Create a Gateway Endpoint

Set up a proxied, authenticated connection between your AI agents and a target MCP server by creating a gateway endpoint on the MCP Gateway page. A gateway endpoint gives agents a Gateway URL to use in place of the direct MCP server URL. Agent Identity Security handles all authentication and optional response scanning behind the scenes. Once created, the endpoint is immediately Active and ready to accept agent traffic.

Before you begin

  • If you plan to use JIT Entra Token authentication, configure a Microsoft Entra ID integration under Integrations first.
  • Have the target MCP server URL available if you are connecting a new server.
  1. In the left navigation sidebar, select Secure, then select MCP Gateway.
  2. Select + Create Endpoint in the top-right area of the page.
    The Create Gateway Endpoint form opens.
  3. Under Endpoint Details, fill in the identification fields:
    Field What to enter
    *Endpoint Name A clear, readable name for this endpoint. For example: Jira Prod Gateway. This name appears in the gateway list and in Event Logs.
    Description A short note about what this endpoint is for.
    *: Mandatory field
  4. Under Data Sanitization, configure optional response scanning:
    Setting What it does when enabled
    PII Scanning Detects and replaces personally identifiable information such as names, email addresses, phone numbers, and national ID numbers with placeholder tokens before the agent sees the response.
    Secret Scanning Detects and removes API keys, tokens, and passwords that might accidentally appear in MCP server responses, preventing them from reaching the agent's context.
    Important: PII Scanning and Secret Scanning add processing time to every response. Enable them only for endpoints where responses may contain user data or sensitive values. Scanning applies to responses from the server only, not to requests sent by the agent.
  5. Under Target MCP Server, choose how to specify the server this endpoint proxies to:

    Use Existing Server (default) — select a server that Agent Identity Security has already discovered and added to the MCP server registry. The endpoint target URL is filled in automatically. Use this option when the MCP server already appears in Registry > MCP.

    Connect New Server — enter the MCP server details manually. Agent Identity Security creates a new registry entry and a gateway endpoint at the same time. Use this option for a server that has not yet been discovered or added to Agent Identity Security.

  6. If you selected Use Existing Server, choose the server from the Select MCP Server dropdown.
  7. If you selected Connect New Server, enter the target MCP server URL and authentication details in the fields provided.
  8. Select Create Endpoint.
The endpoint is created immediately with Active status and appears in the MCP Gateway list. Agent Identity Security generates a unique Gateway URL in the format https://<host>/mcp-proxy/v1/<endpoint-id>. Copy this URL from the Gateway URL column and configure your agent to use it in place of the target server URL.