Connect an agent

Agents connect to the gateway via MCP (Model Context Protocol). Once connected, they can access every tool from your configured resources — governed by your policies.

Register an agent

As an admin, open Agent Instances and click Connect; end users self-onboard from the Quickstart page in their portal, which you hand them with Copy portal link. Both open the same catalog of agents and the same setup steps:

1. Click your agent — Claude Code, Cursor, Copilot, Codex, and more
2. Follow the setup steps in the dialog — each agent has its own configuration method
3. Authenticate when prompted — a browser window opens for sign-in

There's nothing to copy back into the dashboard. The gateway registers the agent automatically on its first authenticated connect, and the instance appears in the list.

For agents not in the catalog, pick the Custom agent card in the same grid, then pick how the agent authenticates:

• Auto-register — for clients that perform their own Dynamic Client Registration. Point the agent at the gateway URL and it registers itself on first connect; there's nothing to create here.
• API key — for clients that just need a static header token. The gateway issues a one-time opaque token that you configure in the agent.
• OAuth — for clients that speak OAuth 2.0 but can't self-register via Dynamic Client Registration and instead ask you to hand-paste an authorization URL, token URL, client ID, and client secret into their own settings. The gateway registers an OAuth client with your organization's issuer on the agent's behalf and shows you those values.

For the latter two, copy what's shown immediately — it isn't shown again. See Custom agent for the step-by-step, and Gateway endpoints and authentication for the full detail on both credential types, including what happens when you delete the instance.

See the setup guides for each supported agent:

• Claude Code
• Claude Desktop
• Cursor
• Codex CLI
• Codex App
• ChatGPT
• GitHub Copilot (VS Code)
• GitHub Copilot CLI
• Microsoft Copilot Studio
• OpenCode
• Antigravity
• Gemini CLI
• Custom agent — anything else that speaks MCP

Scope a connection to one MCP

The default endpoint, /gateway/mcp, aggregates every MCP your org has connected into a single tool list. Some agents cap how many tools a connection may expose, and a large catalog can exceed that cap — past it the agent truncates tools or refuses to connect. See Gateway endpoints and authentication for the full reference on both endpoint shapes.

To stay under the cap, connect to a single MCP by appending its slug:

https://your-gateway-url/gateway/mcp/{slug}

Finding the slug — open Resources → your MCP; the MCP Info card shows the Single-MCP gateway URL with a copy button, so you rarely need to build it by hand. The slug is the catalog name for catalog resources (github, slack, …) or the slug you set when adding a custom resource.

This exposes only that MCP's tools. Agents that need several MCPs configure one connection per slug, each well under the cap:

{
  "mcpServers": {
    "github": { "url": "https://your-gateway-url/gateway/mcp/github" },
    "linear": { "url": "https://your-gateway-url/gateway/mcp/linear" },
  },
}

Authentication and policy enforcement are identical to the aggregate endpoint — the slug only narrows which MCP's tools are served. Connecting to a resource your org has added but you haven't connected your account to behaves the same as on the aggregate endpoint: the tools are listed, and calling one returns a link to connect your account. An unknown slug returns 404.

Auto-registration

When an agent connects for the first time, the gateway automatically detects its type and records metadata like client name, version, and protocol version. The agent appears in the dashboard immediately.

Registry vs. Instances

Two views show the same agents from different angles:

• Agent Registry — one card per agent type (Claude Code, Cursor, …) with aggregate instance counts and policy coverage. Use this to answer questions like which tools any Cursor instance can call across the org. See Agent Registry.
• Agent Instances — every individual connected client across all users. Use this to debug a specific agent's identity, history, and effective access.

The instance detail page shows:

• Identity — user, client name and version, MCP protocol version
• Recent activity — audit events for this agent instance
• Effective access — which tools this instance can use based on current policies

Authentication

The first time your agent tries to use a tool that requires authentication (for example, Slack), the gateway will prompt you with a link to connect your account. No upfront setup needed — see Connections for details.

Next steps

Continue to Monitor activity to watch these tool calls appear in the dashboard and audit log. For client-specific setup, see the Claude Code guide or the other supported agents listed above.