> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tools gateway

> Route agent MCP and tool calls through Dome to enforce authorization, inject credentials, and audit every invocation

export const toolsGateway = "The Tools gateway is Dome's MCP ingress for tool traffic at /gateways/<id>/mcp. Dome authenticates the agent, evaluates Rules, injects backend credentials, applies Guards, and audits each invocation.";

<p>
  {toolsGateway}
</p>

## High-level overview

Every tool call targets a [Gateway](/concepts/gateways). Bare `/mcp` fails closed with a `"select a gateway"` 400.

A tool call through the Tools gateway looks like this:

1. An operator adds an MCP server connection, puts it (or its tools) on a Gateway, and grants an agent access.
2. The agent points an MCP client at `https://<host>/gateways/<id>/mcp` with a Dome agent token.
3. Discovery (`tools/list`) returns membership- and Cedar-filtered tools.
4. Each `tools/call` runs admission, Rules, request Guards, egress with injected credentials, response Guards, and audit.

The Tools gateway never exposes backend credentials to the agent.

### Endpoints

| Path (relative to `/gateways/<id>`) | Role                                            |
| ----------------------------------- | ----------------------------------------------- |
| `/mcp`                              | MCP Streamable HTTP session and JSON-RPC frames |

Point MCP clients at the Gateway's returned `mcp_url`. Do not omit the `/gateways/<id>` segment.

### Pipeline

Tool calls share these stages:

1. **Ingress:** Resolve the Gateway from the path, validate the bearer credential, extract agent identity, check Gateway admission (discovery exempt), verify act-as when present, apply kill switches and rate limits.
2. **Evaluate:** Load the workspace Cedar policy and authorize the tool action. Stale policy fails closed.
3. **Egress:** Resolve the backend from the tool catalog, inject stored credentials, forward over MCP Streamable HTTP, stdio, or REST catalog.
4. **Filter:** Apply response Guards and field-level redaction before the agent sees the result.
5. **Audit:** Emit `mcp.tool_call.*`, filtering, discovery, and denial events stamped with the Gateway id.

Details of credential models, denial wire shapes, and deployment topology live on the [Data plane](/concepts/architecture/dataplane) concept.

### Discovery vs invoke

`tools/list` stays membership- and Cedar-filtered and does not require a Gateway access grant at the edge. `tools/call` requires addressability, admission, and Cedar. A tool that is not a member of the addressed Gateway does not appear for that caller.

### Egress protocols

| Protocol                | Use case                                                 |
| ----------------------- | -------------------------------------------------------- |
| **MCP Streamable HTTP** | Primary protocol for MCP-native backends.                |
| **Stdio**               | Local backends spawned by the gateway runtime.           |
| **REST Catalog**        | HTTP tool discovery and invocation for non-MCP backends. |

## Next steps

With the Tools gateway model in mind, continue with:

* [Gateways](/concepts/gateways) concept for membership, grants, and URL shape
* [Data plane](/concepts/architecture/dataplane) concept for the shared pipeline, credentials, and readiness
* [LLM gateway](/concepts/gateways/llm-gateway) concept for the sibling model ingress
* [Tools](/concepts/resources/tools) concept for credentials, catalogs, and reachability
* [Tools](/connect/resources/tools) to register MCP and tool connections
* [Gateways](/connect/gateways) to attach tools to a Gateway