[ Maha Strategies // Enterprise infrastructure ]
One governed path to your MCP servers.
The Enterprise MCP Gateway is the shared control layer for a tenant’s approved MCP connections: server inventory, explicit method and tool allowlists, tenant-bound credentials, and an audit record that does not retain request contents.
01 // Inventory
Register each approved upstream endpoint under one customer tenant. A credential for one tenant cannot reach another tenant’s server.
02 // Policy
Allow only the MCP methods and tool names you have explicitly registered. Unlisted calls are blocked before any upstream request is made.
03 // Evidence
Record the method, tool name, outcome, upstream status, and a request hash—not the request body, tool arguments, or upstream response.
First release boundary
This release proxies JSON MCP messages to registered public HTTPS upstreams. It does not store upstream credentials, forward an agent’s bearer token, stream SSE responses, or authorize browser-originated calls. Those restrictions are intentional: private upstream access needs a dedicated OAuth token-exchange layer, not a shortcut that turns the gateway into a secret relay.
Supported policy surface
initializepingtools/listresources/listresources/readprompts/listprompts/gettools/calltools/call requires a named per-server allowlist. A registered server URL is not permission to invoke every tool it exposes.
Optional Context Pack admission
For named approved tools, a gateway operator can require a registered Context Pack. The call must include contextPackId, contextPackHash, and context. Before forwarding, the gateway verifies the supplied context hashes exactly to a pack registered for the same tenant. It records the pack ID and policy outcome, never the context itself.
This is content-admission control, not source verification or a guarantee about the downstream tool’s output.
Machine-readable contract
Integration teams can use the gateway contract to register a server and make requests through a tenant endpoint. Operator registration remains private and requires a distinct operations credential.