Gateway workspaces: curated MCP endpoints for agents

Overview

Every agent can connect to the Shield360 MCP gateway at /api/mcp and reach everything it has been granted. That is the right default, but a well-connected agent may hold grants to dozens of services. When it works on one task, it does better with fewer tools and clear instructions.

A workspace is a curated endpoint on the same gateway:

https://<your Shield360 address>/api/mcp/w/<workspace address>

A workspace sets:

• Tools: which granted tools agents see at this endpoint.
• Instructions: text sent to each agent when it connects.
• Prompt templates: reusable prompts offered through MCP’s prompts/list and prompts/get.
• Who may connect: named agents, or every agent in the project.

Note

A workspace never grants anything. An agent sees a tool only if the tool is both granted to the agent and picked by the workspace. Revoking a grant takes effect in every workspace on the next call.

Create a workspace

1. Open Build → MCP → Workspaces and select New workspace.

2. Give it a name. The address is made from the name unless you set one (lower-case letters, digits and -).

3. List the tools, one per line:

   Pattern	Matches
   github.create_issue	One tool
   github.*	Every tool of the GitHub service
   contexts.*	Contexts (also served as MCP resources)
   data.*	The governed data tools
   *	Everything the agent is granted

   A workspace with no tools listed offers no tools.

4. Choose the agents that may connect, or turn on All agents. With neither, no agent can connect.

5. Optionally write instructions and add prompt templates, then save.

The workspace card shows its endpoint, with a button to copy it.

Connect an agent

Use the workspace endpoint wherever you would use /api/mcp. Agents authenticate exactly as on the main endpoint: with their agent token as a Bearer credential, in an X-API-Key header, or with an OAuth access token from the gateway. ?profile=copilot works here too.

A workspace that does not exist, is disabled, or is closed to the agent answers 404 in every case, so the response does not reveal whether the address exists.

Prompt templates

Write {{name}} where an argument goes. Each placeholder becomes a required argument:

Summarize the open issues in {{repository}} for a weekly update.

Values are inserted as plain text, once. A value that itself contains {{…}} is not expanded. The gateway records which prompt an agent fetched, never its arguments.

Contexts as resources

When a workspace includes contexts.* and the agent is granted contexts, the gateway lists them through MCP’s resources/list as shield360://contexts/<id>. Reading one (resources/read) is the same as calling contexts.read, so it crosses the same authorization, Protect and injection checks as any tool call, and it is recorded the same way.

What stays the same

Every call through a workspace crosses the same boundary as on /api/mcp: grants, action scopes, approval rules, Shield Protect, prompt-injection checks, sequence policies, rate limits and the activity record. See Agent authorization.

Permissions

Action	Permission
View workspaces	View agent access
Create or change a workspace	Grant agent access
Delete a workspace	Revoke agent access