How do I connect an MCP server?

Register your tool servers as Connected Tools on a key. The gateway connects to them, re-exposes their tools through /mcp, and guards every call.

Add a Connected Tool

On the dashboard Connected Tools page, add a server to a key. A Connected Tool has a name (unique per key, and it must not contain __), a transport, and a config.

Streamable HTTP

For a server reachable over HTTP, give its URL:

http connected tool config

{
  "url": "https://tools.internal.example.com/mcp"
}

stdio

For a local server the gateway launches as a subprocess:

stdio connected tool config

{
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-filesystem", "/data"],
  "env": { "READ_ONLY": "1" }
}

How tools are exposed

When an agent connects, the gateway connects to every enabled Connected Tool for the key and re-lists their tools, namespaced as <name>__<tool>. So a tool send_email on a Connected Tool named email appears to the agent as email__send_email. Your policy rules match the underlying tool name (send_email) and the server name (email).

What the gateway guards

Every tools/call runs through your policy first. allow forwards to the server immediately and audits the result; deny never reaches it. require_approval doesn't reach it either at first — the gateway returns a pendingresult right away, and only forwards in the background if and when a human approves. A connection failure to any enabled Connected Tool fails the session, so a half-connected agent can't silently bypass a tool.

Point your agent at the gateway

Once your Connected Tools are registered, set your agent's MCP server to the gateway's /mcp endpoint with your API key. The integration guides have ready-to-paste config for Claude Desktop and others.