How ContextGate Works

A technical overview of the product as it is today: the architecture, what happens on every tool call, what gets recorded, where data goes, and what ContextGate doesn't do.

Updated October 2026

1. What ContextGate is

ContextGate is one MCP connection you add to the AI apps you already use: Claude, Claude Code, Cursor, VS Code, ChatGPT, Codex, Gemini CLI or any other client that supports remote MCP servers. The apps you connect, such as Gmail, GitHub, Salesforce or your own MCP servers, sit behind that connection.

Every tool call an AI app makes through ContextGate is logged, checked against your policies, and blocked, warned on or redacted when it should be. ContextGate is free, with no card needed.

2. Architecture

ContextGate sits between your AI apps and the tools they call. The AI app talks MCP to ContextGate, and ContextGate talks to your connections.

Your AI apps

Claude, Claude Code, Cursor, VS Code, ChatGPT, Codex, Gemini CLI or any remote-MCP client

ContextGate MCP endpoint

OAuth sign-in or API key
Default Toolbox and tool switches
Policies on arguments and results
PII redaction and restore
Activity record

Your connections

App integrations: Gmail, GitHub, Salesforce, HubSpot, Slack and more
Remote MCP servers, including your own

Governance checks are judged by a model ContextGate manages, called through OpenRouter.

The endpoint and sign-in

Each workspace has one MCP URL, shown on the Setup page. AI apps connect to it over HTTP as a remote MCP server. An app signs in with OAuth: you sign in to ContextGate in the browser and the app receives an access token. Clients that can't do OAuth use a workspace API key instead. API keys can be created and revoked, and revoking a key also stops any token issued from it.

ContextGate works out the workspace from the token or key. Each call is attributed to the AI app (by its OAuth client name, such as "Claude" or "Cursor", or by the API key's description) and, for sign-ins, to the user. You can invite teammates to a workspace, and members have Owner, Admin, Member or Viewer roles.

AI apps connect straight to the endpoint at https://api.contextgate.ai/mcp as a remote (HTTP) MCP server. Connection credentials stay on the ContextGate side; the AI app holds only its ContextGate sign-in.

Connections

App integrations. Gmail, GitHub, Salesforce, HubSpot, Slack and more. You authorize each app once with its own sign-in, and the call runs against the app's API.
Remote MCP servers. ContextGate forwards the call to the server over HTTP with the credential you gave it, which is stored in Google Secret Manager. Every request, redirects included, is checked so a connection can't reach private or internal addresses.

Connections show their health and flag when they need re-authorizing. Their tool lists sync, and each tool is listed to the AI app with the connection's name as a prefix, so two connections can offer tools with the same name.

The Default Toolbox

Every connection is reachable through the workspace's Default Toolbox. You can switch individual tools off. A switched-off tool disappears from the AI app's tool list, and if an app calls it anyway, the call is refused and recorded as blocked. Tool switches belong to the toolbox, not to individual AI apps or agents.

3. The tool-call pipeline

Every tool call routed through ContextGate goes through the same steps, in this order:

Restore placeholders. If the arguments contain redaction placeholders from an earlier result, ContextGate swaps the real values back in, so the tool gets what it needs.
Check the arguments. Every active rule in the workspace that runs on arguments looks at the tool name and arguments. A secrets rule checks the arguments exactly as the AI app sent them. Governance checks and content patterns block, warn or log.
Apply tool switches. A call to a switched-off tool is refused.
Call the tool. App integrations call the app's API. Remote MCP servers receive a standard MCP tools/call request.
Check the result. Governance checks and content patterns that run on results look at what the tool returned.
Redact. Personal data in the result is replaced with placeholders.
Return and record. Any warnings are added to the top of the result, the result goes back to the AI app, and the call is written to Activity.

What block, warn and log do

Action	On arguments (before the tool runs)	On results (after the tool runs)
Block	The call is refused with the policy's reason. The tool never runs.	The tool has already run, and anything it did stands. The AI app gets a "blocked by policy" message instead of the result.
Warn	The tool runs. A policy warning with the reason is added to the top of the result, so the AI app sees it.	The result goes back with the policy warning on top.
Log	Nothing changes for the AI app. The match is recorded in Activity.	Nothing changes for the AI app. The match is recorded in Activity.

Use block on arguments when an action must not happen. A block on results can't undo what the tool already did; it only keeps the result away from the AI app.

When a check can't run. If the model behind a governance check returns an error, the call goes ahead by default and Activity records a warning that the check couldn't run. A check that runs past its time limit (10 seconds by default) counts as failed, so a check set to block will block the call.

4. Policies

Policies apply to the whole workspace: every active policy runs on every tool call routed through it. A policy holds one or more rules of the kinds below.

Governance checks

A rule written in plain English, judged by a model that ContextGate manages and calls through OpenRouter. You don't need your own model keys. Each check blocks, warns or logs, and runs on arguments (before the tool runs), on results (before the AI app sees them) or on both.

A check can be scoped to specific tools with name patterns, either to include (for example GMAIL_SEND_*) or to exclude. Without a scope, it runs on every tool call.

The judge sees the tool name and the arguments or the result. It never sees the user's chat or the model's answers, so a check can't judge the tone or accuracy of an answer.

PII redaction and restore

Personal data in tool results is replaced with placeholders, such as [EMAIL_REDACTED_3f9a1c2e], before the AI app sees it. There are 40 built-in types, including email, phone, IBAN, UK sort codes, account numbers and National Insurance numbers, and you can add your own regex patterns. Detection uses Microsoft Presidio plus pattern recognizers, so it can miss values or flag false positives.

The original values are stored encrypted, with the key held in Google Secret Manager. When the AI app later sends a placeholder in a tool call, ContextGate restores the real value before the call goes out.

Redaction runs on results, not arguments. Personal data the AI app puts in an argument itself is treated as data the user meant to send. It isn't redacted or blocked, and it's recorded in Activity as sent.

Secrets blocking

A secrets rule blocks any call whose arguments contain a secret pattern. The Secrets & Credential Leakage template covers AWS keys, Google Cloud service-account keys, Azure storage keys, OpenAI, Anthropic, GitHub and Slack keys, Stripe live keys, Google API keys, JWTs, private key blocks and bearer tokens, and you can add your own patterns. A blocked call never reaches the tool, and its arguments aren't stored in Activity.

Content patterns

Keyword and regex rules that match against the arguments or the result. Keywords also match the tool name. Each rule blocks, warns or logs.

Templates

There are 16 policy templates to start from:

CCPA / CPRA (California)
Copyright & IP Protection
EU AI Act
Financial Advice Disclaimer
GDPR Strict
HIPAA Strict
Internal Confidentiality
Medical Device Software (SaMD)
PCI DSS Cardholder Data
Prompt Injection Defense
Secrets & Credential Leakage
UK AML / KYC
UK FCA Consumer Duty
UK Financial Promotions (FSMA s.21)
UK Insurance Privacy
UK Open Banking (PSD2 / FCA PSRs)

A template is a starting point you edit, and it helps you become compliant with the regulation it's named after.

Per-tool switches

Separate from policies, any tool can be switched off in the Default Toolbox. It's hidden from your AI apps and refused if called (see Architecture).

5. Activity and evidence

Every tool call routed through ContextGate is recorded, including calls that were blocked or refused. Each record holds:

The time, the AI app, the user (for sign-ins), the connection, the toolbox and the tool.
The arguments as the AI app sent them. Placeholders stay as placeholders.
The result as the AI app received it, after redaction.
Latency and status: success, blocked or error.
The policy outcome (allowed, logged, warned or blocked) with the policy, the rule and the reason.
Redactions as types and counts only. The redacted values aren't stored in the record.

When a call is blocked because its arguments contain a secret, the arguments aren't stored.

You can filter Activity by AI app, connection, toolbox, tool, status, violation type or action, policy, check or redaction type, latency, user, conversation and date.

Attention lists the blocked and warned calls from the last 7 days.
Overview shows tool calls, blocked and warned counts, AI apps and apps connected, calls per day by outcome, top tools and calls by AI app.
Agents lists the AI apps and API keys using ContextGate, who signed them in, and when each was first and last seen.

Activity lives in the app. There's no log export or SIEM integration and no alerting, and records aren't tamper-evident.

6. Data handling and hosting

Hosting

ContextGate runs on Google Cloud in the US region (us-central1). The API runs on Cloud Run.
The database is Cloud SQL for PostgreSQL on a private IP only, with encrypted (TLS) connections required. It's backed up daily, and backups are kept for 7 days.
Connection credentials, the encryption key for redacted values and platform API keys are kept in Google Secret Manager.

What ContextGate stores

Workspace settings: connections, policies, tool switches, members and API keys (stored hashed).
The activity records described in section 5.
The encrypted original values behind redaction placeholders.

Third parties in the data path

App integrations run through an integration provider that holds the OAuth grants for the apps you connect. It sees each call's arguments, with real values restored, and the raw result.
OpenRouter runs governance checks. The model behind a check sees the tool name and the full arguments or result, before any redaction. Policies run in order, so a check that runs before a secrets rule can see a secret before the call is blocked.
Remote MCP servers you add receive the calls routed to them.

Google Cloud, OpenRouter and the integration provider belong in your own supplier review, alongside ContextGate.

Not offered today

UK or EU data residency.
A stated retention period for activity records.
Tamper-evident logs.

7. Limits

Questions technical buyers ask, answered plainly. ContextGate today:

Sees only tool calls routed through it, not an AI app's built-in tools, its chat or MCP servers added to the app directly.
Doesn't see or filter prompts or model answers, route model calls or take your own model keys.
Doesn't build, host, schedule or run agents, and has no triggers or webhooks.
Applies policies workspace-wide and tool switches per toolbox. There are no per-agent identities, per-agent allowlists or policy bundles.
Has no approval steps or human-in-the-loop gates. A call is allowed, warned on or blocked.
Sends no alerts or notifications, and has no log export or SIEM integration.
Has no policy versioning, separate dev, staging and production environments, or drift detection.
Has no SSO, SAML or SCIM.
Holds no SOC 2 or ISO certification.
Offers no UK or EU data residency, no retention guarantee and no tamper-evident logs.
Has no VPC or on-premises deployment and no uptime SLA. The service is provided as is (see the Terms of Service).
Relies on a model for governance checks, and models can be wrong. PII detection can also miss values or flag false positives.
Lets a call through by default when a governance check can't run.
Can't undo a tool's side effects when a block on results fires.

8. Getting started

Sign up, then open the Setup page. A 3-step checklist ticks itself off as you go. There are guides for Claude (web, desktop and Cowork), Claude Code, Cursor and VS Code (with one-click install links), ChatGPT (developer mode), Codex, Gemini CLI and any other remote-MCP client (using an API key). Setup takes minutes.

For Claude Code, one command adds it; run /mcp in Claude Code to sign in:

claude mcp add --transport http contextgate https://api.contextgate.ai/mcp

Then connect an app, add a policy from a template, make a few tool calls from your AI app and watch them arrive in Activity.

Get started free Book a 30-minute call

Written by Adam Cooke (Founder of ContextGate.ai)

LinkedIn: https://www.linkedin.com/in/adamcooke1/