Praesidia's MCP gateway sits between your agents and the MCP (Model Context Protocol) servers you register: it gives each server its own identity, allows or denies each tool per connection and constrains the arguments it accepts. It records the decisions it makes on the tool calls that pass through Praesidia — without changing the server's code.
A tool's description is an instruction to the model, so a definition that changes after you approved it is flagged rather than absorbed.
Credentials per server instead of one secret copied into each agent's configuration, revocable on their own.
The same server can expose read tools to one agent and nothing destructive to another.
Tool calls that pass through Praesidia are recorded and correlated back to the requesting agent, team and workflow.
Discover. Register your MCP servers and see which agents connect to each one.
Inspect tools. Each server is inventoried tool by tool, with drift flagged against the approved fingerprint.
Set permissions. Allow or deny each tool per connection, and constrain the argument values it accepts.
Enforce. Rate limits cap how often a looping agent can call a tool, and guardrails check the arguments and the result of a tool call an agent makes during a chat turn.
Prove. Praesidia records the decisions it makes on tool calls in an append-only, hash-chained audit trail, signed under the default configuration.
Each client below has a setup guide naming the exact version, transport and tool path that were validated. Coverage labels come from the runtime catalog, last reviewed 2026-09-07.
OpenCode 1.18.29 authenticates and discovers the runnable managed MCP companion. Explicit prepare, owned checkpoint and approved resume pass transport and durable-restart acceptance.
Setup & validation guide →Claude Code 2.1.202 authenticates and discovers the runnable managed MCP companion. Explicit prepare, owned checkpoint and approved resume pass transport and durable-restart acceptance.
Setup & validation guide →Installable n8n node 0.1.0 executes authenticated managed MCP prepare, checkpoint and explicit approved resume against an independently signed inert target.
Setup & validation guide →The installable tool plugin passes actual Dify Plugin SDK 0.10.2 loading and authenticated managed MCP prepare, checkpoint and approved resume. Official CLI 0.6.10 produces its local package.
Setup & validation guide →The runnable component passes actual lfx 1.12.0 invocation over authenticated managed MCP, including prepare, owned checkpoint and explicit approved resume with independent target-receipt verification.
Setup & validation guide →The credential-free source package that makes OpenCode, Claude Code, n8n, Dify and Langflow runnable clients of one approval-bound Praesidia target.
Read the README → Full runtime catalogCoverage labels: Limited coverage — validated on the specific version, transport, and tool path named in its setup guide; anything outside that scope needs your own acceptance test.
Read the docs: connections · guardrails · the MCP governance guide. Then: runtime security · MCP servers on an internal developer platform · MCP authentication: OAuth 2.1 vs API keys · MCP gateway comparison 2026.
An MCP gateway is an enforcement point between AI agents and the MCP servers they call. It authenticates the agent, decides whether this agent may call this tool with these arguments, and records the decision, so the rules for every server behind it live in one place. Praesidia's MCP gateway does this for the MCP servers you register.
No. You register the server with Praesidia, and its tools are inventoried and governed from there. Servers deployed before governance existed can be brought under the same controls without a code change.
Praesidia records the decisions it makes on tool calls in an append-only, hash-chained audit trail, signed under the default configuration; a call's arguments and result are kept in a separate call log, which is not signed. A signed record shows it was not changed afterwards. It does not show that every action was captured.
Guardrails check the arguments and the result of a tool call an agent makes during a chat turn. Tool permissions, argument constraints and rate limits are separate controls, set per connection and per tool.
No. Inventory, drift detection and every control on this page apply to the servers you register. Calls that do not pass through Praesidia are not recorded.
It is flagged. Each server's tools are compared with the definitions you approved, and a definition that changed afterwards is flagged for review rather than absorbed, because a tool's description is an instruction to the model.
Get started for free. No credit card required.
