Agents reach tools through the Model Context Protocol, and a tool call can read a database, send an email or move money. An MCP gateway puts the same controls between an agent and a tool server that a model call already gets: a registry, approvals, argument policies, OAuth 2.1 authorization, inline inspection and a record of every call.
01
An agent connected directly to an MCP server trusts whatever that server advertises, sends whatever arguments the model produces and reads whatever comes back. Nothing checks that the catalog has not changed, that an argument is within policy, that a result does not carry an injection, or that the call stays within a budget. Skyfix inserts one governed hop: the agent talks to the gateway, the gateway talks to the registered server, and the six stages run on every call.
02
Tool servers are registered with their endpoint and credential, and their tool catalog is fetched and reviewed before any client can call it. An approved catalog is what agents see; a catalog that changes on the server side is flagged as needing review and the changed tools are withheld until someone approves them. The registry shows each server's health, the number of approved tools and which gateways are admitted to reach it.
03
Approval is per tool, not per server, so a server that offers ten tools can expose three. Argument policies constrain what a call may contain and run in enforce mode, where a violating call is refused, or audit mode, where it is allowed and recorded, which is how a team rolls a new policy out safely. Call limits per key and team keep a looping agent from exhausting a tool.
04
MCP clients connect over streamable HTTP and authorize with OAuth 2.1, with protected resource metadata published by the installation so a client discovers the authorization server it must use. Every tool call therefore carries a known caller, with the key, workspace and environment that scope what it may reach, and the same step-up and session rules apply to the people who administer it.
05
The AI Firewall inspects tool arguments on the way out and tool results on the way back, for prompt injection carried in a document or a web page, for secrets and personal data in arguments, and for content that policy says must be redacted. A finding can block the call, redact the content or open a review case, and it is recorded against the same trace as the model calls around it.
06
Not every gateway should reach every tool. A registered server lists the gateways admitted to call it, so a tool that reads an internal system can be reachable only from the gateways in that network, while a public lookup tool is reachable from all of them.
07
Every tool call lands in the hash-chained ledger with the caller, server, tool, policy result, firewall outcome and trace ID, and draws from the same budgets as model calls. Workflow and tool-loop budgets cap what an agent run may spend across all its calls, and the cost cockpit shows unit cost per tool call.
08
Skyfix implements the Model Context Protocol as both client and server and is tested against the official MCP conformance suite, including the 2026-07-28 specification revision. Transport is streamable HTTP; authorization is OAuth 2.1.
FAQ
A governed hop between MCP clients and tool servers. It decides which servers and tools a caller may use, checks arguments against policy, inspects the call and its result, applies budgets and records the outcome. Skyfix runs it in the same gateway as model and agent traffic.
A direct connection trusts the server's catalog, sends whatever arguments the model produces and reads results unchecked. The gateway adds catalog review, per-tool approval, argument policy, inspection, budgets and evidence without changing the agent.
A server's catalog is fetched and approved tool by tool before agents can call it. When the catalog changes on the server, the changed tools are withheld and the server is flagged for review until someone approves the change.
Yes. The AI Firewall inspects arguments on the way out and results on the way back for injection, secrets and personal data, and can block, redact or open a review case.
The Model Context Protocol as tested by the official conformance suite, including the 2026-07-28 revision, over streamable HTTP with OAuth 2.1 authorization.
