dome gateway manages workspace-scoped groupings of callable resources — MCP tool connections, LLM pools, and direct LLM model connections — plus the agent access grants and cost caps that govern each grouping. Refer to Gateways for the concept model.
Resource-side mirrors live under dome tool gateways and dome model pool gateways (each with list, add, remove). Attach at create time with --gateway on dome tool add, dome model add, and dome model pool create.
List
dome gateway list
List Gateways in the active workspace: name, default marker, ID, state, and canonical endpoint path (/gateways/<id>). Alias: ls.
The endpoint column shows one path per Gateway — the single URL every client points at. The Dome SDK and Anthropic clients use it as-is; MCP clients append /mcp; OpenAI-compatible clients append /v1. Refer to Endpoint shape.
Get
dome gateway get <name-or-id>
Show a Gateway’s members — tools, tool sources (connections), LLM pools, and direct model connections — plus its canonical endpoint path (/gateways/<id>), state, default marker, and grant settings.
Create
dome gateway create <name>
Create a Gateway. Starts active with empty membership; attach resources with the membership commands or --gateway at resource create.
Update
dome gateway update <name-or-id>
Rename or edit the description. Toggle state with enable / disable.
Enable
dome gateway enable <name-or-id>
Re-enable a disabled Gateway. Membership and grants are preserved.
Disable
dome gateway disable <name-or-id>
Disable a Gateway. Its endpoint fails closed until re-enabled.
Set default
dome gateway set-default <name-or-id>
Mark a Gateway as the workspace default — the pre-checked (but overridable) Gateway in the dashboard’s tool, pool, and model create dialogs. A suggestion only; it enforces no membership and grants no access. Setting a new default clears the previous one. A disabled default is never pre-selected.
Delete
dome gateway delete <name-or-id>
Delete a Gateway. Its memberships are removed, but the underlying tools, pools, and model connections are unchanged. Aliases: rm, remove.
Callers pointed at this Gateway’s /gateways/<id>/… endpoint will fail closed after deletion. Repoint them at another Gateway first.
dome gateway tools add <gateway-name-or-id> <tool-id>
Add a single MCP tool to a Gateway. <tool-id> is the observed tool’s ID from dome tool catalog list. To include every tool from a connection — with newly discovered tools joining automatically — use tool-sources add instead.
dome gateway tools remove <gateway-name-or-id> <tool-id>
Remove a single MCP tool. Alias: rm.
dome gateway tool-sources add <gateway-name-or-id> <connection-name-or-id>
Add an MCP server connection as a tool source. The Gateway includes every tool observed on the connection; newly discovered tools propagate automatically.
dome gateway tool-sources remove <gateway-name-or-id> <connection-name-or-id>
Remove the tool source. Tools that joined only through this source stop being included. Alias: rm.
Model-pools add
dome gateway model-pools add <gateway-name-or-id> <pool-name-or-id>
Add an LLM pool. The Gateway exposes the pool’s models at its /gateways/<id>/v1 endpoint.
Model-pools remove
dome gateway model-pools remove <gateway-name-or-id> <pool-name-or-id>
Alias: rm.
Models add
dome gateway models add <gateway-name-or-id> <model-name-or-id>
Add a direct (un-pooled) LLM model connection. The Gateway exposes the model without going through a pool — useful when a single provider serves one purpose.
Models remove
dome gateway models remove <gateway-name-or-id> <model-name-or-id>
Alias: rm.
Access list
dome gateway access list <name-or-id>
List agents and whether each is currently granted access to the Gateway. Revoked agents are excluded — they cannot exchange their API key for a JWT, so they can never reach a gateway. Suspended agents remain in the list because suspension is reversible.
Access grant
dome gateway access grant <gateway-name-or-id> <agent-name-or-id>
Grant one agent access. Requires the agent-access permission set (agent.register + rules.deploy).
Access revoke
dome gateway access revoke <gateway-name-or-id> <agent-name-or-id>
Revoke one agent’s access.
Access grant-all
dome gateway access grant-all <name-or-id>
Grant every current and future workspace agent access to this Gateway. Requires rules.deploy + gateway.manage.
Access revoke-all
dome gateway access revoke-all <name-or-id>
Clear the all-agents grant. Per-agent grants are unaffected.
Quota list
dome gateway quota list [gateway-name-or-id]
List Gateway cost quotas (USD spend caps on a whole Gateway’s aggregate LLM spend). Optionally filter to one Gateway. Alias: ls.
Quota set
dome gateway quota set <gateway-name-or-id> --limit <usd>
Create a USD spend cap that covers every LLM call routed through the Gateway’s member pools and direct connections. Once window spend exceeds the cap, calls to the Gateway return HTTP 429.
Quota update
dome gateway quota update <quota-id> [flags]
Update a Gateway quota’s name, limit, window, or enabled state. The Gateway subject is immutable; create a new quota to cap a different Gateway.
Quota remove
dome gateway quota rm <quota-id>
Remove a Gateway cost quota. Aliases: remove, delete. Refuses IDs of non-Gateway quotas — use dome model quota rm for those.
