> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# dome gateway

> Manage Gateways, their members, agent access grants, and cost quotas

`dome gateway` manages workspace-scoped groupings of callable resources — MCP tool connections, LLM pools, and direct LLM model connections — plus the agent access grants and cost caps that govern each grouping. Refer to [Gateways](/connect/gateways) for the concept model.

Resource-side mirrors live under [`dome tool gateways`](/cli/connect/tools#gateways) and [`dome model pool gateways`](/cli/connect/models#pool-gateways) (each with `list`, `add`, `remove`). Attach at create time with `--gateway` on `dome tool add`, `dome model add`, and `dome model pool create`.

| Command                                     |                                                           |
| ------------------------------------------- | --------------------------------------------------------- |
| [List](#list)                               | `dome gateway list`                                       |
| [Get](#get)                                 | `dome gateway get <name-or-id>`                           |
| [Create](#create)                           | `dome gateway create <name>`                              |
| [Update](#update)                           | `dome gateway update <name-or-id>`                        |
| [Enable](#enable)                           | `dome gateway enable <name-or-id>`                        |
| [Disable](#disable)                         | `dome gateway disable <name-or-id>`                       |
| [Set default](#set-default)                 | `dome gateway set-default <name-or-id>`                   |
| [Delete](#delete)                           | `dome gateway delete <name-or-id>`                        |
| [Tools add](#tools-add)                     | `dome gateway tools add <gateway> <tool-id>`              |
| [Tools remove](#tools-remove)               | `dome gateway tools remove <gateway> <tool-id>`           |
| [Tool-sources add](#tool-sources-add)       | `dome gateway tool-sources add <gateway> <connection>`    |
| [Tool-sources remove](#tool-sources-remove) | `dome gateway tool-sources remove <gateway> <connection>` |
| [Model-pools add](#model-pools-add)         | `dome gateway model-pools add <gateway> <pool>`           |
| [Model-pools remove](#model-pools-remove)   | `dome gateway model-pools remove <gateway> <pool>`        |
| [Models add](#models-add)                   | `dome gateway models add <gateway> <model>`               |
| [Models remove](#models-remove)             | `dome gateway models remove <gateway> <model>`            |
| [Access list](#access-list)                 | `dome gateway access list <gateway>`                      |
| [Access grant](#access-grant)               | `dome gateway access grant <gateway> <agent>`             |
| [Access revoke](#access-revoke)             | `dome gateway access revoke <gateway> <agent>`            |
| [Access grant-all](#access-grant-all)       | `dome gateway access grant-all <gateway>`                 |
| [Access revoke-all](#access-revoke-all)     | `dome gateway access revoke-all <gateway>`                |
| [Quota list](#quota-list)                   | `dome gateway quota list [gateway]`                       |
| [Quota set](#quota-set)                     | `dome gateway quota set <gateway> --limit <usd>`          |
| [Quota update](#quota-update)               | `dome gateway quota update <quota-id> [flags]`            |
| [Quota remove](#quota-remove)               | `dome gateway quota rm <quota-id>`                        |

***

## List

`dome gateway list`

List Gateways in the active workspace: name, default marker, ID, state, and canonical endpoint path (`/gateways/<id>`). Alias: `ls`.

The endpoint column shows one path per Gateway — the single URL every client points at. The Dome SDK and Anthropic clients use it as-is; MCP clients append `/mcp`; OpenAI-compatible clients append `/v1`. Refer to [Endpoint shape](/connect/gateways#build-the-runtime-endpoint).

## Get

`dome gateway get <name-or-id>`

Show a Gateway's members — tools, tool sources (connections), LLM pools, and direct model connections — plus its canonical endpoint path (`/gateways/<id>`), state, default marker, and grant settings.

## Create

`dome gateway create <name>`

Create a Gateway. Starts active with empty membership; attach resources with the membership commands or `--gateway` at resource create.

| Flag            | Type   | Required | Default | Description                |
| --------------- | ------ | -------- | ------- | -------------------------- |
| `--description` | string | No       | —       | Human-readable description |

```bash theme={"system"}
dome gateway create prod-tools --description "Production MCP tools for the ops agent"
```

## Update

`dome gateway update <name-or-id>`

Rename or edit the description. Toggle state with [`enable`](#enable) / [`disable`](#disable).

| Flag            | Type   | Required | Default | Description      |
| --------------- | ------ | -------- | ------- | ---------------- |
| `--name`        | string | No       | —       | New Gateway name |
| `--description` | string | No       | —       | New description  |

## Enable

`dome gateway enable <name-or-id>`

Re-enable a disabled Gateway. Membership and grants are preserved.

## Disable

`dome gateway disable <name-or-id>`

Disable a Gateway. Its endpoint fails closed until re-enabled.

## Set default

`dome gateway set-default <name-or-id>`

Mark a Gateway as the workspace default — the pre-checked (but overridable) Gateway in the dashboard's tool, pool, and model create dialogs. A suggestion only; it enforces no membership and grants no access. Setting a new default clears the previous one. A disabled default is never pre-selected.

## Delete

`dome gateway delete <name-or-id>`

Delete a Gateway. Its memberships are removed, but the underlying tools, pools, and model connections are unchanged. Aliases: `rm`, `remove`.

<Warning>
  Callers pointed at this Gateway's `/gateways/<id>/…` endpoint will fail closed after deletion. Repoint them at another Gateway first.
</Warning>

***

## Tools add

`dome gateway tools add <gateway-name-or-id> <tool-id>`

Add a single MCP tool to a Gateway. `<tool-id>` is the observed tool's ID from [`dome tool catalog list`](/cli/connect/tools#catalog-list). To include every tool from a connection — with newly discovered tools joining automatically — use [`tool-sources add`](#tool-sources-add) instead.

## Tools remove

`dome gateway tools remove <gateway-name-or-id> <tool-id>`

Remove a single MCP tool. Alias: `rm`.

## Tool-sources add

`dome gateway tool-sources add <gateway-name-or-id> <connection-name-or-id>`

Add an MCP server connection as a tool source. The Gateway includes every tool observed on the connection; newly discovered tools propagate automatically.

## Tool-sources remove

`dome gateway tool-sources remove <gateway-name-or-id> <connection-name-or-id>`

Remove the tool source. Tools that joined only through this source stop being included. Alias: `rm`.

## Model-pools add

`dome gateway model-pools add <gateway-name-or-id> <pool-name-or-id>`

Add an LLM pool. The Gateway exposes the pool's models at its `/gateways/<id>/v1` endpoint.

## Model-pools remove

`dome gateway model-pools remove <gateway-name-or-id> <pool-name-or-id>`

Alias: `rm`.

## Models add

`dome gateway models add <gateway-name-or-id> <model-name-or-id>`

Add a direct (un-pooled) LLM model connection. The Gateway exposes the model without going through a pool — useful when a single provider serves one purpose.

## Models remove

`dome gateway models remove <gateway-name-or-id> <model-name-or-id>`

Alias: `rm`.

***

## Access list

`dome gateway access list <name-or-id>`

List agents and whether each is currently granted access to the Gateway. Revoked agents are excluded — they cannot exchange their API key for a JWT, so they can never reach a gateway. Suspended agents remain in the list because suspension is reversible.

```bash theme={"system"}
dome gateway access list prod-tools --json
```

## Access grant

`dome gateway access grant <gateway-name-or-id> <agent-name-or-id>`

Grant one agent access. Requires the agent-access permission set (`agent.register` + `rules.deploy`).

## Access revoke

`dome gateway access revoke <gateway-name-or-id> <agent-name-or-id>`

Revoke one agent's access.

## Access grant-all

`dome gateway access grant-all <name-or-id>`

Grant every current and future workspace agent access to this Gateway. Requires `rules.deploy` + `gateway.manage`.

## Access revoke-all

`dome gateway access revoke-all <name-or-id>`

Clear the all-agents grant. Per-agent grants are unaffected.

***

## Quota list

`dome gateway quota list [gateway-name-or-id]`

List Gateway cost quotas (USD spend caps on a whole Gateway's aggregate LLM spend). Optionally filter to one Gateway. Alias: `ls`.

## Quota set

`dome gateway quota set <gateway-name-or-id> --limit <usd>`

Create a USD spend cap that covers every LLM call routed through the Gateway's member pools and direct connections. Once window spend exceeds the cap, calls to the Gateway return HTTP `429`.

| Flag         | Type   | Required | Default   | Description                                    |
| ------------ | ------ | -------- | --------- | ---------------------------------------------- |
| `--limit`    | string | Yes      | —         | Spend cap in US dollars, e.g. `500` or `12.50` |
| `--window`   | string | No       | `monthly` | Reset window: `daily` or `monthly`             |
| `--name`     | string | No       | —         | Human-readable quota label                     |
| `--disabled` | bool   | No       | `false`   | Create in a disabled state                     |

```bash theme={"system"}
dome gateway quota set prod-tools --limit 500 --window monthly --name "prod-monthly"
```

## Quota update

`dome gateway quota update <quota-id> [flags]`

Update a Gateway quota's name, limit, window, or enabled state. The Gateway subject is immutable; create a new quota to cap a different Gateway.

| Flag        | Type   | Description                            |
| ----------- | ------ | -------------------------------------- |
| `--name`    | string | New label                              |
| `--limit`   | string | New spend cap in US dollars            |
| `--window`  | string | New reset window: `daily` or `monthly` |
| `--enabled` | bool   | Enable or disable enforcement          |

## Quota remove

`dome gateway quota rm <quota-id>`

Remove a Gateway cost quota. Aliases: `remove`, `delete`. Refuses IDs of non-Gateway quotas — use [`dome model quota rm`](/cli/connect/models#quota-remove) for those.