Cloud · MCP · Security

MCP Gateway: secure, audited access for every AI connector

A hosted gateway that sits in front of every MCP connector we build: OAuth sign-in, per-tool scopes, rate limits, human approval for risky actions, and a complete audit log of every agent request.

Type: AI agent integration (MCP)
Tools: 4 agent tools
Stack: TypeScript, MCP SDK, Cloudflare Workers

The problem

Businesses want Claude and ChatGPT to work with their systems, but the first question from every security team is the same: who can the agent act as, what can it touch, and where is the record? Most MCP servers answer none of that.

The solution

One remote gateway handles identity, permissions, approvals, and logging for all connectors. Each business system gets a thin MCP connector behind it, so security is solved once and reused everywhere.

Tools the agent can use

authorizeOAuth 2.1 sign-in that maps the agent session to a real user and roleRead

list_toolsReturns only the tools that user's role is allowed to callRead

request_approvalPauses a risky call and sends it to a human approverNeeds approval

audit_logEvery call, input, result, and approver, stored append-onlyRead

How it connects

Claude / ChatGPT
MCP Gateway (OAuth, scopes, rate limits)
Approval queue for risky actions
Connector (store, ERP, accounting, booking)
Audit log

Security by design

Least-privilege scopes per tool and per role
Secrets stay server-side; agents never see API keys
PII redaction before data reaches the model
Kill switch per connector and per client

Stack

TypeScriptMCP SDKCloudflare WorkersOAuth 2.1PostgreSQL