MCP gateway

The MCP gateway gives every computer's AI tools one MCP server, SpanDock's, and connects it on your server to your organisation's MCP connectors: knowledge bases, issue trackers, code hosts, design tools and internal APIs. Each person gets only the connectors and tools they're allowed. Every call passes your rules and guardrails, and is recorded.

The MCP gateway is on the Premium and Enterprise plans, and in the 30-day trial.

How it works

• One MCP server on every computer. AI tools call SpanDock's MCP server on their own computer. The client forwards each call to your server over the encrypted tunnel.
• Your server decides. It checks who is calling, applies permissions, rules and guardrails, and only then calls the connector.
• Credentials stay on the server. Connector tokens and sign-ins are kept in the server's credential store. They are never shown again, never logged, and never sent to computers.
• Each person's own account, if you prefer. A connector can use one shared sign-in, or each person's own account, so the service's own permissions apply too. SpanDock's rules still apply first, and can only narrow that access.

Connectors

Pick connectors from the catalogue on MCP & connectors → MCP gateway → Catalog, such as GitHub, Linear, Notion or Slack. There are 142; see Integrations for the full list.

• Token connectors: paste the token.
• Sign-in connectors: choose Connect and approve SpanDock once in your browser.

You can also add your own MCP servers, over HTTPS or as a program run on the server.

Permissions

Every connector starts read-only for everyone. When you grant write access, its destructive tools (deleting, merging, closing) still need approval.

Each connector has a default, and overrides by person, group, tag or user type (such as Employee or Contractor). An override can turn access on or off, set read-only or read and write, allow or deny tools by name, require approval for some tools, and limit calls a minute.

• The most specific level wins: person, then group and tag, then user type, then the default.
• When a person's groups disagree, the most restrictive setting applies.
• Read-only access hides write and destructive tools completely: they aren't listed and can't be called.

Permissions → Effective permissions shows what one person, computer or user type gets for every tool, and why.

Rules from your policies

Under Safety & compliance → Guardrails → Policies, upload or link your company policies. AI tools can then search them through the gateway.

Suggest rules reads your policies with a model you choose and proposes rules, each quoting the passage it comes from:

• block a tool;
• require approval for a tool;
• make a connector read-only;
• redact emails, phone numbers, card numbers, secrets or your own pattern.

Nothing applies by itself. An administrator accepts each suggestion, edits it, or dismisses it. You can also write rules by hand. A block or read-only rule can't be overridden by a permission.

Approvals

A tool that needs approval doesn't run. The AI tool is told that the call is waiting, and an administrator reviews it on Approvals: who asked, which tool, and the arguments with secrets removed. Approve once lets exactly that call through, once, within 24 hours. A denied call stays denied.

Just-in-time access

On Enterprise, and in the trial, a connector's write tools can be nobody's standing access. People request them for a while, from their AI tool or their computer's dashboard, with a reason and, if you require one, a ticket. An approver you name grants the request, for the time asked or less, and the grant ends by itself. Nobody can approve their own request.

Set it up per connector under Change management → Settings: which tools, the longest grant (up to 8 hours) and who approves. Every request, approval, grant and use is recorded, and the change management report shows who approved what, with the ticket.

Checks on every call

• Redaction of secrets (on by default), email addresses, phone numbers and card numbers, in arguments before they reach the connector and in results before they reach the AI tool.
• Size limits on arguments and results.
• Block patterns: a call whose arguments match is refused.
• Rate limits per computer and connector.
• Your own guardrail service, if you have one, asked before each call.

A refused call returns an error that says why, and the AI tool shows it to the person. On Enterprise, guardrails on computers apply to gateway calls too.

Turn it on

1. On the server's dashboard, open MCP & connectors → MCP gateway and add connectors from the Catalog.
2. Check each connector's default and add overrides if you need them.
3. Turn the gateway on.
4. On Computers, set Every computer to Recommended (SpanDock adds its MCP server to each AI tool it finds) or Enforced (it also reports, or moves aside, the tools' other MCP servers).
5. Check the result under Permissions → Effective permissions.

SpanDock configures Claude Code, Codex, Gemini CLI, Cursor, VS Code (Copilot), Windsurf and Claude Desktop. Every change to a tool's settings is backed up first, and turning the setting off undoes it exactly.

What is recorded

Every call is recorded like any other telemetry and shown in Activity: the connector and tool, the outcome and why, the person and computer, the duration, and how many items were redacted. Arguments and results are recorded only if an administrator turns that on, with a notice to the people concerned.

AI tools can also use the gateway's built-in servers: SpanDock's own read-only telemetry tools (see MCP and the assistant), your company policies, and a guardrail check.