# What is an MCP gateway? One door for every Claude tool call An MCP gateway is one controlled doorway that every AI tool call passes through, so you can log it, block it, or ask a human before it runs. Published 3 September 2026 · By The GainWix team · Gateway · https://gainwix.ai/blog/what-is-an-mcp-gateway/ An MCP gateway is one controlled doorway between an AI app and every tool it can reach. Claude Desktop, Cowork, or Claude Code sends a tool call. The gateway sees it first. It writes the call down, lets it pass, stops it, or holds it for a human. Nothing touches your files, your database, or your email without going through that door. You own the door, so you own what the assistant can do. ## What MCP is, in plain words MCP stands for Model Context Protocol. Anthropic published it as an open standard in November 2024. The [announcement](https://www.anthropic.com/news/model-context-protocol) describes the problem it fixes. Every new data source used to need its own custom connection. MCP replaces those one-off connections with a single protocol. The [MCP site](https://modelcontextprotocol.io/introduction) uses a plain picture. MCP is like a USB-C port for AI apps. One plug shape, many devices. Three parts make it work. The host is the AI app, such as Claude Code. Servers are the small programs that offer tools, files, and prompts. Clients are the connectors inside the host that talk to each server. The word that matters here is "tools". In MCP, a tool is a function the model can run. Read a file. Query a database. Send a message. Delete a record. Each one is real work in your real world. ## Why every tool is a door The MCP [specification](https://modelcontextprotocol.io/specification/2025-06-18) says this outright. Tools "represent arbitrary code execution and must be treated with appropriate caution". It goes further. Hosts "must obtain explicit user consent before invoking any tool". The Claude Code [MCP docs](https://code.claude.com/docs/en/mcp) say the same thing from the other side. "Verify you trust each server before connecting it." Servers that fetch outside content can carry prompt injection. A web page can hide an instruction. The model reads it. The model might act on it. So each MCP server you connect is a door into your house. Some doors lead to the kitchen. Some lead to the safe. The model doesn't always know the difference. You do. ## Why one doorway beats many Picture a normal setup. Claude Code has five MCP servers connected. GitHub, a database, Slack, the file system, and a browser. Each server is its own door. Each one has its own trust dialog, its own permissions, its own idea of what's risky. Now something goes wrong. A tool call you didn't expect. Which door did it come through? What did it touch? Was it the browser reading a page that told the model to do it? You'd have to check five places. Five logs, if they exist at all. An MCP gateway collapses those five doors into one. Every call from every server passes through the same point. One set of rules. One log. One inbox for the calls that need a human. The [spec](https://modelcontextprotocol.io/specification/2025-06-18) admits MCP "cannot enforce these security principles at the protocol level". The protocol carries the messages. Somebody has to stand at the door. That somebody is the gateway. The story in [One doorway between Claude and everything you own](/blog/one-doorway/) shows what this feels like on a working Tuesday. This post is the plain version of the same idea. ## What an MCP gateway logs The gateway sees everything, so it can write everything down. A good log records the same fields for every call, no matter which server handled it. 1. The time the call arrived. 2. The tool that was called, and the server it belongs to. 3. The arguments the model passed in. The file path, the query, the message text. 4. What the gateway decided. Allowed, blocked, or sent for approval. 5. Who approved it, if a person did. 6. What came back. Success, error, or refusal. The log has to be tamper-evident. That's a plain phrase for a simple promise. If any line is edited or removed later, you can tell. Without that, the log is a story. With it, the log is a record. ## What an MCP gateway blocks Blocking works on two levels. The first is the allow-list. You name the tools the model may use. Everything else is off. A new server might offer twenty tools. You allow four. The other sixteen don't exist as far as the model is concerned. The second level is the budget. Some tools are fine in small doses and worrying in large ones. Running the test suite once is normal. Running it two hundred times in a loop is a bug or a runaway. A per-tool budget puts a ceiling on it. Hit the ceiling, and the gateway stops the call. Blocking is quiet. The model gets a refusal and moves on. You get a line in the log. Nobody has to wake up. ## What an MCP gateway asks a human about Some actions shouldn't be blocked and shouldn't be automatic either. Sending an email to a client. Pushing to the main branch. Deleting a table. Posting in the team channel. These are the calls where a human should look first. A gateway holds these calls in an inbox. The model pauses. You see what it wants to do, in full. You approve, or you don't. Then the model continues or takes another path. This is the "explicit user consent" the spec asks for, made practical. Not a dialog on every tool call. A dialog on the ones you marked as risky. ## How GainWix AI Studio does it GainWix AI Studio is a local-first control plane for Claude Desktop, Cowork, and Claude Code. Every Claude tool call goes through one gateway you control. It runs on your own machine, not on somebody else's server. Inside it, you get the three things this post has described. - **Per-tool allow-lists and budgets.** You pick which tools Claude can use and how much of each. - **An Approval Inbox.** Risky actions stop there and wait for you. - **A tamper-evident audit log.** Every call, every decision, written down and hard to quietly change. The app is a free desktop download from gainwix.ai for macOS, Windows, and Linux. The [security page](/security/) lists what the gateway does and how it stores the log. GainWix Workmates run through the same door. A role you hire, not a feature you configure, but still one doorway. ## A worked example with Claude Code Say you ask Claude Code to fix a failing test, push the fix, and tell the team. Here's what a day with the gateway looks like, call by call. | Tool call | Gateway action | What you see | |---|---|---| | Read files in the project | Allow | One line in the audit log | | Run the test suite | Allow, inside its budget | A log line and a count against the budget | | Push to a feature branch | Allow | A log line with the branch name | | Push to the main branch | Ask | An item in the Approval Inbox | | Drop a database table | Block | A blocked entry in the log, and Claude gets a refusal | | Send a message to the team channel | Ask | The full message text waiting in the Approval Inbox | Claude Code does the real work. It reads, tests, and pushes without asking. It stops at the two doors you marked. You glance at the inbox between meetings, read the message, and tap approve. Later, anyone can read the log and see every step in order. That's the whole idea. The assistant isn't slower at the safe parts. It's only slower at the parts that should be slow. ## MCP gateway or MCP server People mix these up, so here's the short version. An MCP server offers tools. It's the thing on the far side of the door. GitHub's server offers GitHub tools. A database server offers query tools. An MCP gateway sits on the near side, between the AI app and all of its servers. It doesn't offer tools of its own. It decides what happens to each call. You can have many servers. You want one gateway. ## Where to start Download the GainWix app and connect Claude Code. Open the allow-list and tick the tools you're comfortable with. Mark send, delete, and push-to-main as ask. Then hand Claude Code a real job and go make tea. When you come back, the Approval Inbox has one item in it. The message to your team, word for word, waiting for your nod. Everything else already got done, and the log says so. If you want the longer story of that first handoff, read [One doorway](/blog/one-doorway/) next. ## Questions people also ask **Is an MCP gateway the same as an MCP server?** No. An MCP server offers tools and data to an AI app, while an MCP gateway sits between the app and all of its servers. The gateway decides which calls pass, which stop, and which wait for a person. **Do I need an MCP gateway if I only use one server?** It still helps, because even one server can hold a tool that deletes or sends. A gateway gives you a log and an approval step from day one, so adding a second server changes nothing about how you stay in control. **Does an MCP gateway slow Claude down?** Allowed calls pass straight through, and only the risky ones pause for a human. That pause is the point, because it's where you catch the one action you didn't want. ## Sources - Model Context Protocol — Specification 2025-06-18, Security and Trust & Safety — https://modelcontextprotocol.io/specification/2025-06-18 (checked 2026-09-03) - Model Context Protocol — What is the Model Context Protocol (MCP)? — https://modelcontextprotocol.io/introduction (checked 2026-09-03) - Anthropic — Introducing the Model Context Protocol — https://www.anthropic.com/news/model-context-protocol (checked 2026-09-03) - Claude Code docs — Connect Claude Code to tools via MCP — https://code.claude.com/docs/en/mcp (checked 2026-09-03) --- GainWix AI Studio is a free desktop download: https://gainwix.ai/download/ Work with AI that works with you.