Skip to main content

Connector Gateway

Stacklok Enterprise

The Connector Gateway is a component of Stacklok Enterprise.

Learn more about Stacklok Enterprise.

The Connector Gateway provides an identity-aware endpoint for MCP tool calls. It evaluates each connector's policy to expose the connectors available to each caller and brokers connector credentials on their behalf.

It is the counterpart to the AI Gateway. The AI Gateway governs the models your agents can call; the Connector Gateway governs the tools they can use.

Connector Gateway and vMCP​

Use the Connector Gateway to provide people with a group-scoped set of connectors that administrators manage in the console. Use a Virtual MCP Server (vMCP) for applications and agents with a predefined toolset. A vMCP supports static backend selection, tool filtering and renaming, multiple authentication methods, and ToolhiveAuthorizationPolicy resources.

You can run the Connector Gateway and multiple vMCP instances in the same cluster.

What you administer here​

  • Register MCP servers as connectors.
  • Configure how the gateway authenticates to each connector's backend.
  • Grant connector access to directory groups or through Cedar policies.
  • Review tool calls by connector and tool.

Before you start​

Deploy and configure the Connector Gateway before administering connectors. See Configure the Connector Gateway.

Structured connector grants use directory groups. Cluster authorization policy uses OIDC claim groups. See Directory groups and OIDC claim groups.

Contents​