Skip to content
AxecAxec Docs

Autonomous gateway access

Use this pattern for a backend worker, cron job, or agent that calls its own Application gateway with workspace-owned automation authority. TypeScript uses ApplicationClient; Python uses GatewayClient. Both use Client Credentials and can use only active vaulted or no-auth attachments belonging to that Application.

import { ApplicationClient } from "@axec/sdk/application";


const gateway = new ApplicationClient({
  baseUrl: "https://axec.example",
  clientId: process.env.AXEC_APP_CLIENT_ID!,
  clientSecret: process.env.AXEC_APP_CLIENT_SECRET!,
  resource: "https://axec.example/g/automation/mcp",
});


const tools = await gateway.mcp().request({
  jsonrpc: "2.0",
  id: 1,
  method: "tools/list",
  params: {},
});

Call only a tool returned by tools/list. Both MCP interfaces send stateless requests with a fresh bearer for the exact gateway Resource, so live Application, attachment, Connector, and credential restrictions take effect on the next call.

Neither interface can use a User Connection, GrantBundle, or credential exchange. Keep the confidential client secret server-side. Use TypeScript gateway.gatewayRequest() only for a non-MCP gateway request; use the MCP interface for standard tool invocation.

Python’s optional axec_sdk.fastmcp integration wraps GatewayClient in a GatewayMcp handler when exposing an Axec-governed gateway through FastMCP. It forwards authority to Axec; it does not create a User principal or release an upstream credential.

See Run an autonomous Application for the authority boundary and evidence checks.

Continue

Section titled “Continue”