Core concepts
Servers, tools, policies, approvals, access requests and the audit log, and how a call moves through them.
Servers
An MCP server is a connection Gatehouse makes on your agents' behalf. It's either a remote URL (Streamable HTTP) or a local command (stdio). Gatehouse stores the server's credentials encrypted and adds them only when it calls the server.
A server's credentials are either shared (one organization credential) or per person (each person connects their own, so an agent never has more access than its human).
A server is requestable (anyone can see its tools and ask for access) or private (hidden from anyone without access).
Tools
Every tool appears as server__tool, for example github__create_pull_request. A tool's status is one of:
| Status | Meaning |
|---|---|
| Needs review | New. Off until an admin enables it. |
| On | Agents can call it, if a policy allows. |
| Off | Disabled by an admin. |
| Changed · paused | The server changed the tool's description or inputs after approval. Paused until reviewed. |
Policies
A policy says what happens when a call matches it: Allow, Require approval or Deny. Policies match on tool names (with * wildcards), groups or people, and conditions on the call's arguments. When several match, the strictest wins. When none match, the call is denied.
Approvals
When a policy requires approval, the agent's call waits. The approvers get a request in the console and in Slack showing who asked, which agent, the tool and the exact arguments. The call continues when someone approves, and fails with the reason if they deny or nobody answers in time. Nobody can approve their own request.
Access requests
People can ask for tools they can't use yet, straight from their agent. Admins approve or reject in the console. Approving turns the tools on and adds a policy for that person.
Audit log
Every call, decision and admin change is written to an append-only log. Each entry includes a hash of the previous entry, so editing or deleting history is detectable.
How one call is handled
- Identity. The agent's token identifies the person. Sessions are bound to the person who opened them.
- Tool check. The tool must be on and still match the approved definition.
- Secret scan. Arguments containing credentials are refused.
- Policy. The strictest matching rule decides.
- Approval, when the policy requires one.
- Credentials. Gatehouse calls the server with the stored credential.
- Result scan and audit. Secrets in the result are redacted, then the call is recorded.