--- title: What is an MCP gateway? description: An MCP gateway is one endpoint between MCP clients and many MCP servers. It signs people in, filters their tools, holds server credentials and logs every call. canonical: https://mcp1.com/blog/what-is-an-mcp-gateway last-updated: 2026-11-13 --- # What is an MCP gateway? An MCP gateway is one endpoint between MCP clients and many MCP servers. It signs people in, filters their tools, holds server credentials and logs every call. ![](https://avatars.githubusercontent.com/u/1297371?s=96&v=4)Eldad FuxFounder and CEO, Appwrite An MCP gateway is one endpoint that sits between MCP clients, like Claude Code, Cursor or ChatGPT, and the MCP servers they use. Clients connect to the gateway once and sign in as a person; the gateway lists the tools that person may use, checks each call against rules, adds the server’s credential and forwards it, and records what happened. ## What problem does an MCP gateway solve? It replaces a grid of connections with one. Without a gateway, every person configures every server in every client: ten people, six servers and three clients is up to 180 entries, each with its own token. That causes the problems teams hit in the first month: - Tokens get copied into config files and chat, and a shared key makes every call look like the same person to the service. - Nobody can say which tools a given person’s agent can reach, or limit a group to read-only. - There is no single record of which agent called which tool with what arguments. - Removing someone means finding every token they had and rotating the shared ones. A gateway moves the credentials, the rules and the log to one place, and each client keeps a single URL. ## How does an MCP gateway handle a tool call? It speaks MCP on both sides. To the client it is an MCP server; to each upstream server it is an MCP client. One call goes through these steps: 1. 1The client connects and authenticates. Remote MCP uses OAuth 2.1, so the gateway acts as the resource server, points the client at an authorization server, and gets back a token that names a person. 2. 2The client asks for `tools/list`. The gateway gathers the tools of every server behind it, drops the ones this person may not use, and prefixes the rest with the server name so two servers’ `search` tools don’t collide. 3. 3The model calls a tool with `tools/call`. The gateway checks it again against the person’s groups and rules, because a client can call a tool it wasn’t shown. 4. 4If the call is allowed, the gateway attaches the server’s credential, which the client never sees, and forwards the call. 5. 5It returns the answer, sometimes trimmed to a size limit, and writes an audit record: who, which client, which tool, the arguments, the outcome and how long it took. ## Is an MCP gateway the same as an MCP proxy or an API gateway? No. They overlap, and the words get used loosely, but they do different jobs: ComponentWhat it does MCP proxy Forwards one client’s traffic to one server, often to bridge transports, like stdio to HTTP. Usually no identity, rules or log. MCP gateway Puts many servers behind one endpoint for many people, with sign-in, per-person tool access, held credentials and an audit log. API gateway Routes and rate-limits HTTP requests. It sees a POST to /mcp, not which tool was called or with what arguments, unless it parses MCP. MCP registry A list of servers and how to reach them. It tells clients what exists; it doesn’t sit in the path of calls. The MCP specification defines clients, servers and authorization, not gateways. A gateway is a server built from those parts, so any client that supports remote MCP servers works with one without changes. ## When does a team need an MCP gateway? When more than a few people share servers, or when someone has to answer for what agents do with them. A single developer with two servers in one client doesn’t need one; a config file is fine. The signs you’ve outgrown that: - A service only issues one key per organization, and more than one person needs it. - Some people should read but not write, or a tool like a database query or a file delete should be held to admins. - Security or compliance asks for a record of tool calls by person. - People use more than one client, and keeping each config in sync has become a chore. - Agents run in CI or on a schedule and need tools without a person to sign in. ## What should an MCP gateway do well? Most products in the category cover routing. These are what separate them in practice: - Standard MCP authorization: OAuth 2.1 with PKCE, protected resource metadata and dynamic client registration, so clients connect with nothing but the URL. API keys scoped to one gateway for clients that can’t open a browser. - Per-tool rules that also catch tools a server adds later, like a pattern on a name, not only a checklist of today’s tools. - Read-only that the service enforces, by holding a read-only credential for read-only people, rather than only hiding write tools. - An audit log that names the person, not only the credential, and a way to search and export it. - A plan for many tools. Fifty servers’ tool definitions can fill a model’s context before the conversation starts; the gateway should list fewer and let agents search. - Where it runs. Hosted gateways save running an authorization server, a secret store and a log yourself; self-hosted ones like Docker’s MCP Gateway or IBM’s ContextForge stay inside your network. A gateway doesn’t make a tool safe It decides who can call what and records it. Whether a call is harmful still depends on the credential behind the server. Give servers the narrowest token that does the job, and see [how to stop agents from running destructive MCP tools](https://mcp1.com/blog/stop-destructive-mcp-tools) for the rest. ## MCP1, the gateway we run MCP1 is a hosted MCP gateway. It started as Appwrite’s internal gateway in front of the systems Appwrite Cloud runs on, and the [launch post](https://mcp1.com/blog/introducing-mcp1) covers what we learned. Each gateway has one URL, `https://mcp1.com/mcp//`, and: - Clients sign in with OAuth 2.1, or use an API key scoped to one gateway. Server tokens are encrypted with AES-256-GCM and never reach the client. - Tools are namespaced as `server__tool`, like `github__create_issue`. Gateways are granted to groups with full or read-only access, and rules by name, like `github__delete_*`, set a minimum role or block tools. - Every call is recorded with the person, client, gateway, tool and outcome, and auditors can read the log without being able to call tools. - A gateway whose tools fit in about 2k tokens lists them directly. A larger one lists its built-in tools, and agents find the rest with `mcp1__search_tools`. The [catalog](https://mcp1.com/servers) has hundreds of remote servers, and any other remote server can be added by URL. The [docs](https://mcp1.com/docs) cover setup, and the Individual plan is free to [start with](https://mcp1.com/signup). ## Common questions ### Do MCP clients need special support to use a gateway? No. To a client, a gateway is a remote MCP server. Any client that connects to remote servers over Streamable HTTP and supports MCP authorization can use one. ### Does an MCP gateway add latency? Some, since every call makes one more network hop and a policy check. It is usually small next to the time the upstream server and the model take. ### Can a gateway connect to local stdio MCP servers? Self-hosted gateways often can, because they run next to the servers. Hosted gateways reach servers over the network, so a stdio server has to be exposed over HTTP first. ### What is the difference between an MCP gateway and an MCP registry? A registry lists servers and how to reach them. A gateway sits in the path of every call and decides whether it runs. Give your team one URL Create a workspace, install your servers and share a gateway with a group. Free for individuals. [Start with MCP1](https://mcp1.com/signup)[Read the docs](https://mcp1.com/docs) ## More from the blog [ Terminal$ claude mcp add --transport http linear mcp.linear.app/mcplinearConnectedHow to connect Linear MCP to Claude CodeRun claude mcp add with Linear’s hosted URL and authenticate with /mcp. How to share it with a team, make it read-only, use an API key and fix errors.![](https://avatars.githubusercontent.com/u/1297371?s=96&v=4)Eldad FuxFounder and CEO, Appwrite](https://mcp1.com/blog/linear-mcp-claude-code)[ Destructive toolsgithub\_\_get\_file\_contentsAllowedgithub\_\_merge\_pull\_requestAsk firstsupabase\_\_execute\_sqlAsk firstgithub\_\_delete\_fileAdmin onlyHow to stop agents from running destructive MCP toolsDeny the destructive MCP tools an agent never needs, make the rest ask first, and give the server a credential that can’t delete. Then make writes undoable.![](https://avatars.githubusercontent.com/u/1297371?s=96&v=4)Eldad FuxFounder and CEO, Appwrite](https://mcp1.com/blog/stop-destructive-mcp-tools) --- This is the markdown copy of https://mcp1.com/blog/what-is-an-mcp-gateway. Site index for agents: https://mcp1.com/llms.txt