--- title: MCP1 by Appwrite description: "MCP1 by Appwrite is an MCP gateway for teams: put your Model Context Protocol servers behind one URL with authentication, groups, per-tool rules and an audit log. Works with Claude, Cursor, ChatGPT, Codex and any MCP client." canonical: https://mcp1.com/ --- # MCP1 by Appwrite > MCP1 is an MCP gateway for teams, made by Appwrite. It puts your Model Context Protocol (MCP) servers behind one URL, so Claude, Claude Code, Cursor, ChatGPT, Codex, Gemini, VS Code, Windsurf and any other MCP client connect once, authenticate with their own account, and get only the tools their groups and role allow. Every tool call is checked and recorded. - [Website](https://mcp1.com) ([markdown](https://mcp1.com/index.md)) - [Docs](https://mcp1.com/docs) ([markdown](https://mcp1.com/docs.md), [llms.txt](https://mcp1.com/docs/llms.txt)) - [Server catalog](https://mcp1.com/servers) ([llms.txt](https://mcp1.com/servers/llms.txt)) - [Blog](https://mcp1.com/blog) ([llms.txt](https://mcp1.com/blog/llms.txt), [RSS](https://mcp1.com/blog/rss.xml)) - [Changelog](https://mcp1.com/changelog) ([markdown](https://mcp1.com/changelog.md)) - [Pricing](https://mcp1.com/pricing.md) - [About MCP1](https://mcp1.com/about) - [Sign up](https://mcp1.com/signup) - [X](https://x.com/MCP1_) - [Everything in one file](https://mcp1.com/llms-full.txt), with the whole server catalog ## When to use MCP1 Reach for MCP1 when a person or a team wants their AI agents to use company systems through MCP, and someone has to decide who can do what: - A team wants Claude, Claude Code, Cursor, ChatGPT, Codex or another MCP client connected to several MCP servers (GitHub, Linear, Sentry, Notion, Stripe, databases, observability) without configuring each server in each client. - Server credentials should be shared without handing out API keys: MCP1 keeps the tokens and each person signs in with their own account. - Some tools must be limited: read-only access for some groups, destructive tools held to admins or confirmed first, single tools turned off. - Someone needs to know which agent called which tool, as whom, with what arguments: the audit log records every call. - A CI job or scheduled agent needs MCP tools with a scoped API key instead of OAuth. It is not an MCP server framework: MCP1 connects to MCP servers that already exist, remote ones from its catalog or any server reachable by URL. ## For agents - MCP endpoint: `https://mcp1.com/mcp` (Streamable HTTP). A workspace's gateways are at `https://mcp1.com/mcp//`. - Server card: https://mcp1.com/mcp/server-card (listed in https://mcp1.com/.well-known/ai-catalog.json) - Authentication: OAuth 2.1 with PKCE and dynamic client registration, device code for headless tools, or an MCP1 API key as a bearer token. Walkthrough: https://mcp1.com/auth.md - OpenAPI description: https://mcp1.com/openapi.json (API catalog: https://mcp1.com/.well-known/api-catalog) - Agent skill for using a gateway: https://mcp1.com/.well-known/agent-skills/mcp1-gateway/SKILL.md - Every public page has a markdown copy at its path plus `.md`, and is served as markdown to requests that send `Accept: text/markdown`. ## What it does - One URL per gateway: `https://mcp1.com/mcp//`. Each workspace also has a default gateway at `/mcp/`. - Shared gateways: admins bundle installed servers behind one URL and grant it to groups, with full or read-only access. - Personal gateways: anyone can build their own gateway from their own servers (with their own tokens) and the workspace servers open to their groups. - Groups and tool rules: limit servers and single tools to certain groups, set a minimum role per tool, hold destructive tools to admins, and rate-limit calls. - Authentication: MCP clients authenticate with OAuth 2.1 (PKCE and dynamic client registration). Clients without OAuth, like CI pipelines, use API keys scoped to one gateway. - One-click server connections: catalog servers that support OAuth (Linear, Notion, Sentry and others) authenticate in one click instead of with a pasted token. MCP1 keeps the tokens encrypted and refreshes them. - Audit log and analytics: every call is recorded with who made it, through which client and gateway, how long it took and whether it was allowed. Admins get usage by person, group, gateway, server and tool. - Tool names are namespaced as `server__tool` (for example `github__create_issue`), so tools from different servers never collide. - MCP Apps: interactive views that servers attach to their tools (`ui://` resources) pass through the gateway, so clients like Claude and ChatGPT render them. Output schemas and structured results pass through too. - Rules by name: patterns like `github__delete_*` set a minimum role, limit tools to groups, or block them, including tools added later. - Read-only secrets: a server can hold a second, read-only token; people on read-only access call with it, so the service itself refuses their writes. - Answer size limit: oversized tool answers are cut down with a note asking the model to narrow its query (1 MB by default). - Confirmations: destructive calls can ask the person to confirm in their client first (MCP elicitation), where the client supports it. - Admin tools: admins' agents can list members, search the audit log, invite people, change roles, groups, tool rules and gateway access. Every change is audited and can require confirmation. - IP allowlists (Enterprise): gateway calls only from listed IPv4 and IPv6 addresses and ranges, for every client or API keys only. - Built-in tools on every gateway. A gateway whose servers' tools fit in about 2k tokens lists those too, so agents call them directly; a larger one lists only its built-in tools, and agents find servers' tools with `mcp1__search_tools` and run them with `mcp1__call_tool`, so tool definitions stay a few hundred tokens however many servers are connected. The others: `mcp1__server_instructions`, `mcp1__whoami`, `mcp1__gateway_info`, `mcp1__check_access`, `mcp1__recent_calls`. - Server instructions: a server's own instructions for its tools come with the first search results from that server in a session (and from `mcp1__server_instructions`), with tool names as the gateway exposes them. The gateway's own instructions mark which servers have some. ## Security and compliance MCP1 is SOC 2, GDPR, HIPAA and CCPA compliant. A DPA is available for every workspace and a BAA on Enterprise. Server tokens, OAuth grants and call arguments are encrypted with AES-256-GCM, every endpoint uses TLS, and workspace data is hosted in Frankfurt (EU). ## Roles Owner, admin, developer, member and auditor. Admins manage gateways, servers, groups and rules. Auditors can read everything, including the audit log, but cannot call tools. ## Plans - Individual: free. 1 member, 3 gateways, 15 servers. One free workspace per account. - Team: $12 per member per month. Up to 25 members, 25 gateways, 100 servers. Groups, shared gateways, per-tool rules, usage analytics and audit export. - Enterprise: $29 per member per month. Up to 1,000 members, 500 gateways, 1,000 servers. ## Server catalog Hundreds of remote MCP servers, organized by business unit: Engineering, Product & design, Data & analytics, Customer support, Sales & CRM, Marketing, Finance & payments, Operations & productivity, Security & IT, and Knowledge & docs. Servers marked "one-click authentication" connect with MCP OAuth instead of a pasted token. Any other remote MCP server can be added by URL (streamable HTTP or SSE). - [The whole catalog, by business unit](https://mcp1.com/servers/llms.txt) - [Browse the catalog](https://mcp1.com/servers); each server has a page at `https://mcp1.com/servers/` and a markdown copy at `https://mcp1.com/servers/.md` - Popular: [GitHub](https://mcp1.com/servers/github), [Linear](https://mcp1.com/servers/linear), [Sentry](https://mcp1.com/servers/sentry), [Notion](https://mcp1.com/servers/notion), [Supabase](https://mcp1.com/servers/supabase), [Cloudflare](https://mcp1.com/servers/cloudflare), [Vercel](https://mcp1.com/servers/vercel), [Stripe](https://mcp1.com/servers/stripe) ## Blog Posts by Eldad Fux, founder and CEO of Appwrite, unless a post names another author. - [What is an MCP gateway?](https://mcp1.com/blog/what-is-an-mcp-gateway): one endpoint between MCP clients and many servers, the grid of per-person, per-client configs it replaces, what happens to one call (OAuth sign-in, filtered and namespaced tools/list, policy check on tools/call, held credential, audit record), how it differs from an MCP proxy, an API gateway and a registry, when a team needs one, what to look for, and MCP1. - [How to connect Linear MCP to Claude Code](https://mcp1.com/blog/linear-mcp-claude-code): claude mcp add with https://mcp.linear.app/mcp and /mcp to authenticate, local, user and project scopes, sharing through a committed .mcp.json, the /mcp/readonly endpoint, a Linear API key as a bearer header, allowing mcp__linear in settings, troubleshooting, and Linear in an MCP1 gateway. - [How to stop agents from running destructive MCP tools](https://mcp1.com/blog/stop-destructive-mcp-tools): what destructiveHint and the other tool annotations mean and default to, which GitHub and Supabase tools to treat as destructive, Claude Code deny and ask rules and managed settings, Codex disabled_tools, Cursor and VS Code approvals, why client rules aren't enough, making destructive calls undoable (branch protection, database branches, backups), and MCP1's destructive guardrail, confirmations and rules by name. - [How to share an MCP server without sharing the API key](https://mcp1.com/blog/share-mcp-server-without-api-key): why a shared key hides who did what, OAuth servers shared through a project .mcp.json, keeping tokens out of config with ${VAR} in Claude Code, ${env:VAR} in Cursor, VS Code inputs and Codex bearer_token_env_var, what a proxy needs when a service issues one key, removing someone's access, and MCP1's encrypted workspace servers, groups and audit log. - [MCP audit logging: how to record every tool call](https://mcp1.com/blog/mcp-audit-logging): what to record for each call (person, client, server and tool, arguments, result, latency), why a service's own logs see only the credential, capturing calls in the client, the server or a gateway, a Claude Code PostToolUse hook for mcp__ tools, masking secrets, and MCP1's audit log, auditor role and mcp1__search_audit. - [Too many MCP tools: how to cut context bloat](https://mcp1.com/blog/too-many-mcp-tools): why tool definitions cost tokens and accuracy, measuring a server's tools/list, deny rules in Claude Code, enabled_tools and disabled_tools in Codex, Cursor and VS Code toggles, ENABLE_TOOL_SEARCH and VS Code virtual tools, per-project configs, and how MCP1 gateways list only their own tools past about 2k tokens. - [How to use MCP servers in CI and headless agents](https://mcp1.com/blog/mcp-in-ci-and-headless-agents): authenticate with a bearer token instead of OAuth, write the MCP config in the job, Claude Code with --bare, --mcp-config and --allowedTools in GitHub Actions, Codex with bearer_token_env_var, catching servers that silently fail to load, scoping a CI credential, and MCP1 API keys. - [How to make an MCP server read-only](https://mcp1.com/blog/read-only-mcp-server): three layers (a read-only credential, the server's own read-only mode, a filter on readOnlyHint), GitHub's X-MCP-Readonly header and /readonly URL, Supabase's read_only=true, a SELECT-only Postgres role, why hiding tools isn't enough, and read-only grants and secrets in MCP1. - [How to connect MCP servers to Grok Bot](https://mcp1.com/blog/connect-mcp-servers-to-grok-bot): by Atharva Deosthale, Developer Advocate. Connect Grok Bot to an MCP1 gateway once, so every server is managed in one dashboard and shared with coding agents. Covers adding servers to MCP1, the gateway URL, the Connect card, how tools, Ask first rules and the audit log apply, and Revoke. - [Introducing MCP1: the gateway we built for ourselves](https://mcp1.com/blog/introducing-mcp1): MCP1 started as Appwrite's internal gateway in front of the systems Appwrite Cloud runs on. What changed when agents could match knowledge across them, what running it taught the team (read-only tokens, saved definitions, small answers), what's in MCP1 and its trade-offs. - [10 steps for rolling out MCP across your company](https://mcp1.com/blog/rolling-out-mcp-to-your-company): start from each team's slowest questions, install servers once with read-only secrets, a group and shared gateway per team, read-only grants first, Ask first rules, one URL per client, API keys for CI, the audit log, limits, and the policy as YAML. - [How we built MCP1 on Appwrite](https://mcp1.com/blog/how-we-built-mcp1-on-appwrite): Appwrite Cloud's OAuth2 server as the authorization server (RFC 9728, RFC 7591, client ID metadata documents, PKCE, RFC 8707), Teams for workspaces, the policy function, confirmations over MCP elicitation, answer limits, the outbound address guard, sealed secrets, and trade-offs. ## How to connect a client - Claude Code: `claude mcp add --transport http https://mcp1.com/mcp//`, then run `/mcp` and choose Authenticate. - Claude and ChatGPT: add the gateway URL as a custom connector and approve MCP1. - Cursor and VS Code: one-click install from the Connect page in the MCP1 dashboard. - Codex: `codex mcp add --url ` then `codex mcp login `. - OpenCode: `opencode mcp add --global --url ` then `opencode mcp auth `. - T3 Code: it runs the agents installed on your machine (Claude Code, Codex, OpenCode), so add MCP1 to one of those and T3 Code sessions get it too. - Gemini CLI: `gemini mcp add --transport http `, then `/mcp auth`. - Any other client: point it at the gateway URL; it finds how to authenticate from `/.well-known/oauth-protected-resource/mcp//`. ## Common questions - What is an MCP gateway? One endpoint in front of your MCP servers. Clients connect to it once; it signs people in, applies your rules and forwards each call to the right server. - Where do server tokens live? In MCP1, encrypted with AES-256-GCM. People never see the workspace's tokens, and nobody else can use a personal server's tokens. - What happens when someone leaves? Remove them from the workspace and every client they approved stops working. Single clients and keys can also be revoked.