For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
MCP authorization
Verified Code examples on this page have been automatically tested and verified.Define authorization rules for MCP method invocations using CEL expressions.
Attaches to:
llm or mcp modes, the examples on this page show each option in tabs. For more information, see Routing-based configuration.The MCP authorizationAuthorization (AuthZ)The process of determining what actions an authenticated user or service is allowed to perform. Agentgateway supports HTTP authorization, MCP authorization, and external authorization services. policy works similarly to HTTP authorization, but runs in the context of an MCP request.
Note
Instead of running against an HTTP request, MCP authorization policies run against specific MCP method invocations such as list_tools and call_tools.
If a tool or other resource is not allowed, the gateway automatically filters it from the list response.
# yaml-language-server: $schema=https://agentgateway.dev/schema/config
mcp:
port: 3000
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"]
policies:
mcpAuthorization:
rules:
# Allow anyone to call 'echo'
- 'mcp.tool.name == "echo"'
# Only the test-user can call 'add'
- 'jwt.sub == "test-user" && mcp.tool.name == "add"'
# Any authenticated user with the claim `nested.key == value` can access 'printEnv'
- 'mcp.tool.name == "printEnv" && jwt.nested.key == "value"'CEL variables
The following MCP-specific CEL variables are available in authorization rules:
| Variable | Type | Availability | Description |
|---|---|---|---|
mcp.tool.name | string | Request-time | The name of the tool being called. |
mcp.tool.target | string | Request-time | The target backend handling the tool call. |
mcp.tool.arguments | map | Request-time | The JSON arguments passed to the tool call. |
mcp.tool.result | any | Post-request | The tool call result payload (access logs only). |
mcp.tool.error | any | Post-request | The tool call error payload (access logs only). |
mcp.prompt.name | string | Request-time | The name of the prompt being accessed. |
mcp.resource.name | string | Request-time | The name of the resource being accessed. |
mcp.methodName | string | Post-request | The MCP JSON-RPC method name, such as tools/call. |
mcp.sessionId | string | Post-request | The MCP session ID. |
Request-time variables are available during authorization and can be used in mcpAuthorization rules. Post-request variables are available in access log CEL expressions.
Authorize based on tool arguments
You can use tool arguments in authorization rules to enforce fine-grained access control. For example, restrict which URLs a fetch tool can access:
mcpAuthorization:
rules:
- 'mcp.tool.name == "fetch" && mcp.tool.arguments.url.startsWith("https://internal.")'Refer to the CEL reference for additional variables.
