MCP services: add, discover and bring under the gateway

Overview

Agents reach tools through the Shield360 MCP gateway. Each tool belongs to a service: a remote MCP server or a REST API wrapped from its OpenAPI description. You register services in Build → MCP → Servers, grant agents the tools they need in Protect → Agents & access, and every call goes through the gateway’s authorization, Shield Protect and audit.

Add a service

1. Open Build → MCP → Servers and select Add a service.
2. Choose MCP server or REST API, give it a name and a tool prefix (agents see prefix.tool), and enter its address.
3. Choose how it authenticates:
   • None.
   • A header, such as Authorization: Bearer <token>. The value is stored encrypted and never shown again.
   • A vault key that holds the credential.
   • Each person’s own account (OAuth). See Agent authorization.
4. Save. Shield360 reads the service’s tools straight away.

Add from the catalog

Select Add from catalog to start from a well-known remote MCP server: GitHub, Atlassian, Linear, Notion, Sentry, Stripe or Hugging Face. The catalog fills in the address, transport, name and prefix. You add the credential the provider gives you, then save.

Note

Providers can move their endpoints. Each catalog entry links to the provider’s documentation, so check the address there. Several providers sign in only with OAuth dynamic client registration, which Shield360 does not offer. For those, use a token from the provider where it issues one, or per-person OAuth with an app you register with the provider.

MCP servers on your computers

The MCP servers on your computers list shows the MCP servers the Shield360 collector found configured in AI clients (Claude Code, Claude Desktop, Cursor, VS Code, Codex and others) on your organization’s computers in the last 30 days. For each one it shows:

• the name it was given
• where it runs: a remote server’s host, or a local server’s command file name
• which AI clients use it
• how many computers and people
• whether a registered service already manages it, matched by host or by name

Select Register on a remote server to open the form filled in from it: from the catalog when its host is a known provider, otherwise from its host. Complete the path and the credential, then save. Local servers run as a program on each computer, so the gateway cannot reach them directly.

The collector keeps only the name, transport, command file name or host, and the client. It never keeps a URL’s path or query, a command’s arguments, headers or environment variables, because those routinely hold keys.