MCP gateway
An MCP gateway is one MCP server that all your AI apps connect to. It sits in front of the real servers and tools, holds their credentials, switches each tool on or off, applies your policies and records every tool call.
Already know you need one? Connect your AI apps
The short answer
The Model Context Protocol (MCP) gives an AI app a standard way to discover tools and call them. Each MCP server exposes the tools for one system. Connect five systems to four AI apps and you have twenty separate connections, each with its own credentials, its own settings and its own partial history.
An MCP gateway replaces that with one connection. The AI apps connect to the gateway; the gateway connects to the servers behind it. Every tool call passes through one point, so that point can decide which tools are visible, check each call against your policies, keep the credentials out of the apps and write one log.
The five things a gateway does are below, each with what tends to happen without one.
Each of these follows from one fact: every tool call from every AI app passes through the gateway.
Claude, ChatGPT, Claude Code, Cursor, Copilot and other MCP apps each connect to one MCP URL: the gateway. The real MCP servers and APIs sit behind it. Adding a new AI app means adding one connection, not re-creating every server, key and setting inside it.
The same servers configured separately in every app on every laptop, each slightly different, with no single list of what is connected.
The API keys and OAuth grants for the servers behind the gateway are held once, in the gateway, rather than in JSON config files on each machine. Rotating or revoking a credential is one change in one place, and no laptop holds the key at all.
A live API key in a committed .mcp.json file, copied onto every machine that cloned the repository.
A single MCP server can expose dozens of tools, and the model may call any tool it can see. A gateway lets you switch each tool on or off, so a workflow that only needs reads never sees the write or delete tools. In approval mode, new tools a server adds later arrive switched off until someone enables them.
A full read/write server connected to answer read-only questions, with the delete tools left on.
Because every call passes through it, a gateway can check the arguments going out and the results coming back against your policies before the model sees them: block a call, warn on it, or redact personal data such as card numbers, sort codes, National Insurance numbers and email addresses.
Asking the model in its instructions not to repeat sensitive data, which is not a control.
The gateway records each call in one place and one format: which user and which AI app called which tool on which server, with what arguments, what came back, and the policy outcome. That record answers "what did the agent do" after an incident, and it is the evidence a security, risk or compliance review asks for.
Piecing together each AI app's own partial chat history after something has gone wrong.
Remote servers
The MCP specification's authorization model applies to servers reached over HTTP and is based on OAuth 2.1. Local stdio servers are expected to take their credentials from the environment they start in instead, which is why keeping keys out of config files matters so much for them.
For remote servers, the specification requires every MCP client to use PKCE and to name the server a token is for with the resource parameter (RFC 8707), so a token issued for one server cannot be replayed against another. Access tokens must not be put in a URL query string. And an MCP server that calls an upstream API must use its own token for that API: it must not pass through the token it received from the client.
A gateway sits naturally in that model. Where a remote server only offers OAuth and the AI app or in-house agent you use cannot run the flow, the gateway acts as the OAuth client and holds the grant, and the apps keep one connection of their own to the gateway. For the controls to apply around it, read MCP security best practices.
FAQ
An MCP gateway is a single MCP server that your AI apps connect to, which in turn connects to the real MCP servers and tools behind it. Because every tool call passes through it, it can hold the credentials so the apps do not, switch individual tools on or off, apply policies that block, warn or redact, and log every call in one place.
An MCP server exposes tools for one system, such as a CRM, a ticketing tool or a database. An MCP gateway sits in front of many servers and presents them to your AI apps as one connection, adding the controls that individual servers leave to you: tool switches, policies, credential handling and one audit log.
Even with one AI app, a gateway gives you per-tool switches, policies and a log of every tool call, which the app's chat history does not. The case gets stronger as soon as a second app (ChatGPT, Cursor, Claude Code or Copilot) or a second person needs the same servers, because otherwise each one is configured separately.
Remote MCP servers use the MCP specification's OAuth 2.1 based authorization. Where a server only offers OAuth, a gateway can act as the OAuth client on your behalf and hold the grant, so each AI app only needs its one connection to the gateway. The specification also says an MCP server must not pass the token it received from the client through to an upstream API.
Firms that answer to a regulator need to show what their AI tools can reach and what they did. A gateway gives one place to set and evidence that: the list of connected tools, the policies applied to each call, and an activity log of every call. ContextGate turns that log into reports: the AI security review pack is available in the free workspace today, with regulator-specific reports such as an SM&CR reasonable-steps pack and a Consumer Duty board report planned.
Yes. ContextGate is one MCP connection that Claude, ChatGPT, Claude Code, Cursor, Copilot and other MCP apps share. Each tool has an on/off switch, policies block, warn or redact on every call, keys for the servers behind it live in the workspace vault, and every call is recorded in Activity with its arguments, redacted result and policy outcome.
Get started
One URL for Claude, ChatGPT, Claude Code, Cursor and the rest. Keys in a vault, tools switched on one at a time, policies that block, warn or redact, and every call recorded. The free workspace is enough to start.