MCP Gateway

    A Model Context Protocol (MCP) gateway is the single entry point that your MCP clients connect to. It sits in front of your registered MCP servers and controls three things: which identities from your identity source—such as your Microsoft Entra ID users—are allowed to connect; which tools those identities can use; and which control policies are checked on every tool call.

    How it works

    When you create a gateway, you define four things: the URL that clients will use; the identity source that validates their tokens; the MCP servers and tools the gateway exposes; and the control policies it enforces. After you save it, SecureAI issues a single gateway URL built from the slug you provided. Your MCP client connects to that URL instead of connecting to each MCP server directly. On every tool call, the gateway validates the client's token against the identity source, confirms that the caller is one of the allowed identities, checks that the requested tool is one you exposed, and evaluates the call against your control policies. The call reaches the MCP server only when all four checks pass.

    Prerequisites

    • Administrator access to SecureAI with permission to manage MCP gateway.
    • An identity source configured in SecureAI (e.g., Microsoft Entra ID) to validate inbound tokens.
    • The gateway base URL, which forms the first part of every gateway URL. If it is not set, click Configure Gateway URL on the MCP Gateway page, enter the Gateway Base URL, and click Save.

    Steps to create an MCP gateway

    1. Go to Access Protection > Gateway > MCP Gateway.
    2. Click + Create MCP Gateway.
    3. In Gateway Name, enter a name for the gateway. To add an optional description, click Description and enter it.
    4. In Gateway URL Slug, enter a slug, or click Generate to create one from the gateway name.
    5. Under Inbound Authentication, select the Identity Source that validates inbound tokens.
    6. In Allowed Identities, click the add icon. In the Select Allowed Identities window, select the identities that may use this gateway, then click OK.
    7. Under MCP Server Access, in MCP Servers, click the add icon. In the Select MCP Servers and Tools window:
      1. Select the MCP servers in the left panel.
      2. For each server, select the tools to expose, using the Tool Name, Description, and Action Type columns.
      3. Click OK.
    8. Under Control Policies, in the Control Policies field, click the add icon. In the Select Control Policies window:
      1. (Optional) Narrow the list using the Filter: All, OWASP, or MITRE.
      2. Select the policies to attach. To build a new policy first, click + Create Control Policy.
      3. Click Select.
    9. Click Save.

    The gateway appears in the MCP Gateway list with its Gateway Name, Description, Gateway URL, and MCP Servers. Copy the Gateway URL into your MCP client to start routing tool calls through the gateway. To see how requests move through the gateway, click View Flowchart at the top right of the page.