> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Gateways

> MCP tools for managing Gateways, membership, access grants, and cost quotas

Gateway MCP tools manage workspace-scoped groupings of callable resources and the agent access grants that govern them. Refer to [Gateways](/connect/gateways) for the concept model. All tools require workspace context.

## Gateway CRUD

### dome\_gateway\_list

List Gateways in the active workspace with state, membership counts, and the canonical endpoint path (`/gateways/<id>`) — the single URL every client points at. The Dome SDK and Anthropic clients use it as-is; MCP clients append `/mcp`; OpenAI-compatible clients append `/v1`.

| Parameter | Type | Required | Description   |
| --------- | ---- | -------- | ------------- |
| —         | —    | —        | No parameters |

**Permission:** `gateway.view`

### dome\_gateway\_get

Get a Gateway with its members (individual tools, tool sources, LLM pools, direct model connections).

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `name`    | string | Yes      | Gateway name |

**Permission:** `gateway.view`

### dome\_gateway\_create

Create a Gateway. Starts active with empty membership. Until a resource is added it is unreachable.

| Parameter     | Type   | Required | Description                            |
| ------------- | ------ | -------- | -------------------------------------- |
| `name`        | string | Yes      | Gateway name (unique within workspace) |
| `description` | string | No       | Free-form description                  |

**Permission:** `gateway.manage`

```json title="Create a Gateway" theme={"system"}
{
  "name": "dome_gateway_create",
  "arguments": {
    "name": "prod-tools",
    "description": "Production MCP tools for the ops agent"
  }
}
```

### dome\_gateway\_update

Rename or edit the description. Use `dome_gateway_set_state` to enable/disable.

| Parameter     | Type   | Required | Description             |
| ------------- | ------ | -------- | ----------------------- |
| `name`        | string | Yes      | Current Gateway name    |
| `new_name`    | string | No       | New name (omit to keep) |
| `description` | string | No       | New description         |

**Permission:** `gateway.manage`

### dome\_gateway\_set\_state

Enable or disable a Gateway. A disabled Gateway fails closed at its endpoint.

| Parameter | Type   | Required | Description            |
| --------- | ------ | -------- | ---------------------- |
| `name`    | string | Yes      | Gateway name           |
| `state`   | string | Yes      | `active` or `disabled` |

**Permission:** `gateway.manage`

### dome\_gateway\_set\_default

Make a Gateway the workspace default — the Gateway pre-checked (but overridable) in dashboard create dialogs. Enforces no membership. Setting a new default clears the previous one.

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `name`    | string | Yes      | Gateway name |

**Permission:** `gateway.manage`

### dome\_gateway\_delete

Delete a Gateway. Membership rows cascade; the underlying tools, connections, and pools are untouched. Marked destructive.

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `name`    | string | Yes      | Gateway name |

**Permission:** `gateway.manage`

## Membership

### dome\_gateway\_tool\_add

Add a single MCP tool. Address the tool by its `(connection, tool)` pair from the observed catalog. Run `dome_tools_for_connection` to see observed names.

| Parameter    | Type   | Required | Description                                |
| ------------ | ------ | -------- | ------------------------------------------ |
| `gateway`    | string | Yes      | Gateway name                               |
| `connection` | string | Yes      | MCP connection name                        |
| `tool`       | string | Yes      | Tool name as observed (e.g. `create_page`) |

**Permission:** `gateway.manage`

### dome\_gateway\_tool\_remove

Remove an individual tool. The underlying tool is untouched.

| Parameter    | Type   | Required | Description           |
| ------------ | ------ | -------- | --------------------- |
| `gateway`    | string | Yes      | Gateway name          |
| `connection` | string | Yes      | MCP connection name   |
| `tool`       | string | Yes      | Tool name as observed |

**Permission:** `gateway.manage`

### dome\_gateway\_tool\_source\_add

Add a tool source (an MCP server connection). The Gateway includes every tool observed on the connection; newly observed tools propagate automatically.

| Parameter    | Type   | Required | Description         |
| ------------ | ------ | -------- | ------------------- |
| `gateway`    | string | Yes      | Gateway name        |
| `connection` | string | Yes      | MCP connection name |

**Permission:** `gateway.manage`

### dome\_gateway\_tool\_source\_remove

Remove a tool source. Tools that joined only through this source stop being included; the connection itself is untouched.

| Parameter    | Type   | Required | Description         |
| ------------ | ------ | -------- | ------------------- |
| `gateway`    | string | Yes      | Gateway name        |
| `connection` | string | Yes      | MCP connection name |

**Permission:** `gateway.manage`

### dome\_gateway\_model\_pool\_add

Add an LLM pool. The Gateway exposes the pool's models at its `/gateways/<id>/v1` endpoint.

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `gateway` | string | Yes      | Gateway name |
| `pool`    | string | Yes      | Pool name    |

**Permission:** `gateway.manage`

### dome\_gateway\_model\_pool\_remove

Remove an LLM pool. The pool itself is untouched.

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `gateway` | string | Yes      | Gateway name |
| `pool`    | string | Yes      | Pool name    |

**Permission:** `gateway.manage`

### dome\_gateway\_model\_add

Add a direct (un-pooled) LLM model connection. The Gateway exposes the model without going through a pool.

| Parameter | Type   | Required | Description           |
| --------- | ------ | -------- | --------------------- |
| `gateway` | string | Yes      | Gateway name          |
| `model`   | string | Yes      | Model connection name |

**Permission:** `gateway.manage`

### dome\_gateway\_model\_remove

Remove a direct LLM model connection. The connection itself is untouched.

| Parameter | Type   | Required | Description           |
| --------- | ------ | -------- | --------------------- |
| `gateway` | string | Yes      | Gateway name          |
| `model`   | string | Yes      | Model connection name |

**Permission:** `gateway.manage`

## Access grants

Access grants control who can *use* a Gateway. An agent with no grant is rejected at the edge before Cedar evaluates.

### dome\_gateway\_access\_list

List agents and their access state for a Gateway. Revoked agents are excluded to match the CLI and dashboard — a revoked agent cannot exchange its API key for a JWT, so it can never reach the gateway. Suspended agents remain in the list because suspension is reversible.

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `gateway` | string | Yes      | Gateway name |

**Permission:** `agent.view`

### dome\_gateway\_agent\_grant

Grant an agent access to a Gateway.

| Parameter  | Type   | Required | Description     |
| ---------- | ------ | -------- | --------------- |
| `gateway`  | string | Yes      | Gateway name    |
| `agent_id` | string | Yes      | Agent ID (UUID) |

**Permission:** `agent.register` + `rules.deploy`

### dome\_gateway\_agent\_revoke

Revoke an agent's access. Marked destructive.

| Parameter  | Type   | Required | Description     |
| ---------- | ------ | -------- | --------------- |
| `gateway`  | string | Yes      | Gateway name    |
| `agent_id` | string | Yes      | Agent ID (UUID) |

**Permission:** `agent.register` + `rules.deploy`

### dome\_gateway\_all\_agents\_grant

Grant every current and future workspace agent access to a Gateway.

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `gateway` | string | Yes      | Gateway name |

**Permission:** `rules.deploy` + `gateway.manage`

### dome\_gateway\_all\_agents\_revoke

Clear the all-agents grant. Per-agent grants are unaffected. Marked destructive.

| Parameter | Type   | Required | Description  |
| --------- | ------ | -------- | ------------ |
| `gateway` | string | Yes      | Gateway name |

**Permission:** `rules.deploy` + `gateway.manage`

## Cost quotas

### dome\_gateway\_quota\_list

List Gateway cost quotas (USD spend caps on a whole Gateway's aggregate LLM spend). Optionally filter to one Gateway.

| Parameter | Type   | Required | Description           |
| --------- | ------ | -------- | --------------------- |
| `gateway` | string | No       | Filter to one Gateway |

**Permission:** `gateway.view`

### dome\_gateway\_quota\_set

Create a USD spend cap on a whole Gateway. Covers every LLM call routed through the Gateway's member pools and direct connections. Once window spend exceeds the cap, calls to the Gateway return HTTP `429`.

| Parameter   | Type   | Required | Description                                            |
| ----------- | ------ | -------- | ------------------------------------------------------ |
| `gateway`   | string | Yes      | Gateway name                                           |
| `limit_usd` | number | Yes      | Spend cap in US dollars (e.g. `500` or `12.50`)        |
| `window`    | string | No       | Reset window: `daily` or `monthly` (default `monthly`) |
| `name`      | string | No       | Human-readable label                                   |
| `disabled`  | bool   | No       | Create disabled (no enforcement until enabled)         |

**Permission:** `gateway.manage`

```json title="Cap a Gateway at $500/month" theme={"system"}
{
  "name": "dome_gateway_quota_set",
  "arguments": {
    "gateway": "prod-tools",
    "limit_usd": 500,
    "window": "monthly",
    "name": "prod-monthly"
  }
}
```

### dome\_gateway\_quota\_update

Update a Gateway quota's name, limit, window, or enabled state. Omitted fields stay unchanged. The Gateway subject is immutable, and the tool refuses IDs for other quota subject types.

| Parameter   | Type   | Required | Description                             |
| ----------- | ------ | -------- | --------------------------------------- |
| `quota_id`  | string | Yes      | Quota ID from `dome_gateway_quota_list` |
| `name`      | string | No       | New human-readable label                |
| `limit_usd` | number | No       | New spend cap in US dollars             |
| `window`    | string | No       | New reset window: `daily` or `monthly`  |
| `enabled`   | bool   | No       | Enable or disable enforcement           |

**Permission:** `gateway.manage`

### dome\_gateway\_quota\_remove

Remove a Gateway cost quota by ID. Refuses IDs of non-Gateway quotas — use `dome_model_quota_remove` for those. Marked destructive.

| Parameter  | Type   | Required | Description                             |
| ---------- | ------ | -------- | --------------------------------------- |
| `quota_id` | string | Yes      | Quota ID from `dome_gateway_quota_list` |

**Permission:** `gateway.manage`

## Next steps

Membership and grants have a full how-to under Connect:

* [Gateways](/connect/gateways)
* [Tools](/connect/resources/tools)
* [Develop](/develop)