> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Guardway's remote MCP server: manage API keys, policies, members, alerts, providers and budgets, and read usage, spend, the audit log and AI use across your company, from Claude, Codex, Cursor, VS Code, Devin Desktop or any MCP client, with your own Guardway role.

## What this is for

**Guardway MCP** is Guardway's remote MCP server. It lets Owners and Admins manage the organization's gateway [API keys](https://docs.guardway.ai/platform/configuration/api-keys.md) by asking an AI client such as Claude, Codex, Cursor, VS Code or Devin Desktop: find keys, create one with the right restrictions, tighten or loosen what a key can reach, rotate it or revoke it. Owners and Admins can also change the organization's policies and guardrail rules (block a model for an application, add banned keywords, turn on PII redaction), switch MCP tools on and off, invite and remove members, act on anomalies and alert rules, and add providers and MCP servers. Anyone in the organization can also ask about usage and spend, guardrail and MCP activity, the audit log, members, anomalies, gateway health and what policy an application actually gets, and about AI use across the company: who uses which AI tools on which machines, and which repositories and cloud agents use AI. Anyone can also ask what the organization spends on AI and how close each budget is to its limit, and which skills, MCP servers, plugins and editor extensions are on its machines. Owners and Admins can also set organization, team and user budgets. The client sees metadata about people's AI use, never what they typed. It works with any MCP client that can reach a remote server (see [How to configure](https://docs.guardway.ai/guardway-mcp/clients.md#how-to-configure)), and it is available to every Guardway organization.

The client acts as **you**, with your current role in each organization. Read Only members can connect too, but can only look. Examples in these pages say Claude; every client gets the same tools and the same safeguards.

You set it up and manage connected apps in the dashboard under **Settings › Guardway MCP**.

The server URL is:

```
https://mcp.guardway.ai/mcp
```

## How clients sign in

* **claude.ai and Claude Desktop** sign in with your own Guardway account through OAuth. There is no token to copy.
* **Every other client** (Claude Code, Codex CLI, Cursor, VS Code, Devin Desktop and others) sends a Guardway API token, which starts with `gwp_`, as an `Authorization: Bearer` header. What it can do is limited by the token's scopes and by your role. See [Tokens and Scopes](https://docs.guardway.ai/guardway-mcp/tokens-and-scopes.md).
* **ChatGPT** and other clients that only sign in with OAuth and can't send a token can't connect yet.

> [card] [Connect a client](https://docs.guardway.ai/guardway-mcp/clients.md)
>
> Setup for Claude, Claude Code, Codex CLI, Cursor, VS Code, Devin Desktop and others.

> [card] [Tokens and Scopes](https://docs.guardway.ai/guardway-mcp/tokens-and-scopes.md)
>
> Create a `gwp_` token and pick what it may do.

> [card] [Tools](https://docs.guardway.ai/guardway-mcp/tools.md)
>
> Every tool, what it does and example prompts.

## Permissions

* **Your role, checked on every call.** Owners and Admins can create, change, rotate and revoke keys. Read Only members can only list and inspect them. A role change applies on the next call.
* **Reading** usage, spend and budgets, the audit log, policies, members, anomalies, alert rules, gateway health, providers and MCP servers, endpoints and people, the AI inventory and the AI supply chain is open to every role, Read Only included.
* **Changing policies and guardrail rules**, switching MCP tools, managing members, acting on anomalies and alert rules, adding or changing providers and MCP servers, changing budgets, and refreshing cloud agents need the Owner or Admin role. Read Only members can read all of these but change none of them. Deleting is done in the dashboard only; the exception is a budget, which Claude can remove after you confirm.
* **Some team changes need the Owner.** Promoting a member to Admin, and inviting someone as Admin through Claude, are refused for Admins. Nobody can change or remove the Owner, or themselves, from Claude.
* **Tokens** are also limited by their scopes: a **Read API keys** token can't change anything, whatever your role, and a token without **Usage & spend (read)** can't read usage.
* **Several organizations.** If you belong to more than one, Claude asks which organization to work in. Tell it by name.

## How your keys stay safe

* **Key secrets never appear in the chat.** When Claude creates or rotates a key, you get a one-time link instead. Open it in your browser while signed in to Guardway to see the key. The link works once, only for you, and for 10 minutes.
* **Destructive changes need your approval.** Rotating a key, revoking a key, and any change that removes a restriction (for example, removing a budget or an expiry, or letting a key use every model) always show you a preview first: the key's name, owner, expiry, last use and what will happen. Nothing changes until you approve in the conversation. A preview expires after 5 minutes, and it is refused if someone changes the key in the meantime.
* **No gateway-admin access.** Guardway MCP can't give a key gateway-admin access, and can't rotate or edit a key that already has it. Do that in the dashboard.
* **Weakening protection or granting access needs your approval too.** Claude shows a preview and waits for you before it weakens a policy or guardrail rule, switches MCP tools on, invites, promotes or removes a member, rebaselines an anomaly, makes an alert rule alert less, or turns on or widens a provider or an MCP server. See [Claude asks before weakening protection](https://docs.guardway.ai/guardway-mcp/tools.md#claude-asks-before-weakening-protection).
* **Every change is audited.** Each key create, edit, rotate and revoke, and each change Claude makes to policies, rules, MCP tools, members, alert rules, providers and MCP servers, is recorded in the [Audit Log](https://docs.guardway.ai/platform/settings/audit-log.md) under your name, noting that it came through the connector.

## Secrets never go through Claude

Provider keys and MCP server credentials go into Guardway through a **one-time link**, never through the chat. When Claude adds a provider or an MCP server, or you ask it to replace a credential, it creates a link and gives it to you:

**1. Open the link**

Open it in your browser while signed in to the Guardway dashboard, in the same organization. It opens a page under `/secrets/input/` in the dashboard that reads **Claude asked you to enter** the fields it needs, **for** the provider or MCP server by name. Opening the page doesn't use the link up.

**2. Type the values and save**

Type each value into its masked field and choose **Save**. The values go straight to Guardway, encrypted, and Claude never sees them. Saving replaces any value already stored for those fields.

**3. Return to Claude**

The page reads **Saved. You can return to Claude.** A provider that was waiting for its key becomes active, and your gateways pick it up on their next config refresh.

* **One use, 10 minutes, only you.** A link saves values once and expires 10 minutes after Claude creates it. Only the member who asked Claude for it can open it; for anyone else, or in another organization, it reads **Link not found**.
* **An expired or used link** reads **This link has expired** or **This link was already used**. Ask Claude for a new link.
* **Claude refuses a secret pasted in the chat.** If you paste a key into the chat, Claude won't pass it to Guardway: a request carrying anything that looks like a key, token, password or private key is refused before anything is sent, without repeating the value, and Claude offers a link instead. The value is still in your chat history, so **rotate it** with the provider or MCP server, then enter the new one through a link.
* **Credentials stay hidden on the way out too.** Providers and MCP servers are shown with credentials masked or as "stored", never as values.

## What Claude sees about people's AI use

> [!NOTE]
>
> **By default, Claude never sees what people typed into AI tools, or what the tools answered.** Guardway removes prompt and response text before anything reaches the connector, and the connector removes it again on its own, so a gap in one still leaves none in the chat. The only exception is [Prompt previews](https://docs.guardway.ai/guardway-mcp/tools.md#prompt-previews), which an Owner or Admin switches on deliberately.

* **What Claude sees:** who uses which AI tools on which machines, whether their AI accounts are corporate or personal (by email domain), risk, counts of sensitive data found in prompts (secrets, PII, source code), and session timelines: when, which tool, which models, token counts and the names of the tools an AI session called.
* **What Claude never sees:** prompt or response text and what a subagent was asked to do (unless you turned on [Prompt previews](https://docs.guardway.ai/guardway-mcp/tools.md#prompt-previews)), the email address of a signed-in AI account, IP addresses, or the system prompt of a cloud agent.
* **Where the text is.** Owners and Admins can read prompt text in the dashboard **People** view, or through Claude once they turn on [Prompt previews](https://docs.guardway.ai/guardway-mcp/tools.md#prompt-previews).
* **Who can ask.** Every role can read this metadata through Claude, Read Only included. A token needs **Read endpoints & people**.

## Disconnect

* **claude.ai and Claude Desktop:** in Guardway, open **Settings › Guardway MCP** and, under **Connected apps**, choose **Disconnect** next to Claude. Access stops immediately. You can also remove the connector in Claude.
* **Clients with a token:** revoke the token in **Settings → API tokens**, and remove the `guardway` server from the client (in Claude Code, `claude mcp remove guardway`). Tokens also stop working when they expire, after at most 30 days.

## Troubleshooting

> [accordion] "This Guardway account isn't a member of any organization"
>
> You signed in with an account that has no Guardway organization. Ask an Owner or Admin to invite you from [Members](https://docs.guardway.ai/platform/settings/members.md), or disconnect and sign in with the account you use for the dashboard.

> [accordion] Claude keeps asking me to sign in or reconnect
>
> The connection was revoked: someone chose **Disconnect** in **Connected apps**, or (for a client with a token) the token expired or was revoked. Reconnect the connector, or create a new token and add the server again. If your connector still uses the older client ID, add it again with the current one (see [How to configure](https://docs.guardway.ai/guardway-mcp/clients.md#how-to-configure)).

> [accordion] Claude says I'm not allowed to change a key
>
> Your role in that organization is **Read Only**, or your token has **Read API keys** access. Ask an Owner or Admin to change your role, or create a token with **Read and manage API keys**.

> [accordion] Claude says my token is missing a scope
>
> The token wasn't created with the scope that tool needs — for example, asking about spend with a token that has only **Read API keys**. Tokens can't gain scopes: create a new token with the right access in **Settings → API tokens**, update the header in your client, and revoke the old token.

> [accordion] Claude says it can't read endpoints, people or the AI inventory
>
> A token needs **Read endpoints & people** for machines, people and AI sessions, and **Read discovery** for repositories, cloud agents and their findings. Tokens can't gain scopes: create a new token with that access in **Settings → API tokens**, update the header in your client, and revoke the old token.

> [accordion] Claude says the route isn't open to this connection yet
>
> Your token or connector has the access, but your Guardway organization doesn't serve that part to Claude yet, for example endpoints and people or discovery right after they were released. Nothing was changed. Use the dashboard for now, and ask Claude again later.

> [accordion] Claude says the cloud agents were refreshed recently, or a refresh is already running
>
> Each cloud connection refreshes one at a time and then has a cooldown of about 15 minutes. Claude says when you can refresh again. The latest results are already there: ask Claude to list your cloud agents.

> [accordion] Claude won't scan a repository
>
> Repositories are read-only from Claude. Open the repository in the dashboard and choose **Scan** (see [Repositories](https://docs.guardway.ai/discovery/repositories.md)); Claude gives you the link.

> [accordion] Claude won't tell me what someone asked an AI tool
>
> Prompt text needs [Prompt previews](https://docs.guardway.ai/guardway-mcp/tools.md#prompt-previews), and you must be an Owner or Admin. In claude.ai or Claude Desktop, switch on **Prompt previews** for the connector in **Settings › Guardway MCP** under **Connected apps** (after you disconnect and connect again, switch it on again). With a token, it needs `prompts:read`. Without them, Claude shows the session's metadata, and Owners and Admins can read the text in the dashboard **People** view.

> [accordion] Claude asks me to confirm
>
> The change weakens protection or grants access — for example, turning a rule off, allowing every MCP server, a new application policy that allows what the baseline denies, switching an MCP tool on, inviting a member, rebaselining an anomaly, or adding models to a provider. Read the preview: it names what is affected, what gets weaker and the full before and after. Say yes in the conversation to apply it, or no to leave everything as it is. Claude never approves on your behalf. A preview expires after 5 minutes; if it has, ask again.

> [accordion] Claude says the policy, rule or setting was changed by someone else
>
> Someone changed the policy or guardrail rule (or, for an application's policy, the baseline), an alert rule, a provider or an MCP tool — in the dashboard or in another chat — after Claude read it, so Claude's edit was based on old settings. Nothing was changed. If the edit only adds protection and you hadn't approved anything, Claude reads the new settings and tries once more on its own. If you had approved a preview, or the edit would now weaken protection, ask Claude again: it shows a fresh preview based on the current settings for you to approve.

> [accordion] Claude says a policy already exists for that scope
>
> There can be only one policy for the organization baseline and one per application. Claude names the existing policy; ask it to change that one instead.

> [accordion] The cost looks too low
>
> Requests the gateway couldn't price count as \$0 — often Azure deployment names. Claude says how many requests had no price; the real cost is higher by what those requests cost. Usage also lags real time by about an hour.

> [accordion] The reveal link says it expired or was already viewed
>
> A reveal link works once and for 10 minutes. Ask Claude to rotate the key again to get a new link.

> [accordion] The link to enter a credential says it expired, was used or wasn't found
>
> A link to enter credentials works once, for 10 minutes, and only for the member who asked Claude for it. Ask Claude for a new link: for example, "give me a new link for the OpenAI provider's key". **Link not found** can also mean you're signed in to another organization in the dashboard: switch to the organization you asked Claude about.

> [accordion] Claude refused my request because it contained a secret
>
> Claude doesn't pass keys, tokens or passwords from the chat to Guardway, and it didn't send the value. Ask again without the value, and Claude gives you a link to enter it in Guardway. Rotate the secret you pasted: it's still in your chat history.

> [accordion] Claude says only the Owner can do this
>
> Promoting a member to Admin, and inviting someone as Admin through Claude, need the organization's Owner. Ask the Owner to make the change, or invite the person as Read Only and have the Owner promote them.

> [accordion] Claude can't revoke an invitation because the person already joined
>
> An invitation can only be revoked while it's pending. The person is now a member: ask Claude to remove them as a member, which asks you to approve a preview first.

> [accordion] A provider says Waiting for credentials
>
> Claude added it, but nobody has saved its key through the link yet, so your gateways don't use it. Ask Claude for a new link to enter the key.

> [accordion] Claude asks which organization to use
>
> You belong to more than one organization. Tell Claude which one, by name.

## Related

* [API Keys](https://docs.guardway.ai/platform/configuration/api-keys.md) — every key setting Guardway MCP can change.
* [MCP](https://docs.guardway.ai/platform/configuration/mcp.md) — MCP servers and per-key tool rules.
* [Roles](https://docs.guardway.ai/platform/settings/roles.md) — what Owner, Admin and Read Only can do.
* [Security](https://docs.guardway.ai/platform/configuration/security.md) — guardrails and what each guardrail type does.
* [Audit Log](https://docs.guardway.ai/platform/settings/audit-log.md) — the record of every change.
* [Users](https://docs.guardway.ai/platform/settings/members.md) — members, roles and invitations.
* [Notifications](https://docs.guardway.ai/platform/settings/notifications.md) — alert rules and webhooks.
* [Providers](https://docs.guardway.ai/platform/configuration/providers.md) — every provider setting.
* [Guardway CLI](https://docs.guardway.ai/endpoint-ai-risk/agent/overview.md) — how machines report their AI tools and accounts.
* [Repositories](https://docs.guardway.ai/discovery/repositories.md) and [Agents](https://docs.guardway.ai/platform/agents.md) — the AI inventory in the dashboard.
* [Usage](https://docs.guardway.ai/platform/dashboard/usage.md) and [Spend](https://docs.guardway.ai/platform/dashboard/spend.md) — the same figures in the dashboard.
* [Pricing](https://docs.guardway.ai/platform/settings/pricing.md) — the prices the gateway uses to compute cost.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.