dome gateways

dome gateways manages workspace-scoped groupings of callable resources — MCP tool connections, LLM pools, and direct LLM model connections — plus the agent access grants that govern each grouping. Refer to Gateways for the concept model.

Resource-side mirrors live under dome tools gateways and dome models pool gateways (each with list, add, remove). Attach at create time with --gateway on dome tools add, dome models add, and dome models pool create.

Gateways

List gateways

dome gateways list

List Gateways in the active workspace: name, default marker, ID, state, and canonical endpoint path (/gateways/<id>). Alias: ls.

The endpoint column shows one path per Gateway — the single URL every client points at. The Dome SDK and Anthropic clients use it as-is; MCP clients append /mcp; OpenAI-compatible clients append /v1. Refer to Endpoint shape.

Get gateway

dome gateways get <name-or-id>

Show a Gateway's members — tools, tool sources (connections), LLM pools, and direct model connections — plus its canonical endpoint path (/gateways/<id>), state, default marker, and grant settings.

Create gateway

dome gateways create <name>

Create a Gateway. Starts active with empty membership; attach resources with the membership commands or --gateway at resource create.

dome gateways create prod-tools --description "Production MCP tools for the ops agent"

Update gateway

dome gateways update <name-or-id>

Rename or edit the description. Toggle state with enable / disable.

Enable gateway

dome gateways enable <name-or-id>

Re-enable a disabled Gateway. Membership and grants are preserved.

Disable gateway

dome gateways disable <name-or-id>

Disable a Gateway. Its endpoint fails closed until re-enabled.

Set default gateway

dome gateways set-default <name-or-id>

Mark a Gateway as the workspace default — the pre-checked (but overridable) Gateway in the dashboard's tool, pool, and model create dialogs. A suggestion only; it enforces no membership and grants no access. Setting a new default clears the previous one. A disabled default is never pre-selected.

Delete gateway

dome gateways delete <name-or-id>

Delete a Gateway. Its memberships are removed, but the underlying tools, pools, and model connections are unchanged. Aliases: rm, remove.

Tools

Add tool

dome gateways tools add <gateway-name-or-id> <tool-id>

Add a single MCP tool to a Gateway. <tool-id> is the observed tool's ID from dome tools catalog list. To include every tool from a connection — with newly discovered tools joining automatically — use tool-sources add instead.

Remove tool

dome gateways tools remove <gateway-name-or-id> <tool-id>

Remove a single MCP tool. Alias: rm.

Tool sources

Add tool source

dome gateways tool-sources add <gateway-name-or-id> <connection-name-or-id>

Add an MCP server connection as a tool source. The Gateway includes every tool observed on the connection; newly discovered tools propagate automatically.

Remove tool source

dome gateways tool-sources remove <gateway-name-or-id> <connection-name-or-id>

Remove the tool source. Tools that joined only through this source stop being included. Alias: rm.

Model pools

Add model pool

dome gateways model-pools add <gateway-name-or-id> <pool-name-or-id>

Add an LLM pool. The Gateway exposes the pool's models at its /gateways/<id>/v1 endpoint.

Remove model pool

dome gateways model-pools remove <gateway-name-or-id> <pool-name-or-id>

Alias: rm.

Models

Add model

dome gateways models add <gateway-name-or-id> <model-name-or-id>

Add a direct (un-pooled) LLM model connection. The Gateway exposes the model without going through a pool — useful when a single provider serves one purpose.

Remove model

dome gateways models remove <gateway-name-or-id> <model-name-or-id>

Alias: rm.

Access

List access

dome gateways access list <name-or-id>

List agents and whether each is currently granted access to the Gateway. Revoked agents are excluded — they cannot exchange their API key for a JWT, so they can never reach a gateway. Suspended agents remain in the list because suspension is reversible.

dome gateways access list prod-tools --json

Grant access

dome gateways access grant <gateway-name-or-id> <agent-name-or-id>

Grant one agent access. Requires the agent-access permission set (agents.register + rules.deploy).

Revoke access

dome gateways access revoke <gateway-name-or-id> <agent-name-or-id>

Revoke one agent's access.

Grant access to all agents

dome gateways access grant-all <name-or-id>

Grant every current and future workspace agent access to this Gateway. Requires rules.deploy + gateways.manage.

Revoke access from all agents

dome gateways access revoke-all <name-or-id>

Clear the all-agents grant. Per-agent grants are unaffected.

Interactive access

Enable interactive access

dome gateways interactive enable <name-or-id> \
  --email <email> \
  --subject <idp-subject>

Enable browser sign-in for human MCP clients. Requires gateways.manage and rules.deploy.

The command creates or updates a visible managed agent named gateway-interactive-<id>. Human traffic spends that agent's Quotas and uses its Rules.

Pass at least one email or subject. The command replaces both allow-lists with exactly the supplied values. Interactive login does not match group allow-lists.

Use dome gateways get <name-or-id> to inspect the managed agent and current allow-lists. Use its mcp_url as the remote server URL in the MCP client.

Disable interactive access

dome gateways interactive disable <name-or-id>

Disable new sign-ins and token renewal. The managed agent and allow-lists remain for later re-enabling; existing access tokens expire within minutes.

Cap Gateway LLM spend with dome quotas (--subject gateway --gateway <name>).