Proxy Gateway Mode

Proxy Gateway Mode

The most powerful deployment: route any MCP client's connections to other MCP servers through Xybern. Every tool call, GitHub, Slack, database, internal APIs, passes through enforcement before execution. Zero changes to your agent or MCP server code.

Without Xybern:
  Claude Code → GitHub MCP      (no auth, no rules)
  Claude Code → Database MCP    (no auth, no rules)
  Claude Code → Slack MCP       (no auth, no rules)

With Xybern MCP Gateway:
  Claude Code → Xybern MCP → [rule check] → GitHub MCP   ✓ allowed
                            → [rule check] → Database MCP ⏸ escalated
                            → [rule check] → Slack MCP    ✗ blocked

Xybern becomes the identity and authorisation perimeter for the entire MCP ecosystem.

The fast path: Quick Connect

The dashboard's MCP Gateway tab → Quick Connect does the whole setup in one flow: register the server, mint a scoped API key on the spot, enable ready-made rules, and copy a finished config for your client (Claude Code, Claude Desktop, Cursor, or Windsurf). From signup to your first enforced tool call in under five minutes.

Quick Connect ships one-click rule templates for the popular servers, applied as real mandates in your Charter (enforce immediately or shadow first):

Template	What it enforces
GitHub	Read issues, PRs, and code freely; pushing, merging, and deleting are refused; opening a PR or branch is held for review
Postgres	Query freely; DROP, TRUNCATE, ALTER, and DELETE FROM are refused; UPDATE and INSERT are held for review
Filesystem	Read, search, and list freely; writing, editing, and moving files is held for review
Slack	Read freely; posting and replying is held for review
Stripe	Read freely; refunds, invoices, and payouts are held for review; deletions and cancellations are refused

Every tool call through the gateway is authorised before execution and produces a signed Authorisation Receipt. If a tool call carries a reasoning or justification argument, the agent's own reason is captured on the receipt automatically.

Step 1, Register your MCP server

Register any upstream MCP server via the Authorisation Layer dashboard (MCP Gateway tab → Add Server) or via the API:

curl -X POST https://www.xybern.com/api/sentinel/mcp/servers \
  -H "Cookie: <session>" \
  -H "Content-Type: application/json" \
  -d '{
    "workspace_id": "your-workspace-id",
    "server_name": "filesystem",
    "upstream_url": "http://localhost:3000",
    "transport_type": "streamable_http",
    "auth_type": "bearer",
    "auth_secret": "my-mcp-server-token",
    "blocked_tools": ["delete_file", "overwrite_file"]
  }'

transport_type: streamable_http (MCP spec 2025-03-26) or sse (legacy HTTP+SSE).
auth_type: none, bearer, header, basic, or oauth, secrets stored encrypted.

For OAuth-fronted remote MCP servers (auth_type: "oauth"), the gateway obtains and caches an access token via the client credentials grant and refreshes it before expiry. Provide the identity provider details as the secret:

{
  "auth_type": "oauth",
  "auth_secret": "{\"token_url\": \"https://idp.example.com/oauth/token\", \"client_id\": \"...\", \"client_secret\": \"...\", \"scope\": \"mcp.tools\"}"
}

The dashboard's Add Server modal and Quick Connect expose the same fields. Prefer keeping MCP traffic on your own network entirely? The self-hosted relay has an MCP mode that enforces the same rules on-prem.

Step 2, Point your client at the proxy URL

The proxy URL for a registered server is:

https://www.xybern.com/gateway/mcp/<server_name>

Claude Desktop / Claude Code, config.json:

{
  "mcpServers": {
    "filesystem": {
      "url": "https://www.xybern.com/gateway/mcp/filesystem",
      "headers": { "X-Xybern-API-Key": "xb_live_..." }
    }
  }
}

Any MCP client with HTTP transport:

MCP_SERVER_URL=https://www.xybern.com/gateway/mcp/filesystem
MCP_SERVER_HEADERS='{"X-Xybern-API-Key": "xb_live_..."}'

SSE transport (legacy clients):

# SSE stream endpoint
GET https://www.xybern.com/gateway/mcp/<server_name>/sse
X-Xybern-API-Key: xb_live_...

# Message endpoint (returned in first SSE event)
POST https://www.xybern.com/gateway/mcp/<server_name>/message?sessionId=<id>
X-Xybern-API-Key: xb_live_...

What gets enforced automatically

Method	Enforcement
tools/call	Full control plane, Charter rules, Risk Verdict, agent tool rules, chain detection
resources/read	Sensitive URI patterns enforced; others pass through
tools/list	Response filtered, blocked / non-allowed tools stripped before client sees them
initialize	Server validated against registry, unknown servers rejected

Agent Tool Rules

Define per-agent, per-server tool permission matrices, including regex constraints on arguments (e.g. SELECT-only SQL queries):

curl -X POST https://www.xybern.com/api/sentinel/mcp/agent-policies \
  -H "Cookie: <session>" \
  -H "Content-Type: application/json" \
  -d '{
    "workspace_id": "your-workspace-id",
    "agent_id": "agent_abc123",
    "server_name": "database",
    "allowed_tools": ["execute_query", "list_tables"],
    "blocked_tools": ["drop_table", "delete_rows"],
    "argument_constraints": {
      "execute_query": [
        {"arg": "sql", "pattern": "^\\s*SELECT", "description": "SELECT queries only"}
      ]
    }
  }'