Gateways

Group tools and models behind Gateways, grant agent access, and configure scoped runtime endpoints

A Gateway is a named access surface that lists which tools and models an agent may reach and exposes one stable URL for that set. Dome checks membership and access grants before Rules run on each call.

Refer to Gateways for membership, access grants, and runtime endpoints. All tools require workspace context.

Gateways

dome_gateways_list

List Gateways in the active workspace with state, membership counts, and the canonical endpoint path (/gateways/<id>) — the single URL every client points at. The Dome SDK and Anthropic clients use it as-is; MCP clients append /mcp; OpenAI-compatible clients append /v1.

Parameter	Type	Required	Description
—	—	—	No parameters

Requires gateways.view.

dome_gateways_get

Get a Gateway with its members (individual tools, tool sources, LLM pools, direct model connections).

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name

Requires gateways.view.

dome_gateways_create

Create a Gateway. Starts active with empty membership. Until a resource is added it is unreachable.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name (unique within workspace)
`description`	string	No	Free-form description

Requires gateways.manage.

Create a Gateway

{
  "name": "dome_gateways_create",
  "arguments": {
    "name": "prod-tools",
    "description": "Production MCP tools for the ops agent"
  }
}

dome_gateways_update

Rename or edit the description. Use dome_gateways_set_state to enable/disable.

Parameter	Type	Required	Description
`name`	string	Yes	Current Gateway name
`new_name`	string	No	New name (omit to keep)
`description`	string	No	New description

Requires gateways.manage.

dome_gateways_set_state

Enable or disable a Gateway. A disabled Gateway fails closed at its endpoint.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name
`state`	string	Yes	`active` or `disabled`

Requires gateways.manage.

dome_gateways_set_default

Make a Gateway the workspace default — the Gateway pre-checked (but overridable) in dashboard create dialogs. Enforces no membership. Setting a new default clears the previous one.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name

Requires gateways.manage.

dome_gateways_delete

Delete a Gateway. Membership rows cascade; the underlying tools, connections, and pools are untouched. Marked destructive.

Parameter	Type	Required	Description
`name`	string	Yes	Gateway name

Requires gateways.manage.

Membership

dome_gateways_tool_add

Add a single MCP tool. Address the tool by its (connection, tool) pair from the observed catalog. Run dome_tools_for_connection to see observed names.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name
`tool`	string	Yes	Tool name as observed (e.g. `create_page`)

Requires gateways.manage.

dome_gateways_tool_remove

Remove an individual tool. The underlying tool is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name
`tool`	string	Yes	Tool name as observed

Requires gateways.manage.

dome_gateways_tool_source_add

Add a tool source (an MCP server connection). The Gateway includes every tool observed on the connection; newly observed tools propagate automatically.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name

Requires gateways.manage.

dome_gateways_tool_source_remove

Remove a tool source. Tools that joined only through this source stop being included; the connection itself is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`connection`	string	Yes	MCP connection name

Requires gateways.manage.

dome_gateways_model_pool_add

Add an LLM pool. The Gateway exposes the pool's models at its /gateways/<id>/v1 endpoint.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`pool`	string	Yes	Pool name

Requires gateways.manage.

dome_gateways_model_pool_remove

Remove an LLM pool. The pool itself is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`pool`	string	Yes	Pool name

Requires gateways.manage.

dome_gateways_model_add

Add a direct (un-pooled) LLM model connection. The Gateway exposes the model without going through a pool.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`model`	string	Yes	Model connection name

Requires gateways.manage.

dome_gateways_model_remove

Remove a direct LLM model connection. The connection itself is untouched.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`model`	string	Yes	Model connection name

Requires gateways.manage.

Access grants

Access grants control who can use a Gateway. An agent with no grant is rejected at the edge before Cedar evaluates.

dome_gateways_access_list

List agents and their access state for a Gateway. Revoked agents are excluded to match the CLI and dashboard — a revoked agent cannot exchange its API key for a JWT, so it can never reach the gateway. Suspended agents remain in the list because suspension is reversible.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name

Requires agents.view.

dome_gateways_agent_grant

Grant an agent access to a Gateway.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`agent_id`	string	Yes	Agent ID (UUID)

Requires agents.register and rules.deploy.

dome_gateways_agent_revoke

Revoke an agent's access. Marked destructive.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name
`agent_id`	string	Yes	Agent ID (UUID)

Requires agents.register and rules.deploy.

dome_gateways_all_agents_grant

Grant every current and future workspace agent access to a Gateway.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name

Requires rules.deploy and gateways.manage.

dome_gateways_all_agents_revoke

Clear the all-agents grant. Per-agent grants are unaffected. Marked destructive.

Parameter	Type	Required	Description
`gateway`	string	Yes	Gateway name

Requires rules.deploy and gateways.manage.

Cap Gateway LLM spend with dome_quotas_set (subject=gateway).

Next steps

Membership and grants have a full how-to under Connect:

Gateways

On this page