization-code provider with PKCE. Each routed request initializes its own upstream session, scoped to that server and member credential; sessions are never shared across members or replayed after failure. Private-network servers, same-IdP token exchange, resuming an interrupted stream, and arbitrary MCP implementations remain unsupported. Agent registration is credential-based; it does not attest the identity of the software or person holding the credential. OAuth approval, client sessions, and streamed tool responses are not an enterprise-complete gateway.