Skip to content
AxecAxec Docs

MCP Gateways

An Axec MCP gateway is an MCP endpoint that Axec hosts and operates, aggregating tools from multiple Connectors behind a single URL. Rather than configuring a separate server in each client for GitHub, Jira, Slack, and an internal knowledge base, you register one gateway and Axec routes each tool call to the owning service.

Gateways and Connectors

Section titled “Gateways and Connectors”

A gateway and an MCP Connector are distinct components. An MCP Connector represents one upstream MCP service, such as GitHub’s MCP server or an internal MCP server, and defines how Axec reaches it and which credentials it requires. A gateway is the endpoint that clients connect to, and it exposes tools from the Connectors that an administrator has attached to it.

Example: A Support Gateway might aggregate a ticketing Connector, a messaging Connector, and an internal knowledge-base Connector. Clients see a single MCP server exposing the tools they are authorized to use, while each upstream service retains its own endpoint and credentials.

Tool aggregation

Section titled “Tool aggregation”

An administrator selects the Connectors that a gateway includes and the tools that each one makes available. On a tool listing request, Axec returns only the tools that the calling User or Application is currently authorized to use. On a tool call, it forwards the request to the Connector that owns the tool and applies that Connector’s upstream credential.

HTTP API Connectors can also be attached to a gateway, because Axec exposes their operations as MCP tools. See Connectors for how MCP tools and HTTP operations map to capabilities.

The tools a client sees depend on its permissions, so two clients using the same gateway can see different tool sets. Attaching a Connector to a gateway does not by itself grant any client access to that Connector’s tools.

Unified endpoint and resource identifier

Section titled “Unified endpoint and resource identifier”

A gateway URL such as https://axec.dev/ws/acme/g/support/mcp is both the MCP endpoint that clients use for tool discovery and invocation and the OAuth resource that they name when requesting authorization. Axec issues the resulting access token for that gateway only, so a client cannot present it to a different gateway or to an upstream service.

Because a single URL serves both roles, a client needs no additional configuration to begin. It works unchanged with MCP-compatible AI clients such as Claude, Cursor, and opencode, with the Axec SDKs, which pass it as the resource parameter during authorization, and with custom agents built on an MCP client library.

A request without a token is rejected with a 401 whose WWW-Authenticate header points the client to the gateway’s OAuth metadata. A request with an Axec access token lists the tools available to the caller:

Terminal window
curl -X POST https://axec.dev/ws/acme/g/support/mcp \
  -H "Authorization: Bearer $AXEC_ACCESS_TOKEN" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}'

Authentication

Section titled “Authentication”

Axec owns the gateway endpoint and secures it with OAuth 2.1, so clients do not need provider-specific authentication logic. A client that connects without a valid token is directed to the standard OAuth flow, in which the User signs in, connects any upstream account that a Connector requires, and approves the requested access.

The client then holds an Axec access token for the gateway and presents it on each request. Upstream provider credentials never reach the client: Axec stores them and applies them when it calls the upstream service.

SDK reference

Section titled “SDK reference”

The Axec SDKs for TypeScript and Python take the gateway URL as the resource when they start authorization, and use the same URL for subsequent MCP requests.

Set up a gateway

Section titled “Set up a gateway”
  1. An administrator creates the gateway and attaches the Connectors to aggregate.
  2. The administrator selects the tools that each Connector exposes through the gateway.
  3. A User or developer registers the gateway URL as the server URL in an MCP-compatible client, or as the resource in an SDK.
  4. The client starts the OAuth flow with Axec, and the User signs in, connects any required upstream accounts, and approves access.
  5. The client lists the tools available to it and invokes them through the gateway.

Continue

Section titled “Continue”