MCP server registry

    The MCP server registry is the central inventory of the MCP servers in your organization. Creating a registry entry tells SecureAI where an MCP server lives, how to authenticate to it, and which tools it exposes. You can then add the server to a gateway, which routes all tool calls from MCP clients to that server and applies control policies to them.

    How it works

    You register an MCP server by adding its URL and authentication details to the MCP Server Registry. SecureAI connects to the server and discovers the tools it exposes. The registered server can then be added to an MCP gateway, which groups servers under a single signed gateway URL and applies access policies and identity rules. Your MCP client connects through that gateway URL, and every tool call is evaluated against your access policies before it is forwarded to the server. Registration is the first step in this flow, so a server must exist in the registry before it can be mapped to a gateway.

    Prerequisites

    • Administrator access to SecureAI with permission to manage the MCP Server Registry.
    • The MCP server endpoint URL, reachable from SecureAI.
    • Credentials for the authentication method you plan to use: OAuth 2.0 client ID and client secret, or a bearer token.
    • For OAuth 2.0 with the Automatic setup, the MCP server must support OAuth 2.0 Dynamic Client Registration (DCR) and expose a valid registration_endpoint in its OpenID configuration. If it does not, use Manual.

    Steps to create an MCP server registry entry

    1. Go to Access Protection > Gateway > MCP Server Registry.
    2. Click + Add MCP Server.
    3. In Server Name, enter a name for the server. To add an optional description, click Description and enter one.
    4. Enter the MCP Server URL.
      To pick from servers already detected in your environment, click Import, select an entry in the Discovered MCP Servers list, and click Select.
    5. Select the Authentication Mode:
      • Shared credentials: One set of credentials is used for all tool calls to this server.
      • Per-user credentials: Each user authenticates to the server individually.

      Note: To see how the selected mode passes identity to the server, click View Authentication Flow next to the field.

    6. Configure the authentication details. For Shared credentials, select the Authentication Type:
      • OAuth 2.0: Select the OAuth 2.0 Type.
        • Automatic: No further input is needed. SecureAI registers itself with the server using DCR.
        • Manual: Enter the Client ID and Client Secret.
          • Server supports metadata discovery: If the option is enabled, SecureAI reads the endpoints from the server; if it is not enabled, enter the Authorization URL, Token URL, and Refresh Token URL yourself.
          • Scopes and Redirect URL are optional.
      • Bearer: Enter the Bearer Token.
      • None: The server is registered without authentication.
    7. For Per-user credentials, select the OAuth 2.0 Type, and enter the OAuth details if you select Manual.
    8. (Optional) Expand Additional Headers and add a Header Name and Value for each custom header SecureAI should send to the server.
    9. Click Connect & Discover. SecureAI connects using the details you entered and populates Available Tools.
    10. Click Save.

    The server will now appear in the MCP Server Registry list.