How do I connect an MCP server?

Register your tool servers as upstreams on a key. The gateway connects to them, re-exposes their tools through /mcp, and guards every call.

Add an upstream

On the dashboard Upstreams page, add a server to a key. An upstream has a name (unique per key, and it must not contain __), a transport, and a config.

Streamable HTTP

For a server reachable over HTTP, give its URL:

http upstream config

{
  "url": "https://tools.internal.example.com/mcp"
}

stdio

For a local server the gateway launches as a subprocess:

stdio upstream config

{
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-filesystem", "/data"],
  "env": { "READ_ONLY": "1" }
}

How tools are exposed

When an agent connects, the gateway connects to every enabled upstream for the key and re-lists their tools, namespaced as <upstream>__<tool>. So a tool send_email on an upstream named email appears to the agent as email__send_email. Your policy rules match the underlying tool name (send_email) and the server name (email).

What the gateway guards

Every tools/call runs through your policy first. allow forwards to the upstream and audits the result; deny and require_approvalnever reach the upstream — the gateway returns the verdict (or holds for approval) and records it. A connection failure to any enabled upstream fails the session, so a half-connected agent can't silently bypass a tool.

Point your agent at the gateway

Once upstreams are registered, set your agent's MCP server to the gateway's /mcp endpoint with your API key. The integration guides have ready-to-paste config for Claude Desktop and others.