Gateways - Dome

Gateway MCP tools manage workspace-scoped groupings of callable resources and the agent access grants that govern them. Refer to Gateways for the concept model. All tools require workspace context.

Gateway CRUD

dome_gateway_list

List Gateways in the active workspace with state, membership counts, and the canonical endpoint path (/gateways/<id>) — the single URL every client points at. The Dome SDK and Anthropic clients use it as-is; MCP clients append /mcp; OpenAI-compatible clients append /v1.

Parameter	Type	Required	Description
—	—	—	No parameters

Permission: gateway.view

dome_gateway_get

Get a Gateway with its members (individual tools, tool sources, LLM pools, direct model connections).

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name

Permission: gateway.view

dome_gateway_create

Create a Gateway. Starts active with empty membership. Until a resource is added it is unreachable.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name (unique within workspace)
`description`	string	No	Free-form description

Permission: gateway.manage

Create a Gateway

{
  "name": "dome_gateway_create",
  "arguments": {
    "name": "prod-tools",
    "description": "Production MCP tools for the ops agent"
  }
}

dome_gateway_update

Rename or edit the description. Use dome_gateway_set_state to enable/disable.

Parameter	Type	Required	Description
`name`	string	Yes	Current Gateway name
`new_name`	string	No	New name (omit to keep)
`description`	string	No	New description

Permission: gateway.manage

dome_gateway_set_state

Enable or disable a Gateway. A disabled Gateway fails closed at its endpoint.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name
`state`	string	Yes	`active` or `disabled`

Permission: gateway.manage

dome_gateway_set_default

Make a Gateway the workspace default — the Gateway pre-checked (but overridable) in dashboard create dialogs. Enforces no membership. Setting a new default clears the previous one.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name

Permission: gateway.manage

dome_gateway_delete

Delete a Gateway. Membership rows cascade; the underlying tools, connections, and pools are untouched. Marked destructive.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name

Permission: gateway.manage

Membership

dome_gateway_tool_add

Add a single MCP tool. Address the tool by its (connection, tool) pair from the observed catalog. Run dome_tools_for_connection to see observed names.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name
`tool`	string	Yes	Tool name as observed (e.g. `create_page`)

Permission: gateway.manage

dome_gateway_tool_remove

Remove an individual tool. The underlying tool is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name
`tool`	string	Yes	Tool name as observed

Permission: gateway.manage

dome_gateway_tool_source_add

Add a tool source (an MCP server connection). The Gateway includes every tool observed on the connection; newly observed tools propagate automatically.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name

Permission: gateway.manage

dome_gateway_tool_source_remove

Remove a tool source. Tools that joined only through this source stop being included; the connection itself is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name

Permission: gateway.manage

dome_gateway_model_pool_add

Add an LLM pool. The Gateway exposes the pool’s models at its /gateways/<id>/v1 endpoint.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`pool`	string	Yes	Pool name

Permission: gateway.manage

dome_gateway_model_pool_remove

Remove an LLM pool. The pool itself is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`pool`	string	Yes	Pool name

Permission: gateway.manage

dome_gateway_model_add

Add a direct (un-pooled) LLM model connection. The Gateway exposes the model without going through a pool.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`model`	string	Yes	Model connection name

Permission: gateway.manage

dome_gateway_model_remove

Remove a direct LLM model connection. The connection itself is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`model`	string	Yes	Model connection name

Permission: gateway.manage

Access grants

Access grants control who can use a Gateway. An agent with no grant is rejected at the edge before Cedar evaluates.

dome_gateway_access_list

List agents and their access state for a Gateway. Revoked agents are excluded to match the CLI and dashboard — a revoked agent cannot exchange its API key for a JWT, so it can never reach the gateway. Suspended agents remain in the list because suspension is reversible.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name

Permission: agent.view

dome_gateway_agent_grant

Grant an agent access to a Gateway.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`agent_id`	string	Yes	Agent ID (UUID)

Permission: agent.register + rules.deploy

dome_gateway_agent_revoke

Revoke an agent’s access. Marked destructive.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`agent_id`	string	Yes	Agent ID (UUID)

Permission: agent.register + rules.deploy

dome_gateway_all_agents_grant

Grant every current and future workspace agent access to a Gateway.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name

Permission: rules.deploy + gateway.manage

dome_gateway_all_agents_revoke

Clear the all-agents grant. Per-agent grants are unaffected. Marked destructive.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name

Permission: rules.deploy + gateway.manage

Cost quotas

dome_gateway_quota_list

List Gateway cost quotas (USD spend caps on a whole Gateway’s aggregate LLM spend). Optionally filter to one Gateway.

Parameter	Type	Required	Description
`gateway`	string	No	Filter to one Gateway

Permission: gateway.view

dome_gateway_quota_set

Create a USD spend cap on a whole Gateway. Covers every LLM call routed through the Gateway’s member pools and direct connections. Once window spend exceeds the cap, calls to the Gateway return HTTP 429.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`limit_usd`	number	Yes	Spend cap in US dollars (e.g. `500` or `12.50`)
`window`	string	No	Reset window: `daily` or `monthly` (default `monthly`)
`name`	string	No	Human-readable label
`disabled`	bool	No	Create disabled (no enforcement until enabled)

Permission: gateway.manage

Cap a Gateway at $500/month

{
  "name": "dome_gateway_quota_set",
  "arguments": {
    "gateway": "prod-tools",
    "limit_usd": 500,
    "window": "monthly",
    "name": "prod-monthly"
  }
}

dome_gateway_quota_update

Update a Gateway quota’s name, limit, window, or enabled state. Omitted fields stay unchanged. The Gateway subject is immutable, and the tool refuses IDs for other quota subject types.

Parameter	Type	Required	Description
`quota_id`	string	Yes	Quota ID from `dome_gateway_quota_list`
`name`	string	No	New human-readable label
`limit_usd`	number	No	New spend cap in US dollars
`window`	string	No	New reset window: `daily` or `monthly`
`enabled`	bool	No	Enable or disable enforcement

Permission: gateway.manage

dome_gateway_quota_remove

Remove a Gateway cost quota by ID. Refuses IDs of non-Gateway quotas — use dome_model_quota_remove for those. Marked destructive.

Parameter	Type	Required	Description
`quota_id`	string	Yes	Quota ID from `dome_gateway_quota_list`

Permission: gateway.manage

Next steps

Membership and grants have a full how-to under Connect:

​Gateway CRUD

​dome_gateway_list

​dome_gateway_get

​dome_gateway_create

​dome_gateway_update

​dome_gateway_set_state

​dome_gateway_set_default

​dome_gateway_delete

​Membership

​dome_gateway_tool_add

​dome_gateway_tool_remove

​dome_gateway_tool_source_add

​dome_gateway_tool_source_remove

​dome_gateway_model_pool_add

​dome_gateway_model_pool_remove

​dome_gateway_model_add

​dome_gateway_model_remove

​Access grants

​dome_gateway_access_list

​dome_gateway_agent_grant

​dome_gateway_agent_revoke

​dome_gateway_all_agents_grant

​dome_gateway_all_agents_revoke

​Cost quotas

​dome_gateway_quota_list

​dome_gateway_quota_set

​dome_gateway_quota_update

​dome_gateway_quota_remove

​Next steps

Gateway CRUD

dome_gateway_list

dome_gateway_get

dome_gateway_create

dome_gateway_update

dome_gateway_set_state

dome_gateway_set_default

dome_gateway_delete

Membership

dome_gateway_tool_add

dome_gateway_tool_remove

dome_gateway_tool_source_add

dome_gateway_tool_source_remove

dome_gateway_model_pool_add

dome_gateway_model_pool_remove

dome_gateway_model_add

dome_gateway_model_remove

Access grants

dome_gateway_access_list

dome_gateway_agent_grant

dome_gateway_agent_revoke

dome_gateway_all_agents_grant

dome_gateway_all_agents_revoke

Cost quotas

dome_gateway_quota_list

dome_gateway_quota_set

dome_gateway_quota_update

dome_gateway_quota_remove

Next steps