Search DevTools

Jump to any tool or page

gateway

MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.

Edison-Watch0 stars0 forksAI & Agents
View source

Install

mcp_config.json

{
  "mcpServers": {
    "ai-sealgate-gateway": {
      "url": "https://mcp.sealgate.ai/mcp",
      "type": "streamable-http"
    }
  }
}

Documentation

Sealgate MCP Server

The Model Context Protocol (MCP) server for Sealgate, the AI data-leak-prevention platform: a security gateway and data firewall that sits between AI agents (Claude, ChatGPT, Cursor, Copilot) and your organisation's data and tools.

This server is a thin MCP proxy. It forwards a small set of tool calls to a Sealgate gateway, which you configure with two environment variables. Sealgate runs managed release hosts (the remote MCP gateway at mcp.sealgate.ai and the Management API at dashboard.sealgate.ai), and demo or self-hosted orgs run their own, so this bridge stays host-agnostic: you supply the URL and key.

Tools

ToolWhat it does
list_mcp_serversList the MCP servers governed by your Sealgate gateway, with access-control classification and connection status.
get_session_statusReview recent agent sessions and audit events: what agents did, which data flowed, and any blocked actions.

Connect to the hosted gateway

Sealgate runs a managed remote MCP gateway at https://mcp.sealgate.ai/mcp. It is a per-user proxy that aggregates every MCP server you have enabled behind one Streamable HTTP endpoint and enforces Sealgate's access-control policies on every call. There is nothing to install: point your client at the endpoint and sign in through the browser.

Endpoint:   https://mcp.sealgate.ai/mcp
Transport:  streamable HTTP (remote, not stdio)
Auth:       OAuth 2.1 in the browser, no key to paste
ClientAdd it
ClaudeAdd to Claude opens the Add custom connector dialog with the name and URL filled in. Claude flags it as suggested by an external link; that is expected. On Team and Enterprise plans an admin adds it.
ChatGPTSettings → Connectors → Advanced settings → turn on Developer mode. Back on Connectors, click Create, paste the endpoint, and name it. Start a new chat so the tools menu refreshes.
Claude Codeclaude mcp add --transport http --scope user sealgate https://mcp.sealgate.ai/mcpThen run /mcp in a session to sign in.
CursorNot working? Add the endpoint by hand under Settings → MCP.
VS CodeAdd to VS Code requires Copilot agent mode.
GooseAdds it as an extension over streamable HTTP.
GrokbotAdd a remote MCP server pointing at https://mcp.sealgate.ai/mcp over streamable HTTP, then sign in through the browser.
Any MCP clientAdd a remote server at https://mcp.sealgate.ai/mcp over streamable HTTP. Cline, Zed and Windsurf all work; each spells the config differently (VS Code servers, Cursor and Cline mcpServers, Zed context_servers, and Windsurf wants serverUrl where everyone else wants url).

Every one-click button routes through an https:// install URL, since GitHub strips custom URL schemes such as cursor:// from links.

How OAuth works

The gateway is an OAuth 2.1 authorization server, so most clients connect with no API key at all. The flow uses dynamic client registration (RFC 7591) and client ID metadata documents, mandatory PKCE (S256), and issues refresh tokens via the offline_access scope, so a session stays connected without re-authenticating every hour. Discovery, consent, and token endpoints all live on the gateway origin, so self-hosted single-origin deployments work with no extra configuration.

API key in the URL

Clients that cannot run an OAuth flow can pass a Sealgate API key as a URL path segment instead:

https://mcp.sealgate.ai/mcp/{api_key}/?client={label}

Replace {api_key} with the key from your dashboard and {label} with an optional session label. This is not OAuth and not an Authorization header; the key travels in the path.

mcp.sealgate.ai is the managed release host. Demo and self-hosted orgs run their own gateway host, so substitute your own URL where needed.

Configuration

Set two environment variables, both issued or hosted by your organisation:

VariableDescription
SEALGATE_GATEWAY_URLBase URL of your Sealgate Management API (e.g. https://dashboard.sealgate.ai).
SEALGATE_API_KEYSealgate API key from your dashboard.

If either is unset, every tool returns a clear configuration message instead of failing, so registry probes and --help never crash.

Install

Add the server to your MCP client. It runs over stdio via npx.

Claude Desktop, Cursor

{
    "mcpServers": {
        "sealgate": {
            "command": "npx",
            "args": ["-y", "@sealgate/mcp"],
            "env": {
                "SEALGATE_GATEWAY_URL": "https://dashboard.sealgate.ai",
                "SEALGATE_API_KEY": "your-sealgate-api-key"
            }
        }
    }
}

VS Code

{
    "servers": {
        "sealgate": {
            "type": "stdio",
            "command": "npx",
            "args": ["-y", "@sealgate/mcp"],
            "env": {
                "SEALGATE_GATEWAY_URL": "https://dashboard.sealgate.ai",
                "SEALGATE_API_KEY": "your-sealgate-api-key"
            }
        }
    }
}

Copy-paste configs also live in examples/.

Usage

# Run over stdio (default transport)
npx -y @sealgate/mcp

# Show usage
npx -y @sealgate/mcp --help

Set SEALGATE_MCP_TRANSPORT=http (with an optional PORT, default 3000) to serve streamable HTTP instead of stdio.

Develop

Requires Bun.

bun install
bun run src/index.ts --help   # run from source
bun test                      # run tests
bun run build                 # bundle to dist/
make ci                       # lint, typecheck, dead-code, and the rest

Links

License

MIT. Copyright GPU-EVM LTD (Sealgate). See LICENSE.

Sourced from the repository README.

More in AI & Agents