Keep an existing integration
Connect a service through its existing MCP server and publish selected tools alongside native GateRook connectors. Your AI client only needs the GateRook endpoint.
MCP servers · MCP Firewall integration
Put external MCP tools behind your rules and approvals.
Add existing MCP servers to GateRook’s MCP Firewall alongside your infrastructure connectors. Connect a local stdio process or a Streamable HTTP URL, review discovered tools, and choose what AI may call. Endpoint modes control access and approval; Activity records the calls. External server code still runs with its own permissions.
Connection in GateRook
everything
MCP servers
dev- Name
- everything
- Transport
- stdio
- Command
- npx -y @modelcontextprotocol/server-everything@2.0.0 stdio
- Variables or headers
- None for this echo example
The security boundary
Your AI requests a tool. GateRook checks its mode and policy, requires approval when configured, and resolves credentials locally before an allowed call runs.
Understand the request flowAsk your AI
Use the Everything test server to echo “GateRook connection ready”.
everything_echo · arguments
{
"message": "GateRook connection ready"
}Example result
{
"content": [
{
"type": "text",
"text": "Echo: GateRook connection ready"
}
],
"isError": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Useful access. Explicit control.
What you can do with MCP servers and AI
Centralize tool decisions
Choose which external tools are off, which need approval and which reviewed read tools may run without a prompt. See the server and exact arguments when an approval is requested.
Review tool changes
When a server changes a reviewed tool definition, GateRook stops the call until the change is reviewed. An approval for the old definition cannot execute against the new one.
From service to MCP Firewall
How to connect MCP servers
GateRook must be running on a computer that can reach your service. Open Connectors, choose MCP servers, then Add MCP server. Select stdio or Streamable HTTP and review the server before starting it.
New to GateRook? Start with the full setup guide.Choose a server you trust
Prepare a local command with a pinned package version or the Streamable HTTP URL of your server. Local commands run with your user permissions; inspect the server before starting it.
Add and review the server
Open Connectors, choose MCP servers and Add MCP server. Enter its name and transport, configure the command or URL, then choose Review and start. Review the exact process or remote destination before confirming.
Bind the required secrets
For stdio, choose which environment variables receive values from Secrets. For HTTP, configure the required headers from Secrets. The echo example requires neither. Only explicitly bound secrets are injected; the core’s own secret environment variables are not inherited. The process also receives baseline environment variables such as PATH.
Review discovered tools
Inspect each tool name, description and input schema before exposing it on an endpoint. Newly added server tools are not automatically published to your AI clients; the initial endpoint mode for external tools is Approval.
Choose the endpoint and tool modes
Add the reviewed server tools to an endpoint. Keep the initial Approval mode for the first call and leave unused tools Off. Only move a trusted server-declared read tool to Read only after reviewing its implementation and permissions.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure MCP servers in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Name | everything | A server name also supplies its tool prefix; this example exposes everything_echo. |
Transport | stdio | GateRook starts a local command. Choose HTTP instead for a Streamable HTTP server URL. |
Command | npx -y @modelcontextprotocol/server-everything@2.0.0 stdio | Illustrative test server version exercised by this repository. Review the package before running it; this command needs Node.js and npx on the computer. |
Variables or headers | None for this echo example | For authenticated servers, bind only the required environment variables or HTTP headers to secrets stored in GateRook. |
Know what you expose
MCP servers tools and access boundaries
The connector defines available operations. GateRook’s MCP Firewall enforces endpoint modes and connection policies before an AI client can use them.
| Tool | Purpose | Access behavior |
|---|---|---|
everything_echo | Example discovered tool from the pinned Everything test server. It echoes a message; this name is specific to the configured server and prefix. | Approval initially |
Server-defined tools | The connected server supplies the actual tool names and schemas. GateRook prefixes them and stores the reviewed definitions. | Configured per endpoint |
Before you enable access
- Tool capabilities and input schemas come from the external server. The echo example is a test integration, not a built-in tool available for every server.
- Read-only annotations are claims made by the server. GateRook cannot verify what external code does with its arguments or credentials.
- Local stdio servers run as processes on this computer. An MCP approval layer does not sandbox that process or remove its operating-system permissions.
- HTTP connections use Streamable HTTP over HTTPS, with plain HTTP allowed for localhost. Access to private destinations is also subject to policy.
- External tools begin in Approval when added to an endpoint. Tools not declared read-only are treated as potentially mutating and require approval.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
MCP servers connection questions
Review and start lists the server tools. Use Playground and Activity to inspect endpoint permissions and tool calls.
Is this the same as connecting an AI client?
They are different sides of the MCP Firewall. An external MCP server supplies tools to GateRook. Claude, Codex, Cursor or another MCP client connects to a GateRook endpoint to use the tools you publish.
Can I use a remote MCP server?
Yes, choose the HTTP transport and provide its Streamable HTTP URL. Configure any required headers from Secrets and check destination policies. Legacy SSE is not a transport option in this connector.
Does a server’s read-only label guarantee it cannot write?
No. An external server declares that annotation itself. Keep unfamiliar tools in Approval and review the server implementation and permissions before deciding which reads to allow.
What if an MCP server changes its tools?
GateRook compares calls with the reviewed tool definitions. A changed definition blocks execution and must be reviewed again; a previously approved call is not silently transferred to the changed tool.
Keep exploring
Extend control across your stack
HTTP API
Put HTTP APIs behind GateRook’s MCP Firewall. Protect API keys, restrict destinations and paths, and approve requests that change data.
SSH
Control AI access to SSH with GateRook. Verify host keys, use predefined runbooks and review rendered commands before approving server changes.
PostgreSQL
Put PostgreSQL behind GateRook’s MCP Firewall. Follow the illustrated setup, scope AI queries, approve an UPDATE and inspect its Activity audit trail.
Your MCP Firewall. Your access rules.
Control AI access to MCP servers.
Start with read-only access. Approve changes. Inspect the audit trail.