Prerequisites

Before you configure MCP Gateway, make sure you have:

AI Gateway v1.5 deployed and running.
An MCP server that uses MCP Streamable HTTP (spec 2025-11-25).
Administrator access to Settings > AI Gateway in the Netskope tenant UI.

Transport	Support in v1.5
MCP Streamable HTTP (spec 2025-11-25)	Supported via JSON-RPC 2.0 over HTTP POST and GET. Recommended for reliable policy enforcement and event logging.
MCP spec versions 2025-03-26 and earlier	stdio transport and legacy SSE-only transport are not validated. The gateway does not block these versions, but event sequencing and policy enforcement are untested and may not work as expected. Use spec 2025-11-25 for full compatibility.

Step 1: Register an MCP Server

Go to Settings > AI Gateway > MCP Providers.
Select Add MCP Server.
Enter the following details:

Field	Description
Name	Enter a unique name for the tenant. The gateway uses this name as the route path segment: `/v1/<name>`. Prefix the name with `mcp-`.
URL	Enter the full upstream MCP server URL, including the path. The gateway uses this URL for routing and OAuth2 metadata matching.
Protocol	Select `HTTPS or HTTP`
Certificate	Add the custom TLS certificate. Required only when you select `https-custom`.
Tool List	Add the tool names you want to use in policies and rate limits. The gateway does not automatically sync this list from the upstream server.
Resource List	Add the resource URIs you want to reference in policies and logs.
Prompt List	Add the prompt names you want to reference in policies and logs.

You can register up to 100 MCP providers per tenant for the initial GA release.

When you save the provider, the gateway creates an HTTP Route at /v1/<name> that points to the upstream server. The route becomes active within seconds.

If the MCP server uses OAuth2, you do not need additional registration settings. The gateway automatically performs transparent OAuth2 relay. For details, see OAuth2 Transparent Relay in this topic.

Step 2: Attach the MCP Server to a Gateway Appliance

Go to Settings > AI Gateway > Appliances.
Select the target appliance.
Under MCP Providers, select the registered server(s).
Select Save. The gateway pushes the configuration automatically, and the route becomes active within seconds.

Step 3: Configure Rate Limits (Optional)

Configure MCP rate limits separately from LLM provider rate limits.

Go to Security Platform > AI Gateway > Rate Limits.

Level	Descriptor key	Scope
Per server	`mcp-provider`	Limits all requests to one MCP server.
Per token group	`token-group`	Limits all requests from a user or group.

MCP provider rate limits cannot be combined with LLM provider rate limits in the same rule.

Step 4: Configure Access Control Policy

Create access control policies.

Go to Policies > AI Gateway > Access Control.
Select New Policy > MCP Server.

You can match MCP traffic on the following dimensions:

Match dimension	Description
Token Group	Matches by user or group identity.
MCP Server	`mcp-provider`
Activity Type	Matches a specific MCP activity. For the full list, see MCP Activity Types in the Monitoring MCP Gateway Events topic.
Tool Name	`mcp-tool`
Resource Name	`mcp-resource`
Prompt Name	`mcp-prompt`

Example: Block all call_tool_request activity to a specific server for users outside an allowed token group.

Step 5: Configure DLP and AI Guardrails (Optional)

DLP and AI Guardrails policies apply to the following MCP content:

Tool call arguments — inspected on the request side.
Tool call results — inspected on the response side.
Resource read content — inspected on the response side.

Configure DLP profiles and AI Guardrails rules the same way you configure them for LLM providers. You do not need additional MCP-specific configuration.

OAuth2 Transparent Relay

For MCP servers that require OAuth2, the gateway relays discovery metadata without storing, validating, or inspecting credentials. You do not need to configure OAuth2 separately during MCP server registration.

The relay works as follows:

The MCP client calls GET /.well-known/oauth-protected-resource/<slug>.
The gateway rewrites the resource URL to the gateway URL and preserves the authorization_servers field as-is.
The MCP client gets token directly from the real authorization server. The gateway is not involved in this step.
The MCP client sends the request to the gateway with the Bearer token.
The gateway forwards the token to the upstream server as-is.

The gateway does not store, validate, or inspect OAuth2 credentials. Tested OAuth2 providers include Notion, Figma, Slack, and Asana.

Traffic Flow

MCP Gateway sits inline between the MCP client and the MCP server, applying rate limiting and content inspection to all traffic passing through.

MCP Client ←→ AI Gateway (rate limiting + content inspection) ←→ MCP Server

How MCP Gateway Counts Transactions

Billable transactions

A transaction counts when an active HTTP request-result pair passes through the gateway and triggers rate limiting, access policies, or content inspection. Each of the following counts as one transaction:

InitializeRequest + InitializeResult
ListToolsRequest + ListToolsResult
CallToolRequest + CallToolResult

What is not counted?

The following system traffic does not count as a transaction:

OAuth requests and responses
Notifications
Completions
Pings
GET requests and task operations