# MCP gateways

Expose Python services as tools that AI agents discover and call.

An MCP gateway exposes your Python services as tools that AI clients - Claude Code, Cursor, ChatGPT or any other [MCP](https://modelcontextprotocol.io) client - discover and invoke over the Model Context Protocol. You assign services and security definitions to a gateway, and every compatible client can use them with no client-specific integration code.

Gateways are managed in the dashboard under **AI** > **MCP gateways**, where a three-step wizard creates and edits them. Step 01, **How do agents connect?**, covers the name, URL path and the services, skills and security assignments. Step 02, **What do they receive?**, covers response shaping and the remaining options. Step 03, **Review and go**, shows everything on one screen before the gateway is saved.

> **To build your first gateway end to end,** see the [MCP tutorial](https://zato.io/tutorials/mcp/01.html) - from installation to Claude Code calling your first service in under 5 minutes.

## Configuration {#configuration}

| Field | Meaning |
| --- | --- |
| Name | A unique name for the gateway, used in logs, the dashboard and the [audit log](https://zato.io/docs/ai/mcp/audit-log.html) |
| Active | Whether the gateway accepts requests - MCP clients cannot reach inactive gateways |
| URL path | The path the endpoint is exposed under, e.g. `/mcp/billing` - this is the address MCP clients connect to |
| Services | The services exposed as tools - each service becomes one tool whose input schema is derived from the service's declared input, as described under [tool schemas](https://zato.io/docs/ai/mcp/tool-schemas.html) |
| Skills | The [skills](https://zato.io/docs/ai/skills/index.html) the gateway serves as [MCP prompts](https://zato.io/docs/ai/mcp/prompts.html) - agents read them through `prompts/list` and `prompts/get` |
| Security | The [API key](https://zato.io/docs/security/api-keys.html) and [Basic Auth](https://zato.io/docs/security/basic-auth.html) definitions whose holders may call the gateway - details under [security](https://zato.io/docs/ai/mcp/security.html) |
| OAuth | Whether people sign in through your identity provider instead of sending a key - the gateway then answers unauthenticated requests with a 401 that names its metadata document, as described under [OAuth](https://zato.io/docs/ai/mcp/oauth.html) |
| Scopes | With OAuth on, the scopes the metadata document tells clients to ask for, e.g. `openid profile` |
| Session TTL | How many seconds a session may stay idle before it expires - 30 minutes by default, set through the `session_ttl` attribute in [enmasse](https://zato.io/docs/ai/enmasse.html) |
| Invoke timeout | How many seconds one `tools/call` invocation may run for before it times out - 90 seconds by default, set through the `invoke_timeout` attribute in [enmasse](https://zato.io/docs/ai/enmasse.html) |

Beyond these, each gateway has its own governance configuration, described under [Governance](https://zato.io/docs/ai/mcp/index.html#governance).

## Endpoint behavior {#endpoint-behavior}

The gateway accepts JSON-RPC 2.0 over HTTP, in both MCP protocol revisions - `2025-06-18`, session-based, and `2026-07-28`, stateless. Clients pick per request and one gateway serves both at the same time. Sessions are bound to the identity that created them and expire after the Session TTL above.

Each JSON-RPC request is an HTTP POST and receives one JSON response. A notification, e.g. `notifications/initialized`, is accepted with `202 Accepted` and no body, and a DELETE with the `Mcp-Session-Id` header ends a session. The gateway does not open server-sent events (SSE) streams - a GET returns `405 Method Not Allowed` and MCP clients continue over POST. A body that is empty or not valid JSON returns the JSON-RPC error `-32700`, `Parse error`.

## Clients {#clients}

Each AI product connects to a gateway in its own way - a command, a JSON file or a form - and with either a key or a sign-in through your identity provider. One page per product says what to paste and where:

| Client | How it connects |
| --- | --- |
| [VS Code](https://zato.io/docs/ai/mcp/clients/vscode.html) | An entry in `.vscode/mcp.json`, with a header or an OAuth client ID |
| [Cursor](https://zato.io/docs/ai/mcp/clients/cursor.html) | An entry in `.cursor/mcp.json`, with a header or an OAuth client ID |
| [Claude Code](https://zato.io/docs/ai/mcp/clients/claude-code.html) | One `claude mcp add` command, with a header or an OAuth client ID |
| [Claude.ai and Claude Desktop](https://zato.io/docs/ai/mcp/clients/claude.html) | A custom connector with the gateway's URL and an OAuth client ID |
| [ChatGPT](https://zato.io/docs/ai/mcp/clients/chatgpt.html) | An app with the gateway's URL, registering itself with the identity provider or using a client ID |
| [Microsoft 365 Copilot](https://zato.io/docs/ai/mcp/clients/microsoft-365-copilot.html) | An MCP tool of a Copilot Studio agent, signing people in through Entra ID |

The [sharing](https://zato.io/docs/ai/mcp/sharing-with-clients.html) page has the export that gives a client team the gateway's address and tools in one document, and the [OAuth](https://zato.io/docs/ai/mcp/oauth.html) page has what the sign-in needs on the gateway and at the identity provider.

## Governance {#governance}

Every control below is per-gateway and takes effect immediately when saved - no restarts.

| Control | What it does |
| --- | --- |
| [Security](https://zato.io/docs/ai/mcp/security.html) | Requires API key, Basic Auth or [bearer token](https://zato.io/docs/security/bearer-tokens/index.html) credentials on every request, with rejections logged |
| [OAuth](https://zato.io/docs/ai/mcp/oauth.html) | Has people sign in through your identity provider, with access decided by group membership and each person recorded by name |
| [Rate limits](https://zato.io/docs/ai/mcp/rate-limits.html) | Caps each agent's traffic, enforced per security definition |
| [Audit log](https://zato.io/docs/ai/mcp/audit-log.html) | Records one event per request, with the method, tool, caller, outcome and sizes |
| [Alerts](https://zato.io/docs/ai/mcp/alerts.html) | Raises an alert when the backend fails, when agents call tools that do not exist or loop over one, and when the gateway exposes too many tools |
| [Argument validation](https://zato.io/docs/ai/mcp/argument-validation.html) | Checks tools/call arguments against each tool's schema before the tool runs |
| [Response controls](https://zato.io/docs/ai/mcp/response-controls.html) | Applies PII removal, prompt-injection safeguards and token-denominated size caps to tool responses |
| [Agent filters](https://zato.io/docs/ai/mcp/agent-filters.html) | Runs a per-call JSONata expression the agent sends, returning only the fields it needs |
| [Sharing with clients](https://zato.io/docs/ai/mcp/sharing-with-clients.html) | Exports the gateway's address, headers and tools as one `server.json` document for client teams |

## See also {#see-also}

- [Tool schemas](https://zato.io/docs/ai/mcp/tool-schemas.html) - How each service's input and output become its tool schema
- [Security](https://zato.io/docs/ai/mcp/security.html) - API keys, Basic Auth and bearer tokens for gateways
- [OAuth](https://zato.io/docs/ai/mcp/oauth.html) - Sign-in through Entra ID, Keycloak or another identity provider
- [Audit log](https://zato.io/docs/ai/mcp/audit-log.html) - One event per agent request, with caller, tool and outcome
- [MCP tutorial](https://zato.io/tutorials/mcp/01.html) - A gateway built and called from Claude Code, end to end

## Learn more {#learn-more}

- [MCP tutorial](https://zato.io/tutorials/mcp/01.html) - Expose Python services as AI tools and connect Claude Code in minutes
- [AI Integrations overview](https://zato.io/docs/ai/) - Both directions of AI traffic in one platform, and where to start
- [Tool schemas](https://zato.io/docs/ai/mcp/tool-schemas.html) - How a service's docstring and declared I/O become its tool definition
- [MCP gateway security](https://zato.io/docs/ai/mcp/security.html) - API keys, Basic Auth and bearer tokens for AI agents
- [MCP response controls](https://zato.io/docs/ai/mcp/response-controls.html) - PII removal, prompt-injection safeguards and token-denominated size caps
- [MCP audit log](https://zato.io/docs/ai/mcp/audit-log.html) - What each agent did, when and with what outcome - payloads never recorded
- [MCP alerts](https://zato.io/docs/ai/mcp/alerts.html) - Failing backends, agents stuck in a loop and gateways with too many tools
- [Cost and limits](https://zato.io/docs/ai/cost-and-limits.html) - Every setting that caps AI cost and traffic, with worked examples
- [GitOps for AI integrations](https://zato.io/docs/ai/enmasse.html) - LLM connections and MCP gateways as YAML in version control
- [AI examples](https://zato.io/docs/ai/examples/) - Complete, runnable scenarios - one real-world need per file