Skip to main content

​
What this is for

Guardway MCP is Guardway’s remote MCP server. It lets Owners and Admins manage the organization’s gateway API keys by asking an AI client such as Claude, Codex, Cursor, VS Code or Devin Desktop: find keys, create one with the right restrictions, tighten or loosen what a key can reach, rotate it or revoke it. Owners and Admins can also change the organization’s policies and guardrail rules (block a model for an application, add banned keywords, turn on PII redaction), switch MCP tools on and off, invite and remove members, act on anomalies and alert rules, and add providers and MCP servers. Anyone in the organization can also ask about usage and spend, guardrail and MCP activity, the audit log, members, anomalies, gateway health and what policy an application actually gets, and about AI use across the company: who uses which AI tools on which machines, and which repositories and cloud agents use AI. Anyone can also ask what the organization spends on AI and how close each budget is to its limit, and which skills, MCP servers, plugins and editor extensions are on its machines. Owners and Admins can also set organization, team and user budgets. The client sees metadata about people’s AI use, never what they typed. It works with any MCP client that can reach a remote server (see How to configure), and it is available to every Guardway organization. The client acts as you, with your current role in each organization. Read Only members can connect too, but can only look. Examples in these pages say Claude; every client gets the same tools and the same safeguards. You set it up and manage connected apps in the dashboard under Settings › Guardway MCP. The server URL is:

​
How clients sign in

  • claude.ai and Claude Desktop sign in with your own Guardway account through OAuth. There is no token to copy.
  • Every other client (Claude Code, Codex CLI, Cursor, VS Code, Devin Desktop and others) sends a Guardway API token, which starts with gwp_, as an Authorization: Bearer header. What it can do is limited by the token’s scopes and by your role. See Tokens and Scopes.
  • ChatGPT and other clients that only sign in with OAuth and can’t send a token can’t connect yet.

Connect a client

Setup for Claude, Claude Code, Codex CLI, Cursor, VS Code, Devin Desktop and others.

Tokens and Scopes

Create a gwp_ token and pick what it may do.

Tools

Every tool, what it does and example prompts.

​
Permissions

  • Your role, checked on every call. Owners and Admins can create, change, rotate and revoke keys. Read Only members can only list and inspect them. A role change applies on the next call.
  • Reading usage, spend and budgets, the audit log, policies, members, anomalies, alert rules, gateway health, providers and MCP servers, endpoints and people, the AI inventory and the AI supply chain is open to every role, Read Only included.
  • Changing policies and guardrail rules, switching MCP tools, managing members, acting on anomalies and alert rules, adding or changing providers and MCP servers, changing budgets, and refreshing cloud agents need the Owner or Admin role. Read Only members can read all of these but change none of them. Deleting is done in the dashboard only; the exception is a budget, which Claude can remove after you confirm.
  • Some team changes need the Owner. Promoting a member to Admin, and inviting someone as Admin through Claude, are refused for Admins. Nobody can change or remove the Owner, or themselves, from Claude.
  • Tokens are also limited by their scopes: a Read API keys token can’t change anything, whatever your role, and a token without Usage & spend (read) can’t read usage.
  • Several organizations. If you belong to more than one, Claude asks which organization to work in. Tell it by name.

​
How your keys stay safe

  • Key secrets never appear in the chat. When Claude creates or rotates a key, you get a one-time link instead. Open it in your browser while signed in to Guardway to see the key. The link works once, only for you, and for 10 minutes.
  • Destructive changes need your approval. Rotating a key, revoking a key, and any change that removes a restriction (for example, removing a budget or an expiry, or letting a key use every model) always show you a preview first: the key’s name, owner, expiry, last use and what will happen. Nothing changes until you approve in the conversation. A preview expires after 5 minutes, and it is refused if someone changes the key in the meantime.
  • No gateway-admin access. Guardway MCP can’t give a key gateway-admin access, and can’t rotate or edit a key that already has it. Do that in the dashboard.
  • Weakening protection or granting access needs your approval too. Claude shows a preview and waits for you before it weakens a policy or guardrail rule, switches MCP tools on, invites, promotes or removes a member, rebaselines an anomaly, makes an alert rule alert less, or turns on or widens a provider or an MCP server. See Claude asks before weakening protection.
  • Every change is audited. Each key create, edit, rotate and revoke, and each change Claude makes to policies, rules, MCP tools, members, alert rules, providers and MCP servers, is recorded in the Audit Log under your name, noting that it came through the connector.

​
Secrets never go through Claude

Provider keys and MCP server credentials go into Guardway through a one-time link, never through the chat. When Claude adds a provider or an MCP server, or you ask it to replace a credential, it creates a link and gives it to you:
1

Open the link

Open it in your browser while signed in to the Guardway dashboard, in the same organization. It opens a page under /secrets/input/ in the dashboard that reads Claude asked you to enter the fields it needs, for the provider or MCP server by name. Opening the page doesn’t use the link up.
2

Type the values and save

Type each value into its masked field and choose Save. The values go straight to Guardway, encrypted, and Claude never sees them. Saving replaces any value already stored for those fields.
3

Return to Claude

The page reads Saved. You can return to Claude. A provider that was waiting for its key becomes active, and your gateways pick it up on their next config refresh.
  • One use, 10 minutes, only you. A link saves values once and expires 10 minutes after Claude creates it. Only the member who asked Claude for it can open it; for anyone else, or in another organization, it reads Link not found.
  • An expired or used link reads This link has expired or This link was already used. Ask Claude for a new link.
  • Claude refuses a secret pasted in the chat. If you paste a key into the chat, Claude won’t pass it to Guardway: a request carrying anything that looks like a key, token, password or private key is refused before anything is sent, without repeating the value, and Claude offers a link instead. The value is still in your chat history, so rotate it with the provider or MCP server, then enter the new one through a link.
  • Credentials stay hidden on the way out too. Providers and MCP servers are shown with credentials masked or as “stored”, never as values.

​
What Claude sees about people’s AI use

By default, Claude never sees what people typed into AI tools, or what the tools answered. Guardway removes prompt and response text before anything reaches the connector, and the connector removes it again on its own, so a gap in one still leaves none in the chat. The only exception is Prompt previews, which an Owner or Admin switches on deliberately.
  • What Claude sees: who uses which AI tools on which machines, whether their AI accounts are corporate or personal (by email domain), risk, counts of sensitive data found in prompts (secrets, PII, source code), and session timelines: when, which tool, which models, token counts and the names of the tools an AI session called.
  • What Claude never sees: prompt or response text and what a subagent was asked to do (unless you turned on Prompt previews), the email address of a signed-in AI account, IP addresses, or the system prompt of a cloud agent.
  • Where the text is. Owners and Admins can read prompt text in the dashboard People view, or through Claude once they turn on Prompt previews.
  • Who can ask. Every role can read this metadata through Claude, Read Only included. A token needs Read endpoints & people.

​
Disconnect

  • claude.ai and Claude Desktop: in Guardway, open Settings › Guardway MCP and, under Connected apps, choose Disconnect next to Claude. Access stops immediately. You can also remove the connector in Claude.
  • Clients with a token: revoke the token in Settings → API tokens, and remove the guardway server from the client (in Claude Code, claude mcp remove guardway). Tokens also stop working when they expire, after at most 30 days.

​
Troubleshooting

You signed in with an account that has no Guardway organization. Ask an Owner or Admin to invite you from Members, or disconnect and sign in with the account you use for the dashboard.
The connection was revoked: someone chose Disconnect in Connected apps, or (for a client with a token) the token expired or was revoked. Reconnect the connector, or create a new token and add the server again. If your connector still uses the older client ID, add it again with the current one (see How to configure).
Your role in that organization is Read Only, or your token has Read API keys access. Ask an Owner or Admin to change your role, or create a token with Read and manage API keys.
The token wasn’t created with the scope that tool needs — for example, asking about spend with a token that has only Read API keys. Tokens can’t gain scopes: create a new token with the right access in Settings → API tokens, update the header in your client, and revoke the old token.
A token needs Read endpoints & people for machines, people and AI sessions, and Read discovery for repositories, cloud agents and their findings. Tokens can’t gain scopes: create a new token with that access in Settings → API tokens, update the header in your client, and revoke the old token.
Your token or connector has the access, but your Guardway organization doesn’t serve that part to Claude yet, for example endpoints and people or discovery right after they were released. Nothing was changed. Use the dashboard for now, and ask Claude again later.
Each cloud connection refreshes one at a time and then has a cooldown of about 15 minutes. Claude says when you can refresh again. The latest results are already there: ask Claude to list your cloud agents.
Repositories are read-only from Claude. Open the repository in the dashboard and choose Scan (see Repositories); Claude gives you the link.
Prompt text needs Prompt previews, and you must be an Owner or Admin. In claude.ai or Claude Desktop, switch on Prompt previews for the connector in Settings › Guardway MCP under Connected apps (after you disconnect and connect again, switch it on again). With a token, it needs prompts:read. Without them, Claude shows the session’s metadata, and Owners and Admins can read the text in the dashboard People view.
The change weakens protection or grants access — for example, turning a rule off, allowing every MCP server, a new application policy that allows what the baseline denies, switching an MCP tool on, inviting a member, rebaselining an anomaly, or adding models to a provider. Read the preview: it names what is affected, what gets weaker and the full before and after. Say yes in the conversation to apply it, or no to leave everything as it is. Claude never approves on your behalf. A preview expires after 5 minutes; if it has, ask again.
Someone changed the policy or guardrail rule (or, for an application’s policy, the baseline), an alert rule, a provider or an MCP tool — in the dashboard or in another chat — after Claude read it, so Claude’s edit was based on old settings. Nothing was changed. If the edit only adds protection and you hadn’t approved anything, Claude reads the new settings and tries once more on its own. If you had approved a preview, or the edit would now weaken protection, ask Claude again: it shows a fresh preview based on the current settings for you to approve.
There can be only one policy for the organization baseline and one per application. Claude names the existing policy; ask it to change that one instead.
Requests the gateway couldn’t price count as $0 — often Azure deployment names. Claude says how many requests had no price; the real cost is higher by what those requests cost. Usage also lags real time by about an hour.
Claude doesn’t pass keys, tokens or passwords from the chat to Guardway, and it didn’t send the value. Ask again without the value, and Claude gives you a link to enter it in Guardway. Rotate the secret you pasted: it’s still in your chat history.
Promoting a member to Admin, and inviting someone as Admin through Claude, need the organization’s Owner. Ask the Owner to make the change, or invite the person as Read Only and have the Owner promote them.
An invitation can only be revoked while it’s pending. The person is now a member: ask Claude to remove them as a member, which asks you to approve a preview first.
Claude added it, but nobody has saved its key through the link yet, so your gateways don’t use it. Ask Claude for a new link to enter the key.
You belong to more than one organization. Tell Claude which one, by name.
  • API Keys — every key setting Guardway MCP can change.
  • MCP — MCP servers and per-key tool rules.
  • Roles — what Owner, Admin and Read Only can do.
  • Security — guardrails and what each guardrail type does.
  • Audit Log — the record of every change.
  • Users — members, roles and invitations.
  • Notifications — alert rules and webhooks.
  • Providers — every provider setting.
  • Guardway CLI — how machines report their AI tools and accounts.
  • Repositories and Agents — the AI inventory in the dashboard.
  • Usage and Spend — the same figures in the dashboard.
  • Pricing — the prices the gateway uses to compute cost.