Self-Hosted MCP Gateway for Claude and ChatGPT Connectors
MCP gateway deployment for companies connecting Claude, ChatGPT and Copilot Studio agents to internal tools. One controlled entry point runs in your own cloud account or data center, every AI tool call passes your SSO, scopes and audit log, and the assistant receives only the results each call returns.
What an MCP Gateway Does for Your AI Assistants
An MCP gateway sits between your AI assistants and the self-hosted MCP servers that reach company systems. It gives an enterprise MCP rollout one place for MCP governance.
One entry point
Every AI assistant connects to one HTTPS address, and the gateway routes each tool call to the right MCP server.
Authentication
Staff sign in through your identity provider over OAuth 2.1, and the gateway checks every token before a call runs.
Scopes
Each group gets a defined set of tools. Sales reads CRM deals, finance queries reporting data, and writes stay off until you approve them.
Policies
Rules decide which tools run, for whom and with what inputs, and mask sensitive fields before the AI model receives a result.
Rate limits
Per-user and per-tool limits keep AI agent traffic within the API quotas your systems already set.
Logs
Every tool call is recorded with the user, tool, inputs and output, then exported to your SIEM.
What Runs in Your Environment and What the AI Assistant Sees
A self-hosted MCP gateway keeps the connection layer on infrastructure you control, and the AI vendor runs the assistant itself.
Your systems sit behind one gateway you own.
System credentials live in your vault, results pass your redaction rules on the way out, and every tool call is logged in your own stack. A self-hosted model can sit behind the same gateway too.
The Company Systems We Put Behind the Gateway
We deploy self-hosted MCP servers for the systems your teams already use, each read-only to start.
CRM: HubSpot and Salesforce
Contacts, deals and account history, scoped to the records each group is approved to see.
Files: SharePoint and Google Drive
Documents in the SharePoint sites and Google Drive folders each group is approved for.
Tickets: Jira
Issues and comments, so the assistant can summarize project status or draft an update for a person to post.
Databases
Read-only queries on Postgres, SQL Server or a warehouse, through a service account limited to approved views.
Read-only by default
Every connector launches with read tools only, so the systems of record stay as they are.
Writes need approval
Tools that create or update records are switched on one at a time, after the system owner approves each one.
How Staff Sign In and What Each Group Can Reach
The gateway uses your identity provider and the MCP specification's authorization rules, so each AI tool call carries one person's identity.
SSO through OpenID Connect
Staff sign in with Okta, Microsoft Entra ID or Google through OIDC, and disabling an account ends that person's AI tool access.
Per-user tokens
Each person gets their own OAuth 2.1 token, so every call in the logs is tied to one named user.
Groups mapped to tool scopes
Groups such as Sales or Finance map to the tools each group may call, so AI access changes in one place.
Tokens issued for this server
The MCP specification says servers “MUST validate that access tokens were issued specifically for them” (RFC 8707), and the gateway checks every token's audience.
Separate credentials per system
The MCP security best practices call token passthrough “explicitly forbidden”, so the gateway holds its own credential for each downstream system in your vault.
Consent and redirect checks
Per-client consent, exact redirect URI matching and state checks, per the MCP security guidance on the confused deputy problem.
Redaction and DLP Before Results Reach the AI Model
Results pass the gateway's policy layer before Claude or ChatGPT receives them, with rules for the data classes in your AI use policy:
Rules run in your environment, before data leaves.
The AI vendor receives the masked result, the original values stay in your systems, and each redaction is logged.
An Audit Record for Every AI Tool Call
The gateway writes one log entry per tool call and sends it to the security tools you already run.
Who called which tool
The user, their group, the AI assistant, the MCP server, the tool name and a timestamp.
Inputs and outputs
The arguments the AI model sent and the redacted result it received, so a reviewer sees exactly what data left your systems.
Policy decisions
Allowed, blocked and rate-limited calls, each with the rule that applied.
Export to your SIEM
Logs flow to Microsoft Sentinel, Splunk or Elastic through OpenTelemetry or your log pipeline, under your retention policy.
Works With Claude, ChatGPT and Copilot Studio Agents
The gateway speaks remote MCP, so each AI assistant connects to it like any other remote MCP server.
Claude custom connectors
Anthropic's Help Center lists custom connectors over remote MCP on Free, Pro, Max, Team and Enterprise. On Team, Owners and Primary Owners add them, and each user then connects individually.
ChatGPT developer mode and apps
OpenAI's pricing page lists developer mode (beta) and apps connecting to internal tools on ChatGPT Business and Enterprise. The gateway is that internal tool.
Copilot Studio agents
Agents built in Microsoft Copilot Studio can call MCP servers as tools, according to Microsoft Learn, under the same scopes and logs.
The Open-Source MCP Gateways We Deploy and Configure
Each engagement is a contained deployment of an open-source gateway that fits your stack, configured with your identity provider, scopes, redaction and logging. Details come from each project's repository.
| Gateway | Maintainer | Licence | What the project provides | A good fit for |
|---|---|---|---|---|
| Microsoft MCP Gateway | Microsoft | MIT | Reverse proxy and management layer on Kubernetes, Entra ID sign-in, per-adapter logs | Companies on Azure and Entra ID |
| IBM ContextForge | IBM | Apache-2.0 | Gateway, registry and proxy for MCP, A2A and REST services, with OpenTelemetry | MCP servers and existing REST APIs in one registry |
| Docker MCP Gateway | Docker | MIT | MCP servers in containers, with per-profile tool allowlists, logging and call tracing | Teams that run services in containers |
| agentgateway | Linux Foundation | Apache-2.0 | JWT, API key and OAuth sign-in, RBAC through a CEL policy engine, rate limiting, OpenTelemetry | Fine-grained policy and rate limits per tool |
Companies that want the language model on their own servers too can pair the gateway with a self-hosted AI deployment or private ChatGPT for business.
What Shapes an MCP Gateway Engagement
The scope follows your systems and your rules. Bring your tool list and your AI use policy, and we will map the gateway deployment that fits them.
Book a Strategy Session →Frequently Asked Questions on MCP Gateways
An MCP gateway is one entry point between AI assistants and the MCP servers that connect them to company systems. It signs users in, decides which tools each person can call, applies redaction and rate limits, and logs every call.
Built-in connectors cover systems with a ready-made integration. With HubSpot, each user connects their own login, and a Super Admin approves the connector and chooses its data scopes. A self-hosted MCP gateway covers internal databases, in-house apps and any system you connect yourself, under one set of scopes and logs.
The best fit follows your stack. Microsoft MCP Gateway runs on Kubernetes with Entra ID, Docker MCP Gateway suits teams that run containers, IBM ContextForge puts MCP, A2A and REST services in one registry, and agentgateway adds a CEL policy engine and rate limiting.
The four gateways we deploy are open source under MIT or Apache-2.0, so the software carries no licence fee. Running cost is the compute that hosts the gateway and MCP servers, plus your Claude or ChatGPT seats, billed by the vendor directly. Our deployment scope depends on your systems, identity setup and redaction rules, and the strategy session gives you a scoped figure.
The vendor's model receives each tool call's result after your redaction rules run. Credentials, tokens, unredacted data and the call log stay in your environment. Anthropic's pricing page lists model training on Team and Enterprise as “None by default”, and OpenAI states for ChatGPT Business and Enterprise: “We do not train on your business data, and our models don't learn from your usage.”
Related AI Rollout Services and Private AI Solutions
Claude Team and Enterprise Rollout for Your Company
Learn more →ChatGPT Business and Enterprise Rollout for Your Team
Learn more →Private ChatGPT for Business: Self-Hosted Chat for Regulated Teams
Learn more →AI Acceptable Use Policy
Approved tools, connector approvals and the data that stays out of AI, written into one policy.
See the policy service →Self-Hosted AI Deployment
Chat, search and model serving in your own tenant, with the model on your servers.
See the deployment →AI Strategy Session
A scoping call on your tools, identity provider and data rules.
Book a session →Ready to Put Your AI Connectors Behind One Gateway?
In a free strategy session, we'll map your systems, identity provider and data rules, then outline the MCP gateway setup that fits.