Connect Antigravity to a gateway

Google Antigravity connects to an MCP gateway through an entry in .agents/mcp_config.json in the project, or in ~/.gemini/config/mcp_config.json for every project, and the gateway's tools then appear in the agent's tool list. The same file applies to Antigravity 2.0, the Antigravity IDE and the Antigravity CLI. The gateway's address goes into the serverUrl field, as Antigravity does not accept url. The entry has two forms, and which one you write depends on how the gateway is secured.

With an API key

For a gateway secured with an API key or a static bearer token, the entry sets the header:

{
    "mcpServers": {
        "billing": {
            "serverUrl": "https://api.example.com/mcp/billing",
            "headers": {"X-API-Key": "the-actual-key"}
        }
    }
}

In the Antigravity IDE, the file opens from the agent side panel, under ... > MCP Servers > Manage MCP Servers > View raw config.

With OAuth

For a gateway with OAuth on, the entry has the client ID and the client secret that the person managing your identity provider registered for Antigravity, and no header:

{
    "mcpServers": {
        "billing": {
            "serverUrl": "https://api.example.com/mcp/billing",
            "oauth": {
                "clientId": "<client-id>",
                "clientSecret": "<client-secret>"
            }
        }
    }
}

Without the oauth block, Antigravity registers itself with the provider, which works with Keycloak when dynamic registration is on and never with Entra ID.

What the identity provider needs

The registration for Antigravity is a confidential client with a client secret and this redirect URI:

• https://antigravity.google/oauth-callback - the page that shows the authorization code after the sign-in

The sign-in

1. Open the agent settings with Cmd + , on macOS or Ctrl + , on Windows and Linux.
2. On the Customizations tab, click Authenticate next to the gateway.
3. Sign in at your identity provider's page in the browser and copy the authorization code that follows.
4. Paste the code into the settings panel and click Submit - the gateway reconnects and its tools are listed.

Antigravity keeps the token in ~/.gemini/antigravity/mcp_oauth_tokens.json and refreshes it when it expires.

Tool approvals

Antigravity asks for an approval before each call of a tool it has no policy for. A policy entry of mcp(billing/*) allows every tool of the gateway, and mcp(billing/crm.get-customer) allows only the tool of the crm.get-customer service.

When access is refused

A person whose token the gateway does not accept - outside the group the gateway's bearer definition lists, or signed in to the wrong tenant - receives a 401 from the gateway. The reason is in the gateway's audit log, in the Reason column of the auth-failed event, next to the person's name.

See also

Learn more