Permit MCP Gateway
Put Permit MCP Gateway in front of your Model Context Protocol (MCP) servers to add authentication, authorization, consent, and audit to every tool call your AI agents make. This page is for AI agent builders and platform teams choosing where to start.
Permit MCP Gateway is a proxy between MCP clients (Cursor, Claude Desktop, Claude Code, VS Code, and other AI tools) and the MCP servers they connect to. For each tool call, the gateway:
- Authenticates the human behind the agent.
- Checks the call against policy in Permit.io.
- Confirms the human consented to the agent's access level.
- Logs the decision.
You don't add an SDK, rewrite agents, or change your MCP servers. You point the MCP client at the gateway URL instead of the MCP server URL. The diagram shows the path of one tool call.
The path of one MCP tool call
- MCP clientCursor, Claude, or VS Code, acting for a human who signed in and set a trust level.
- Permit MCP GatewayVerifies the session and binds every tool call to that human and that agent.
- permit.check()Runs on every tool call: agent trust level, human trust ceiling, and the tool's risk.
- Upstream MCP serverReceives only allowed calls. Upstream OAuth tokens stay with the gateway, and the server is unchanged.
- Audit logEvery allowed or denied tool call, with the human, the agent, and the reason.
What the gateway gives developers and platform teams
- Three setup steps: create a host, import an MCP server, and share the gateway URL.
- Existing MCP servers: GitHub, Linear, Slack, Jira, and any other server that speaks MCP.
- Client configuration to copy: the admin dashboard shows snippets for Cursor, Claude Desktop, VS Code, and Claude Code.
- Pass-through runtime: the gateway forwards allowed calls to the MCP server unchanged and returns a permission error for denied calls.
What the gateway gives security, IAM, and governance teams
- Identity-aware access control: each tool call is bound to one human and one agent.
- Least privilege: the gateway classifies each tool by risk (read, write, or destructive), and admins set a maximum trust level per user.
- Consent-based delegation: humans choose how much access an agent gets, up to the maximum the admin set.
- Audit trail: each decision is logged with the human, the agent, the tool, the MCP server, the time, and the allow or deny result.
- Deny by default: no user or agent can call a tool until an admin grants access.
Read the Permit MCP Gateway overview for the security and trust model and a comparison with API gateways and identity and access management (IAM) platforms.
How the gateway uses Permit.io
Permit MCP Gateway runs on Permit.io. Permit is the control plane (where policies are defined) and the default data plane (where decisions are evaluated) for every gateway host.
- Each gateway host maps to one Permit environment. The policies, users, and audit logs for that host live in the linked environment.
- Gateway policies can use Permit's policy models: role-based access control (RBAC), attribute-based access control (ABAC), and relationship-based access control (ReBAC), with policy updates applied on the next tool call.
- You work in two dashboards: app.permit.io for policies and audit logs, and app.agent.security for hosts, MCP servers, and users.
See How Permit MCP Gateway works with Permit.io for the policy model.
Prerequisites
- A Permit.io account.
- Access to the Permit MCP Gateway admin dashboard, where you create hosts, import MCP servers, manage users, and review activity.
Start here
- Follow the Permit MCP Gateway quickstart to get a gateway URL for one MCP server and connect a client.
- Read the Permit MCP Gateway overview to learn what the gateway enforces and when to use it.
- Follow Getting started with Permit MCP Gateway to set up a host for your team, test an allowed and a denied call, and read the audit log.
Find a topic
| Task | Page |
|---|---|
| Manage hosts, MCP servers, and users in the admin UI | Platform reference |
| Grant, limit, and revoke access for humans and their agents | Managing humans and agents |
| Plan multiple hosts and roll the gateway out to teams | Host setup guide |
| Configure SSO, OAuth, and email sign-in for the consent flow | Authentication methods |
| Understand what users see when they authorize an agent | Consent service |
| Read, filter, and investigate activity | Audit logs |
| Review data flows and sequence diagrams | Architecture |
| Govern an agent's outbound HTTP and HTTPS calls outside MCP | HTTP egress proxy |
| Require human approval for high-risk tool calls (Enterprise) | Human-in-the-loop approvals |
| Review other Enterprise controls, such as time-limited consent | Advanced features |
| Run the gateway in your own network or fully on-premises | Enterprise deployment |
Get help
- Ask in the Permit Slack community.
- Use the Permit.io API reference for the underlying authorization API.
- Email support@permit.io.