MCP Gateway
Provides the client-facing endpoint for discovering and invoking permitted MCP servers.
Explore MCP GatewayCustomer-Hosted Enterprise MCP Gateway & Server Registry
Jarvis is an enterprise MCP gateway and server registry that runs in your AWS or Azure environment to discover, authorize, route, and observe every approved tool call. Connect MCP servers and AI clients through one customer-controlled, policy-enforced endpoint.
Choose the right control point
Where the MCP Gateway Fits in Jarvis Registry
Jarvis Registry brings related capabilities together. The MCP server catalog and MCP Gateway work together; agent and skill capabilities have distinct roles.
MCP Server Registry
Catalogs MCP server endpoints, transports, metadata, and sharing settings as part of Jarvis Registry.
Explore Jarvis RegistryAgent Gateway
Provides the runtime entry point for governed agent-to-agent interactions.
Explore Agent GatewayAgent Registry
Catalogs agent ownership, capabilities, and lifecycle information.
Explore Agent RegistrySkill Gateway
Manages and distributes approved skills as an adjacent Registry capability.
Explore Skill GatewayGoverned AI
Provides cross-cutting governance context for identity, privacy, and observability across AI workloads.
Explore Governed AIComponents
What's Inside the MCP Gateway
Five core components work together to make every MCP server in your enterprise discoverable, governed, and ready for any AI client or copilot.
Auto-Discovery
Every registered MCP server and its tools discovered via one endpoint - permission-scoped so each AI client sees exactly what it can invoke.
Federation Layer
Federate MCP servers and agents from AWS AgentCore. Azure AI Foundry federation imports agents into the shared registry for review and governed access.
Egress Authentication
For OAuth-protected MCP servers, Jarvis stores downstream credentials encrypted at rest and can refresh access tokens before forwarding a request. Copilots do not receive raw credentials.
Governance Layer
RBAC scopes and resource ACLs control access to registered MCP servers and tools. Federated resources use the registry access model after import.
Identity & Observability
OpenTelemetry and Prometheus expose platform and MCP activity metrics, including operations and latency, for export to your observability backend.
Features
Enterprise-Grade MCP Gateway Capabilities
Everything you need to discover, govern, secure, and observe every MCP server tool call across your enterprise AI stack.
01—Auto-Discovery
One Endpoint. Every MCP Server Auto-Discovered.
Connect any AI copilot or MCP client to a single authenticated gateway endpoint and get automatic discovery of every registered MCP server and its tools - no per-client configuration, no manual server lists. The MCP registry surfaces only the tools each identity is permitted to invoke, giving every client a permission-scoped view of your entire MCP server catalog.
02—Governance Layer
RBAC and ACL Across Every MCP Server
Define role-based access control scopes and per-tool ACL policies that apply uniformly across every MCP server in the catalog - whether self-hosted, federated from AWS AgentCore, or imported from Azure AI Foundry. The MCP gateway enforces policy on every tool call at the gateway layer, not inside individual MCP servers.
03—Identity & Observability
OpenTelemetry and Prometheus for MCP Activity
Platform metrics cover registry operations, MCP discovery and execution, server requests, resource access, prompt execution, and latency. Route telemetry through the OpenTelemetry Collector to supported OTLP backends; the published documentation does not specify per-call payload or policy-snapshot logging.
04—Downstream Authentication
OAuth 2.0 Credential Management
When a downstream MCP server uses OAuth 2.0, Jarvis stores its client and token configuration encrypted at rest, can refresh an expired or near-expiry access token, and keeps raw credentials from the calling copilot.
05—Egress Authentication
Per-User OAuth Lifecycle Management
When users have individual OAuth identities for a downstream service, Jarvis can store per-user credentials and use the invoking user's credential for that service. Stored credentials are encrypted at rest; the documentation does not specify the encryption algorithm.
Multi-Cloud Federation
One MCP Registry Across AWS and Azure
MCP servers deployed in AWS AgentCore and Azure AI Foundry are imported into the Jarvis MCP registry, governed under your access policies, and exposed through a single MCP gateway endpoint - no redeployment, no duplicated infrastructure.
☁ AWS AgentCore
AWS AgentCore Federation
MCP servers deployed in AWS AgentCore are imported into the Jarvis MCP registry, governed under your access policies, and exposed through a single MCP gateway endpoint - no redeployment, no duplicated infrastructure.
- ✓Cross-account IAM via assume-role for secure MCP server discovery across AWS accounts
- ✓Automatic catalog sync brings AgentCore MCP servers into the Jarvis MCP registry
- ✓Inherited governance the same registry authentication, RBAC, and ACL controls as local resources
- ✓No redeployment MCP servers continue running inside AgentCore
◈ Azure AI Foundry
Azure AI Foundry Federation
Import Azure AI Foundry agents into Jarvis Registry, then review their visibility and grant access through the registry sharing model.
- ✓Tenant-scoped discovery across subscriptions and resource groups
- ✓Unified catalog Azure AI Foundry agents alongside other registered agents
- ✓Cross-cloud RBAC access remains governed through the registry sharing model
- ✓One endpoint for all AI clients regardless of which cloud hosts the MCP server
Integrations
Works With Every AI Copilot and MCP Client
Jarvis Registry acts as the universal MCP gateway - connecting any AI client to every registered and federated MCP server through one endpoint.
Claude Desktop
Chat Copilot
Claude Code
Coding Copilot
VS Code
IDE
Cursor
IDE
GitHub Copilot
Coding Copilot
Microsoft Copilot
Enterprise
Windsurf
IDE
Jarvis Chat
Chat Copilot
ChatGPT
Chat Copilot
Custom Clients
Custom App
Ready to Govern Every MCP Tool Call?
See how Jarvis Registry brings enterprise-grade MCP gateway governance, MCP server registry management, and full observability to your AI stack.
At a glance
MCP Gateway
The MCP Gateway provides a single entry point to registered MCP servers, while Jarvis Registry catalogs resources and applies access controls. These documented capabilities describe how it fits an existing estate.
| Concern | Documented behavior |
|---|---|
| Discovery | A single Registry Endpoint exposes the MCP servers the authenticated user is permitted to access. |
| Transports | MCP server registration supports HTTPStreamable and SSE transports. |
| Downstream OAuth | OAuth 2.0 credentials can be stored encrypted at rest and refreshed when an access token expires or nears expiry. The documentation does not specify the encryption algorithm. |
| Access control | RBAC scopes and resource ACLs govern access to MCP servers and tools; resources are private by default until shared. |
| Federation | The AgentCore integration documents importing MCP servers and agents. The Azure AI Foundry integration documents agent import. |
| Observability | OpenTelemetry and Prometheus cover platform operations and MCP activity metrics, including latency. The docs do not specify per-call payload or policy-snapshot logging. |
Last verified: October 9, 2026
Specifications
MCP Gateway technical
The gateway stands or falls on its authorisation model, because it holds credentials for many downstream servers. These rows name every specification involved so that model can be reviewed rather than assumed.
| Specification | Value |
|---|---|
| Protocol | Model Context Protocol (MCP), published November 2024, over JSON-RPC 2.0 |
| Integration surface | 1 endpoint per client instead of 1 integration per MCP server |
| Server redeploys required | 0 — registration is by endpoint, servers keep their runtime |
| Base authorization | OAuth 2.0 (RFC 6749), Bearer usage per RFC 6750 |
| Token scoping | Resource Indicators (RFC 8707) — a token for 1 server is not replayable at another |
| Delegation | OAuth 2.0 Token Exchange (RFC 8693) |
| Public-client flows | PKCE (RFC 7636) |
| Token format | JSON Web Token (RFC 7519), signed per RFC 7515 |
| Auth elicitation | Supported — a tool can request a downstream credential mid-session |
| Identity federation | OpenID Connect Core 1.0 and SAML 2.0 |
| Access model | Per-tool ACL evaluated on every invocation, layered on RBAC roles |
| Transport security | TLS 1.2 minimum, TLS 1.3 preferred (RFC 8446) |
| Telemetry | OpenTelemetry OTLP — call, policy decision, and latency per invocation |
| Denial responses | HTTP 401 unauthenticated, HTTP 403 policy denial, HTTP 429 rate limited |
| Zero-trust reference | NIST SP 800-207 (2020) |
| Runtimes | 3 managed Kubernetes services — Amazon EKS, Azure AKS, Google GKE |
Watch
MCP in practice
A 3-minute demonstration of what changes when a copilot reaches enterprise context through a governed MCP endpoint rather than a direct per-server integration.
Rollout
How to put a gateway in front of your MCP servers
Use the documented deployment and registry workflow to connect clients to approved MCP servers through one endpoint.
Deploy the gateway. The production deployment guide covers an existing Kubernetes cluster on Amazon EKS or Azure AKS.
Register the servers. Add each server URL to the catalog and select its transport and authentication type.
Set access permissions. Use registry scopes and ACL sharing to grant the appropriate users or groups access to each resource.
Configure downstream OAuth when needed. For OAuth-protected servers, configure the provider and scopes; Jarvis documents encrypted credential storage and access-token refresh.
Point clients at one endpoint. Connect MCP-compatible clients to the Registry Endpoint to discover and invoke the resources available to them.
In practice
Governance and discovery in practice
A gateway is where tool sprawl becomes a governed catalog: servers are discovered automatically, then exposed only through explicit policy.
FAQ
Frequently asked questions
The questions below separate a gateway that fits an existing MCP estate from one that would require rebuilding it.
An MCP registry catalogs server details and access settings. An MCP gateway provides the endpoint clients use to discover and invoke permitted servers.
Jarvis Registry provides the catalog and gateway capabilities together; the MCP server catalog is not a separate product route.
The MCP Server Gateway & Registry documentation lists HTTPStreamable and SSE as supported transports for server registration.
For OAuth-protected servers, the registry stores credentials encrypted at rest and can refresh an expired or near-expiry access token. The calling copilot does not receive the raw downstream credential.
The public documentation does not specify the encryption algorithm.
The observability documentation describes OpenTelemetry and Prometheus metrics for registry, authentication, and MCP activity, including request counts and latency.
It does not specify that every tool call logs its arguments, identity, or policy snapshot.
Related resources
Jarvis resources
The MCP Gateway is one part of Jarvis Registry. These pages explain the related registry, gateway, skills, and governance roles.
- MCP Gateway FAQ additional questions about MCP server discovery, access, and integration.
- Jarvis Registry the umbrella registry platform that includes MCP, agent, and skill capabilities.
- Agent Gateway runtime access and routing for agent-to-agent interactions.
- Agent Registry agent catalog, ownership, and lifecycle management.
- Skill Gateway private skill authoring, governance, and distribution.
- Enterprise MCP gateway comparison a broader buyer guide to gateway and registry architecture choices.
- Jarvis Knowledge Base enterprise retrieval exposed through the gateway as a governed tool.
- Governed AI overview identity, privacy, and observability across every layer of execution.
Sources
Standards and references
First-party product documentation for the capabilities described on this page.
- MCP Server Gateway & Registry documentation server registration, transports, access control, and downstream OAuth handling.
- Jarvis Registry observability documentation OpenTelemetry pipeline, Prometheus metrics, and documented MCP activity signals.
- Jarvis Registry production deployment guide production deployment architecture for AWS EKS and Azure AKS.
- AWS AgentCore federation documentation the documented import flow for AgentCore MCP servers and agents.
ASCENDING empowers businesses with AI-driven solutions and cloud transformation strategies. Unlock innovation, scalability, and efficiency with our expert services in AI, cloud migration, and digital modernization.