# MCP Tool Governance: who can call which tool, in one permission plane

> AI gateway unifies MCP servers behind one /mcp endpoint: tool-level allow/deny, label filters, full audit of calls / violations / sessions. Agent tool permissions share one plane with model permissions; credentials never leave the gateway.

Canonical: https://www.gatellm.io/use-cases/mcp-tool-governance/

Aggregate external MCP servers behind one gateway /mcp endpoint — per-key-group tool allow/deny and label filters, with calls / violations / sessions fully audited.

## What the community actually complains about
Once an agent framework is wired to a pile of MCP servers, permissions spiral: there is no unified control over who can call which tool, and no audit trail when something goes wrong. Configuring each agent separately scatters credentials and drifts policies.
"How do I restrict Claude Code to just these MCP tools" is a recurring question for platform teams.

## How GateLLM does it
GateLLM ships a built-in MCP proxy: multiple external MCP tool servers (streamable HTTP / SSE) are aggregated behind one /mcp endpoint, with endpoint, auth header (forwarded verbatim), labels, priority, and lazy loading configured once. Key groups govern tools with allow/deny lists (deny wins) and label filters — the same ACL plane that governs models.
When the tool list grows long, context budgets trim it and built-in BM25 retrieval locates the relevant tools. MCP tool calls, access-rule violations, and session setup all land in the audit log.
MCP server credentials never reach the agent: tool access is granted and revoked with the gateway key group.

## 5 levers that actually land
- Server aggregation: streamable HTTP / SSE MCP servers behind one /mcp endpoint
- Lazy loading: tools discovered on first use, cutting startup cost and attack surface
- Tool-level ACL: per-key-group allow/deny, deny overrides allow, label filters in bulk
- Context budget + BM25: long tool lists trimmed to budget, relevant tools located by search
- Full audit: tool calls / access violations / session setup logged and exportable

## FAQ
### Are tool permissions and model permissions the same plane?
Yes. A key group's "models" and "MCP" tabs form one ACL: models decide which models are callable, MCP decides which tools are usable (allow/deny + label filters). Attach an access key to the group and both take effect at once.

### Do MCP server credentials get handed to the agent?
No. Auth headers are configured on the gateway and forwarded verbatim to the MCP server; the agent only holds a gateway access key and never sees the MCP server's real credentials. Revoking the gateway key cuts tool access.

- [Full how-to: Onboard external MCP servers (docs)](https://docs.gatellm.io/en/howto/onboard-external-mcp)

## Related
- [Home](https://www.gatellm.io/index.md)
- [Pricing](https://www.gatellm.io/pricing.md)
- [Cost Calculator](https://www.gatellm.io/calculator.md)
- [About](https://www.gatellm.io/about.md)
- [Book a Demo](https://www.gatellm.io/demo.md)
- [FAQ](https://www.gatellm.io/faq.md)
- [Compare AI Gateways](https://www.gatellm.io/compare.md)
- [Compare LiteLLM](https://www.gatellm.io/compare/litellm.md)
- [Compare OpenRouter](https://www.gatellm.io/compare/openrouter.md)
- [Compare Alibaba Cloud AI Gateway](https://www.gatellm.io/compare/alibaba-cloud.md)
- [Compare Azure API Management](https://www.gatellm.io/compare/azure-apim.md)
- [Compare Apigee](https://www.gatellm.io/compare/apigee.md)
- [Compare Cloudflare AI Gateway](https://www.gatellm.io/compare/cloudflare.md)
- [Compare Kong AI Gateway](https://www.gatellm.io/compare/kong.md)
- [Compare Portkey](https://www.gatellm.io/compare/portkey.md)
- [LiteLLM vs Kong AI Gateway](https://www.gatellm.io/compare/litellm-vs-kong.md)
- [LiteLLM vs OpenRouter](https://www.gatellm.io/compare/litellm-vs-openrouter.md)
- [LiteLLM vs Portkey](https://www.gatellm.io/compare/litellm-vs-portkey.md)
- [Use Cases](https://www.gatellm.io/use-cases.md)
- [Reduce LLM Cost](https://www.gatellm.io/use-cases/reduce-cost.md)
- [High Availability](https://www.gatellm.io/use-cases/high-availability.md)
- [Multi-Tenant Isolation](https://www.gatellm.io/use-cases/multi-tenant.md)
- [Compliance & Audit](https://www.gatellm.io/use-cases/compliance-audit.md)
- [Troubleshooting by Symptom](https://www.gatellm.io/use-cases/troubleshooting.md)
- [Mixed Multi-Vendor Model Stack](https://www.gatellm.io/use-cases/mixed-model-stack.md)
- [Self-Host AI Inside Office](https://www.gatellm.io/use-cases/self-hosted-office-ai.md)
- [Token Usage Visibility & Attribution](https://www.gatellm.io/use-cases/token-ops.md)
- [Token FinOps: AI Cost Allocation & Control](https://www.gatellm.io/use-cases/token-finops.md)
- [Web Search for Every Model](https://www.gatellm.io/use-cases/web-search-grounding.md)
- [Multi-Key Rotation & Standby](https://www.gatellm.io/use-cases/multi-key-pooling.md)
- [Admission Control for Connected Clients](https://www.gatellm.io/use-cases/client-admission-control.md)
- [Enforce Which Model Agents Actually Run](https://www.gatellm.io/use-cases/enforce-model-policy.md)
- [No Model Choice on the Client](https://www.gatellm.io/use-cases/automatic-model-tiering.md)
- [One Protocol, Any Model](https://www.gatellm.io/use-cases/one-protocol-any-model.md)
- [Office / Microsoft 365 Add-in](https://www.gatellm.io/office-addin.md)
- [Glossary](https://www.gatellm.io/glossary.md)
- [Model Catalog](https://www.gatellm.io/models.md)
- [SDK & Framework Integrations](https://www.gatellm.io/integrations.md)
- [AI Coding Agents & Harnesses](https://www.gatellm.io/coding-agents.md)
- [Security & Compliance](https://www.gatellm.io/security.md)
- [Privacy Policy](https://www.gatellm.io/privacy-policy.md)
- [Terms of Service](https://www.gatellm.io/terms.md)
- [Cookie Policy](https://www.gatellm.io/cookies.md)
- [Data Processing Agreement (DPA)](https://www.gatellm.io/dpa.md)
- [Sub-processor List](https://www.gatellm.io/subprocessors.md)
- [Security Questionnaire (CAIQ/SIG/VSA)](https://www.gatellm.io/trust.md)
- [Incident Response & Support](https://www.gatellm.io/sla.md)
- [Vulnerability Disclosure Policy](https://www.gatellm.io/vulnerability-disclosure.md)
- [Open Source License Notice](https://www.gatellm.io/open-source-licenses.md)
- [Version Support & Lifecycle (EOL)](https://www.gatellm.io/lifecycle.md)
- [Engineering Blog](https://www.gatellm.io/blog.md)
- [Your Agents Have More Permissions Than Your Employees: Governing MCP Tools at the Gateway](https://www.gatellm.io/blog/mcp-tool-governance.md)
- [The $10k Invoice Problem: Five Ways to Cut LLM Spend Without Dumbing Down Your App](https://www.gatellm.io/blog/reduce-cost.md)
- [Your Vendor's List Price Is Not Your Cost: Applying Real FinOps to Token Spend](https://www.gatellm.io/blog/token-finops.md)
- [llms.txt](https://www.gatellm.io/llms.txt)