# Connect Antigravity to a gateway

Add an MCP gateway to Google Antigravity with an API key or with a sign-in through your identity provider.

Google Antigravity connects to an [MCP gateway](https://zato.io/docs/ai/mcp/index.html) through an entry in `.agents/mcp_config.json` in the project, or in `~/.gemini/config/mcp_config.json` for every project, and the gateway's tools then appear in the agent's tool list. The same file applies to Antigravity 2.0, the Antigravity IDE and the Antigravity CLI. The gateway's address goes into the `serverUrl` field, as Antigravity does not accept `url`. The entry has two forms, and which one you write depends on how the gateway is [secured](https://zato.io/docs/ai/mcp/security.html).

## With an API key {#with-an-api-key}

For a gateway secured with an API key or a static bearer token, the entry sets the header:

```json
{
    "mcpServers": {
        "billing": {
            "serverUrl": "https://api.example.com/mcp/billing",
            "headers": {"X-API-Key": "the-actual-key"}
        }
    }
}
```

In the Antigravity IDE, the file opens from the agent side panel, under **...** > **MCP Servers** > **Manage MCP Servers** > **View raw config**.

## With OAuth {#with-oauth}

For a gateway with [OAuth](https://zato.io/docs/ai/mcp/oauth.html) on, the entry has the client ID and the client secret that the person managing your identity provider registered for Antigravity, and no header:

```json
{
    "mcpServers": {
        "billing": {
            "serverUrl": "https://api.example.com/mcp/billing",
            "oauth": {
                "clientId": "<client-id>",
                "clientSecret": "<client-secret>"
            }
        }
    }
}
```

Without the `oauth` block, Antigravity registers itself with the provider, which works with Keycloak when dynamic registration is on and never with Entra ID.

## What the identity provider needs {#what-the-identity-provider-needs}

The registration for Antigravity is a confidential client with a client secret and this redirect URI:

- `https://antigravity.google/oauth-callback` - the page that shows the authorization code after the sign-in

## The sign-in {#the-sign-in}

1. Open the agent settings with **Cmd + ,** on macOS or **Ctrl + ,** on Windows and Linux.
2. On the **Customizations** tab, click **Authenticate** next to the gateway.
3. Sign in at your identity provider's page in the browser and copy the authorization code that follows.
4. Paste the code into the settings panel and click **Submit** - the gateway reconnects and its tools are listed.

Antigravity keeps the token in `~/.gemini/antigravity/mcp_oauth_tokens.json` and refreshes it when it expires.

## Tool approvals {#tool-approvals}

Antigravity asks for an approval before each call of a tool it has no policy for. A policy entry of `mcp(billing/*)` allows every tool of the gateway, and `mcp(billing/crm.get-customer)` allows only the tool of the `crm.get-customer` service.

## When access is refused {#when-access-is-refused}

A person whose token the gateway does not accept - outside the group the gateway's bearer definition lists, or signed in to the wrong tenant - receives a 401 from the gateway. The reason is in the gateway's [audit log](https://zato.io/docs/ai/mcp/audit-log.html), in the **Reason** column of the `auth-failed` event, next to the person's name.

## See also {#see-also}

- [OAuth](https://zato.io/docs/ai/mcp/oauth.html) - How the sign-in works and how to set up Entra ID or Keycloak
- [Sharing with clients](https://zato.io/docs/ai/mcp/sharing-with-clients.html) - The export with the gateway's address and the other clients' snippets
- [MCP gateways](https://zato.io/docs/ai/mcp/index.html) - Configuration and the governance controls

## Learn more {#learn-more}

- [MCP tutorial](https://zato.io/tutorials/mcp/01.html) - Expose Python services as AI tools and connect Claude Code in minutes
- [AI Integrations overview](https://zato.io/docs/ai/) - Both directions of AI traffic in one platform, and where to start
- [MCP gateway reference](https://zato.io/docs/ai/mcp/) - Configuration, endpoint behavior and the governance controls
- [Tool schemas](https://zato.io/docs/ai/mcp/tool-schemas.html) - How a service's docstring and declared I/O become its tool definition
- [MCP gateway security](https://zato.io/docs/ai/mcp/security.html) - API keys, Basic Auth and bearer tokens for AI agents
- [MCP response controls](https://zato.io/docs/ai/mcp/response-controls.html) - PII removal, prompt-injection safeguards and token-denominated size caps
- [MCP audit log](https://zato.io/docs/ai/mcp/audit-log.html) - What each agent did, when and with what outcome - payloads never recorded
- [MCP alerts](https://zato.io/docs/ai/mcp/alerts.html) - Failing backends, agents stuck in a loop and gateways with too many tools
- [Cost and limits](https://zato.io/docs/ai/cost-and-limits.html) - Every setting that caps AI cost and traffic, with worked examples
- [GitOps for AI integrations](https://zato.io/docs/ai/enmasse.html) - LLM connections and MCP gateways as YAML in version control
- [AI examples](https://zato.io/docs/ai/examples/) - Complete, runnable scenarios - one real-world need per file