# MCP Manager

> MCP Manager by Usercentrics is the governance and security layer for Model Context Protocol — connect, control, and monitor MCP servers and gateways across your organization.

## Docs

- [Introduction](https://docs.mcpmanager.ai/get-started/introduction.md): What MCP Manager is and the problem it solves: the Model Context Protocol connects AI to your tools but ships without enterprise controls, so MCP Manager puts one governed gateway between your AI clients and your MCP servers — adding identity, governance, runtime protection, and logging. Includes a…
- [Use these docs with your AI agent](https://docs.mcpmanager.ai/get-started/use-docs-with-ai.md): How MCP Manager publishes its documentation for AI agents — a hosted docs MCP server, an agent skill (skill.md), llms.txt, and per-page Markdown — so your developers' coding agents can self-serve accurate, always-current answers about the platform, and how to register the docs MCP server behind your…
- [MCP Servers Overview](https://docs.mcpmanager.ai/mcp-gateway-concepts/mcp-servers/overview.md): What MCP servers are and the three ways MCP Manager connects to them — Remote, Managed, and Workstation — with use cases, trade-offs, and how identities control access across all three.
- [Remote MCP Servers](https://docs.mcpmanager.ai/mcp-gateway-concepts/mcp-servers/remote.md): What remote MCP servers are and how MCP Manager connects to them over HTTPS — whether a SaaS vendor's endpoint or your own self-hosted server — the three authentication methods (standard OAuth with dynamic client registration, OAuth with client pre-registration, and custom-header tokens), how to cho…
- [Choosing a Remote Server's Authentication Method](https://docs.mcpmanager.ai/mcp-gateway-concepts/mcp-servers/choosing-remote-auth.md): How to decide which of MCP Manager's three remote-server authentication methods to use — standard OAuth with dynamic client registration, OAuth with client pre-registration, or a token in custom headers — including what to do when automatic OAuth fails and when to fall back to a workstation server.
- [Managed MCP Servers](https://docs.mcpmanager.ai/mcp-gateway-concepts/mcp-servers/managed.md): What managed MCP servers are — the same MCP server run as multiple named instances in your own infrastructure, per user, team, customer, or environment (staging vs. production) — registering already-deployed instances by URL or launching new ones from a command MCP Manager generates, when to choose…
- [Workstation MCP Servers](https://docs.mcpmanager.ai/mcp-gateway-concepts/mcp-servers/workstation.md): What workstation MCP servers are — MCP servers that run on a local machine and connect to MCP Manager through an encrypted tunnel so they're never exposed to the internet — including why to use them, how the tunnel and local router work, the TUI setup experience, the governance benefits, the outboun…
- [MCP Gateways](https://docs.mcpmanager.ai/mcp-gateway-concepts/mcp-gateways.md): What an MCP gateway is in MCP Manager: one governed URL that aggregates many upstream MCP servers, applies authentication, authorization, and rules to every request and response in the path, and logs everything — plus how clients and upstreams authenticate separately and how the same server can be a…
- [Apps & Agents](https://docs.mcpmanager.ai/mcp-gateway-concepts/apps-and-agents.md): What apps and agents are in MCP Manager: the AI clients that connect to a gateway, how headed OAuth apps appear automatically while headless agents use token-based credentials, and how administrators disable a specific app or agent to control access.
- [Architecture & Trust](https://docs.mcpmanager.ai/mcp-gateway-concepts/architecture-and-trust.md): How the MCP Manager gateway is secured as the control point in the path of every call: why it terminates and re-originates connections by design, encryption in transit and at rest (AES-256-GCM credential vault, key rotation), what it stores and what it never stores, network isolation and static egre…
- [Features](https://docs.mcpmanager.ai/features/overview.md): A complete index of MCP Manager capabilities — gateways and server types, identity and OAuth, tool and feature provisioning, threat prevention, DLP filtering, platform security, observability, alerts, and team administration.
- [Connection Experience](https://docs.mcpmanager.ai/features/connection-experience.md): What an end user experiences when connecting a gateway in MCP Manager: adding the gateway URL in a client like Claude, the tab that opens back to MCP Manager to authorize, how only apps administrators allow can connect, how the flow guides you server by server so you end fully connected, how identit…
- [Feature Provisioning](https://docs.mcpmanager.ai/features/feature-provisioning.md): How to provision which MCP features a gateway exposes in MCP Manager: for each server, choose to allow all, allow only those that match conditions, or block all tools (and the same for resources and prompts), preview a server's live tools using an identity, pin a tool by its name, title, or descript…
- [API Tokens & Headless Agents](https://docs.mcpmanager.ai/features/api-tokens-and-headless-agents.md): How headless agents connect to MCP Manager with API access tokens: how token-based hosts differ from headed OAuth apps, creating a token-based host and generating, copying, and revoking an API access token scoped to a gateway connection, managing connections, and the break-glass toggles that disable…
- [Reporting](https://docs.mcpmanager.ai/features/reporting.md): What the MCP Manager Reporting page shows — the Reports and Usage dashboards, every chart and KPI tile, the fixed 31-day window, and how the charts are derived live from MCP log data.
- [Viewing Logs](https://docs.mcpmanager.ai/features/viewing-logs.md): Where to find MCP request logs in MCP Manager, what every log column and log type means, how the four-entry correlation model works, where to view logs scoped to a server, gateway, connection, or app, and how to export them.
- [PII Filtering](https://docs.mcpmanager.ai/features/pii-filtering.md): The role MCP Manager plays in keeping customer PII out of AI: why teams won't connect their most valuable MCP servers until PII is controlled, how the gateway filters PII inline before it reaches the model or an external tool, how detection and actions work at a high level (with links to the rule en…
- [Gateway Rules Overview](https://docs.mcpmanager.ai/features/gateway-rules/overview.md): How gateway rules work in MCP Manager: the per-gateway Rules tab, the detection methods (regex, Microsoft Presidio, custom engines), detection hooks, failure modes, actions, alerts, rule ordering, and how rule activity appears in logs.
- [Regex](https://docs.mcpmanager.ai/features/gateway-rules/regex.md): How regular-expression gateway rules work in MCP Manager: JavaScript regex syntax with case-insensitive global matching, multiple OR patterns, the five actions (block, redact, replace, mask, hash), and ready-to-use patterns for prompt injection, SSNs, credit cards, and secrets.
- [Microsoft Presidio](https://docs.mcpmanager.ai/features/gateway-rules/presidio.md): How the Microsoft Presidio detection method finds and anonymizes PII in MCP Manager: the analyzer/anonymizer two-pass engine MCP Manager runs for you as a managed add-on, the selectable entity types, the 0.2 default confidence threshold, why it is less reliable for names in free-form text, the Allow…
- [Amazon Bedrock](https://docs.mcpmanager.ai/features/amazon-bedrock.md): What AWS Bedrock Guardrails is and how to connect one to MCP Manager as a custom rule engine: the guardrail policy types, the model-agnostic ApplyGuardrail API integration, the ARN/version/Authorization setup, and the tier, pricing, and logging details to plan for.
- [Google Model Armor](https://docs.mcpmanager.ai/features/google-model-armor.md): What Google Cloud Model Armor is and how to connect a template to MCP Manager as a custom rule engine: the filters it enforces, the sanitizeModelResponse integration, the project/location/template plus service-account-key setup, server-side authentication, and the pricing and behavior to plan for.
- [Lakera Guard](https://docs.mcpmanager.ai/features/lakera-guard.md): What Lakera Guard is and how to connect it to MCP Manager as a custom rule engine: its threat-intelligence-driven detection of prompt injection, jailbreaks, PII, and toxic content, the gateway-level fit, the fixed /v2/guard setup, and the availability and pricing details to know.
- [Google Drive Folder Blocker](https://docs.mcpmanager.ai/features/gateway-rules/google-drive-folder-blocker.md): How the Google Drive Folder Blocker protects sensitive Drive folders from being read or referenced through the Google Workspace MCP: what it inspects, how the folder-hierarchy walk works across shortcuts and shared drives, how to find folder IDs and configure the rule, the accepted ID format and sup…
- [Custom Rule Engines](https://docs.mcpmanager.ai/features/gateway-rules/custom-rules-engines.md): How to add and manage custom rule engines in MCP Manager: the Rule Engines section, provider choices, endpoint/method/header configuration, HTTPS-only and private-IP rejection, header forwarding, IP allowlisting, testing, and deletion rules.
- [Identity Controls](https://docs.mcpmanager.ai/features/identity-controls.md): The per-server identity choice in MCP Manager: for each server on a gateway, an administrator decides whether every user connects with their own identity (bring your own identity) or everyone shares one service account — and what each choice looks like for the end user connecting the gateway, includ…
- [Alerts](https://docs.mcpmanager.ai/features/alerts.md): What the MCP Manager Alerts page surfaces — the error, warning, and info events it raises, what triggers each one, what an alert record contains, and how alerts differ from logs and reporting.
- [Industries](https://docs.mcpmanager.ai/industries/overview.md): How MCP Manager governs agentic AI for regulated industries — financial services, investment management, healthcare, pharma and biotech, insurance, cybersecurity, and energy and utilities — putting one governed gateway between AI agents and the regulated systems they reach, with identity attribution…
- [Financial Services & Banking](https://docs.mcpmanager.ai/industries/financial-services-and-banking.md): How MCP Manager makes agentic AI examinable for banks and financial institutions — one governed gateway that attributes every tool call to a real identity, keeps NPI and special-category data out of models, and produces the evidence trail GLBA, DORA, SR 11-7, NYDFS Part 500, and the EU AI Act demand…
- [Investment Management](https://docs.mcpmanager.ai/industries/investment-management.md): How MCP Manager lets buy-side firms — hedge funds, private equity, and money managers — adopt agentic AI without breaching the information wall: one governed gateway that attributes every tool call to an identity, contains MNPI across pods, keeps positions and LP data out of external models, and cap…
- [Healthcare & Life Sciences](https://docs.mcpmanager.ai/industries/healthcare-and-life-sciences.md): How MCP Manager governs AI for healthcare providers and payers — one governed gateway that detects and redacts PHI before it reaches a model, enforces minimum-necessary access to EHR and FHIR systems, and attributes every clinical-system call to a real identity under HIPAA and GDPR.
- [Pharmaceutical & Biotechnology](https://docs.mcpmanager.ai/industries/pharmaceutical-and-biotechnology.md): How MCP Manager governs AI for pharma and biotech — one governed gateway that keeps drug IP and patient data out of public models, attributes every call into LIMS, eTMF, EDC, and safety systems to a real identity, and produces the inspection-ready record GxP, 21 CFR Part 11, and the EU AI Act expect…
- [Insurance](https://docs.mcpmanager.ai/industries/insurance.md): How MCP Manager governs AI across underwriting and claims for insurers — one governed gateway that attributes every call into the policy and claims systems, keeps NPI and PHI out of models, and produces the documentation NAIC AI bulletins, NYDFS, GLBA, and the EU AI Act demand.
- [Cybersecurity & Threat Intelligence](https://docs.mcpmanager.ai/industries/cybersecurity-and-threat-intelligence.md): How MCP Manager lets security teams and MSSPs adopt the agentic SOC safely — one governed gateway that enforces against tool poisoning at runtime, applies least privilege to agents as first-class identities, keeps tenant data isolated, and produces the audit evidence ISO 42001, NIST AI RMF, and the…
- [Energy & Utilities](https://docs.mcpmanager.ai/industries/energy-and-utilities.md): How MCP Manager brings governed AI to critical infrastructure — one governed gateway that attributes every agent call, controls vendor and third-party access, keeps customer energy data out of models, and produces the audit evidence NERC CIP, NIS2, and GDPR demand.
- [Government & Public Sector](https://docs.mcpmanager.ai/industries/government-and-public-sector.md): How MCP Manager gives government and public-sector teams a zero-trust control point for agentic AI — one governed gateway that isolates credentials, attributes every call to a real identity, keeps citizen data out of models, and produces the audit evidence FISMA, NIST 800-207, the EU AI Act, and GDP…
- [Retail & E-commerce](https://docs.mcpmanager.ai/industries/retail-and-ecommerce.md): How MCP Manager lets retailers join agentic commerce safely with one governed gateway that attributes every agent call into catalog, inventory, pricing, and customer systems, keeps customer PII out of models, and produces the evidence PCI DSS, CCPA/CPRA, and GDPR expect.
- [Tutorials](https://docs.mcpmanager.ai/tutorials/overview.md): Hands-on, guaranteed-to-work lessons for MCP Manager: connect your first MCP server and call a tool, connect an AI client to a gateway, connect a workstation server running on your own machine, build a team gateway, add your first gateway rule, redact PII from tool responses with Presidio, trace a t…
- [Quickstart: Your first governed tool call](https://docs.mcpmanager.ai/tutorials/first-tool-call.md): A hands-on MCP Manager quickstart: add the public docs MCP server with no authentication, put it behind a gateway, connect Claude, call a tool, and watch the request appear in your audit log — end to end in about 15 minutes.
- [Connect your AI client to a gateway](https://docs.mcpmanager.ai/tutorials/connect-your-ai-client.md): A 5-minute walkthrough for end users: paste your MCP Manager gateway URL into Claude, Claude Code, Cursor, or VS Code, authorize in the browser, pick your gateway, and start using its tools.
- [Connect a workstation MCP server](https://docs.mcpmanager.ai/tutorials/connect-a-workstation-server.md): A hands-on walkthrough for connecting an MCP server running on your own machine to MCP Manager: create a workstation server, configure a local instance, run the generated commands to start the encrypted tunnel, test the connection, and call a local tool through a governed gateway.
- [Build a team gateway and invite a teammate](https://docs.mcpmanager.ai/tutorials/team-gateway.md): A hands-on lesson in MCP Manager's access model: create a team, build a gateway for it, provision a server with a trimmed tool allowlist, invite a teammate, and confirm they see only that gateway.
- [Add your first gateway rule](https://docs.mcpmanager.ai/tutorials/first-gateway-rule.md): A hands-on MCP Manager lesson: add a gateway rule that detects sensitive data in tool traffic, run it in a non-blocking alert configuration, trigger it with a test call, and see the alert and rule activity in your logs.
- [Redact PII from tool responses with Presidio](https://docs.mcpmanager.ai/tutorials/pii-filtering.md): A hands-on MCP Manager lesson: add a Microsoft Presidio rule on the response leg of a gateway, fail it closed, trigger it with a tool result that contains an email address, and confirm the value was replaced with a typed tag in your logs.
- [Trace a tool call in your logs](https://docs.mcpmanager.ai/tutorials/trace-in-logs.md): A hands-on MCP Manager lesson in observability: follow the four correlated entries of one tool call, open a log entry to read its body and headers, and answer who did what, when, and through which tool.
- [Run a headless agent with an API token](https://docs.mcpmanager.ai/tutorials/headless-agent.md): A hands-on MCP Manager lesson for developers: create a token-based host in Apps & Agents, generate an API access token scoped to a gateway, call a tool over HTTP with an Authorization: Bearer token, and confirm the call is attributed and logged.
- [Build and connect your first custom rule engine](https://docs.mcpmanager.ai/tutorials/custom-rule-engine.md): A hands-on MCP Manager lesson for developers: write a minimal webhook that redacts emails, expose it over public HTTPS, register it under Rule Engines, verify it with the built-in Test action, attach it to a gateway rule, and confirm the modify verdict in your logs.
- [Find & Connect MCP Servers](https://docs.mcpmanager.ai/mcp-server-guides/overview.md): How to find remote MCP servers that work with MCP Manager — using public listings like PulseMCP and mcpservers.org — and how MCP Manager detects a server's authentication type when you submit its URL, so you know what (if anything) you'll need to bring.
- [Connect Asana](https://docs.mcpmanager.ai/mcp-server-guides/asana.md): Connect Asana's remote MCP server to MCP Manager: register an app in Asana's developer console to get a Client ID and Client Secret, supply them when MCP Manager's detection lands on OAuth client pre-registration, and approve the OAuth screen so tool calls run as each user's own Asana identity.
- [Connect Atlassian Rovo](https://docs.mcpmanager.ai/mcp-server-guides/atlassian.md): Connect Atlassian's Rovo MCP server to MCP Manager: paste the remote MCP URL, click Continue, and approve the Atlassian OAuth consent screen. Standard OAuth 2.1 with dynamic client registration means you bring no keys — just confirm the site(s) and Jira, Confluence, and Compass access for your accou…
- [Connect AWS](https://docs.mcpmanager.ai/mcp-server-guides/aws.md): Connect the AWS MCP Server to MCP Manager. Because it authenticates with AWS IAM SigV4 rather than OAuth or a token header, you run AWS's mcp-proxy-for-aws proxy locally and add it as a Workstation server — so every call to AWS's 15,000+ APIs is signed with your own IAM credentials on your machine a…
- [Connect Bitbucket](https://docs.mcpmanager.ai/mcp-server-guides/bitbucket.md): Connect Bitbucket Cloud through the Atlassian Rovo MCP server. Unlike Jira and Confluence, Bitbucket tools authenticate only with a scoped API token — not OAuth — so this guide covers the two admin prerequisites (an org-linked workspace and API-token authentication enabled in the Rovo MCP server set…
- [Connect Chargebee](https://docs.mcpmanager.ai/mcp-server-guides/chargebee.md): Connect Chargebee's MCP servers to MCP Manager: choose from three servers (Knowledge Base, Data Lookup, Onboarding), copy the environment-specific URL from Chargebee's Agentic AI settings, create an API key, and store it as an Authorization: Bearer header.
- [Connect Datadog](https://docs.mcpmanager.ai/mcp-server-guides/datadog.md): Connect Datadog's MCP server to MCP Manager: enable MCP at the organization level, create a dedicated service account, generate an application key scoped to mcp_read (and optionally mcp_write), resolve the region-specific MCP URL for your Datadog site, and add the server with DD-API-KEY and DD-APPLI…
- [Connect GitHub](https://docs.mcpmanager.ai/mcp-server-guides/github.md): Connect GitHub's remote MCP server to MCP Manager using a Personal Access Token — covering PAT creation, scope selection, toolset URLs, and the identity trade-offs of token-based auth.
- [Connect HubSpot](https://docs.mcpmanager.ai/mcp-server-guides/hubspot.md): Connect HubSpot's remote MCP server to MCP Manager: create an MCP auth app in HubSpot to get a Client ID and Client Secret, supply them when MCP Manager's detection lands on OAuth client pre-registration, and approve the OAuth screen so tool calls run as each user's own HubSpot identity.
- [Connect Metabase](https://docs.mcpmanager.ai/mcp-server-guides/metabase.md): Connect your Metabase instance's built-in MCP server to MCP Manager: find your instance's MCP endpoint, paste it, and approve the OAuth consent screen. Metabase runs its own embedded OAuth server with dynamic client registration — no external provider needed.
- [Connect Notion](https://docs.mcpmanager.ai/mcp-server-guides/notion.md): Connect Notion's remote MCP server to MCP Manager: paste the remote MCP URL, click Continue, and approve the Notion OAuth consent screen. Standard OAuth 2.1 with dynamic client registration means you bring no keys — tools are scoped to your own workspace and permissions.
- [Connect Salesforce](https://docs.mcpmanager.ai/mcp-server-guides/salesforce.md): Connect Salesforce's hosted MCP server to MCP Manager: register an External Client App in your org, grant the api and sfap_api scopes with refresh_token, enable PKCE and JWT-based tokens, pick the right server URL (api.salesforce.com/platform/mcp/v1/<server>), then add the server and supply the Cons…
- [Connect Slack](https://docs.mcpmanager.ai/mcp-server-guides/slack.md): Connect Slack's MCP server to MCP Manager: create a Slack app, request the user scopes its tools need, publish it to the Slack Marketplace or keep it internal, then add the server at https://mcp.slack.com/mcp with your app's Client ID and Client Secret using confidential OAuth.
- [Security Overview](https://docs.mcpmanager.ai/security/overview.md): A short glossary of the key MCP security threats — prompt injection, tool poisoning, rug pulls, server spoofing, token theft, over-privileged access, data leakage, shadow MCP, and missing authentication — with a one-line definition of each and a link to the MCP Manager capability that addresses it.
- [Authentication & Identity](https://docs.mcpmanager.ai/security/authentication-and-identity.md): How MCP Manager authenticates callers and brokers identity to downstream MCP servers: the two-authentications model, per-user versus shared identity schemes, the three server authentication methods (standard OAuth with dynamic client registration, OAuth pre-registration, and token headers), AES-256-…
- [Feature Governance](https://docs.mcpmanager.ai/security/feature-governance.md): How MCP Manager applies least privilege to MCP capabilities: provisioning tools, resources, and prompts with an allowing-all, allow-if-conditions-met, or blocking-all scheme; pinning a capability by matching its name, title, and description so a changed description stops passing the gateway (a defen…
- [Audit & Observability](https://docs.mcpmanager.ai/security/audit-and-observability.md): Why the MCP Manager gateway is the only place an organization can get a complete MCP audit trail, what every call records (full request and response, identity attribution, latency, token estimate, and the four-leg correlation model), how attribution and non-repudiation work, how logging stays non-bl…
- [Runtime Protections](https://docs.mcpmanager.ai/security/runtime-protections.md): How MCP Manager inspects and acts on live MCP traffic: gateway rules that scan tool calls and results on the request and response legs, defenses against direct and indirect (second-order) prompt injection, the detection methods and actions for data-loss prevention, fail-open versus fail-closed behav…
- [Access Control](https://docs.mcpmanager.ai/deployment/access-control.md): How access control works in MCP Manager: roles grant capabilities (what you can do), teams grant gateways (which you can reach), and a user's access is the intersection of the two — why each user has exactly one role but can belong to many teams, plus the per-server identity and feature-provisioning…
- [Roles](https://docs.mcpmanager.ai/deployment/rbac-and-roles/overview.md): How roles and capabilities govern what users can do in MCP Manager: the three built-in roles, creating and duplicating custom roles, how a role is assigned at invite and through SSO, and how roles combine with teams to control access.
- [Teams](https://docs.mcpmanager.ai/deployment/teams.md): How teams in MCP Manager grant users access to gateways: provisioning a gateway to a team, team membership, disabling and deleting teams, how access resolves across multiple teams, and how teams combine with roles.
- [Capabilities](https://docs.mcpmanager.ai/deployment/rbac-and-roles/capabilities.md): The complete reference of MCP Manager capabilities — every permission you can grant to a role, grouped by area (Identities, Servers, Gateways, Hosts, People, Workspace settings, Logging, Alerting, Reporting, Integrations) — and exactly what each one allows.
- [Gateway Deployment Strategies](https://docs.mcpmanager.ai/deployment/gateway-deployment-strategies.md): How to choose a gateway topology in MCP Manager: the building blocks (servers, gateways, teams, roles), the picker versus locked connection URLs, and four strategies — one organization-wide gateway, one per team, one per server, and one per use case — with when each fits and the trade-offs.
- [Safe Rollout Sequence](https://docs.mcpmanager.ai/deployment/safe-rollout-sequence.md): The recommended order for configuring a gateway in MCP Manager before any user connects — so governance is in place before data can move.
- [Hosting & Data Residency](https://docs.mcpmanager.ai/deployment/hosting-and-data-residency.md): Where MCP Manager is hosted — Google Cloud Platform in the United States — whether a self-hosted or on-premise version exists and why the hosted model usually fits, what you keep in your own environment (your servers, an EU copy of your logs, redaction before logging, static egress IPs), and the sta…
- [Product Support](https://docs.mcpmanager.ai/deployment/product-support.md): How to get help with MCP Manager: the in-product chat and ticket system available on every plan via the Get help tab, and the dedicated Slack channel, relationship, and executive access available on Enterprise and higher-tier plans.
- [Uptime & Maintenance Plan](https://docs.mcpmanager.ai/deployment/uptime-and-maintenance-plan.md): How MCP Manager handles deployments and planned maintenance: no regularly scheduled downtime, a minimum 7-day notice window when maintenance is required, and how to subscribe to status.mcpmanager.ai for incident and maintenance announcements by email, Slack, MS Teams, or RSS.
- [Enterprise Strategy & Lockdown](https://docs.mcpmanager.ai/deployment/enterprise-strategy-and-lockdown.md): Where MCP Manager fits in an enterprise AI control stack and the levers admins use to lock it down: funneling all MCP usage through the gateway with client-side connector allowlists, MDM/EDR, and static egress IPs; what MCP Manager governs versus what the endpoint layer controls on the device; the i…
- [Security & Compliance](https://docs.mcpmanager.ai/enterprise/security-and-compliance.md): MCP Manager's public enterprise resource center — security certifications, compliance documents, IP ranges, DPA, NDA, and BAA. Everything your legal, security, and procurement teams need, without going through a sales process.
- [Single Sign-On (SSO)](https://docs.mcpmanager.ai/enterprise/sso.md): How MCP Manager brokers enterprise single sign-on through Auth0: how IdP federation and email-domain routing work, what you provide to connect Okta or Entra ID, just-in-time provisioning, and troubleshooting plus FAQs on sharing credentials securely, secret rotation, break-glass accounts, and social…
- [Add an MCP Manager tile to your IdP dashboard](https://docs.mcpmanager.ai/enterprise/idp-dashboard-tile.md): Configure your IdP so users launch MCP Manager with one click from the IdP dashboard: allow IdP-initiated login, set the tenant-scoped Initiate login URI, and assign the application to users.
- [SCIM Provisioning](https://docs.mcpmanager.ai/enterprise/scim.md): How MCP Manager acts as a SCIM 2.0 service provider so your IdP automatically creates, updates, and deactivates users and syncs IdP groups to MCP Manager teams: connecting Okta or Entra ID with the base URL and bearer token, mapping groups to teams, the user lifecycle, supported SCIM operations, and…
- [Supported Identity Providers](https://docs.mcpmanager.ai/enterprise/supported-identity-providers.md): The identity providers MCP Manager works with for enterprise SSO and SCIM provisioning, in one searchable table. Because sign-in is standards-based OpenID Connect (OIDC) federated through Auth0 and provisioning is SCIM 2.0 (RFC 7643 and RFC 7644), any conformant IdP works — Okta, Microsoft Entra ID,…
- [Programmatic Access](https://docs.mcpmanager.ai/enterprise/programmatic-access.md): How to manage MCP Manager from code: the Admin API and MCP server (in closed beta) provision and configure gateways, servers, identities, roles, and more over MCP tools and REST, scoped by your role capabilities; a downloadable CLI and infrastructure-as-code support are still to come; and the token-…
- [Export to SIEM](https://docs.mcpmanager.ai/enterprise/export-to-siem.md): How MCP Manager forwards structured MCP request logs and traces to any OpenTelemetry (OTLP/HTTP) collector or SIEM — what gets sent, how to set the logs and traces collector URLs and request headers, how trace context propagates downstream, how to verify delivery, and how to troubleshoot export fail…
- [New Relic](https://docs.mcpmanager.ai/enterprise/export-to-siem/new-relic.md): How to forward MCP Manager logs to New Relic over OpenTelemetry: generating a License (ingest) key, choosing the regional OTLP endpoint, configuring the api-key request header, and verifying logs with NRQL.
- [Grafana Cloud](https://docs.mcpmanager.ai/enterprise/export-to-siem/grafana-cloud.md): How to forward MCP Manager logs to Grafana Cloud over OpenTelemetry: the /otlp/v1/logs gateway URL, building the instanceID:token Basic auth header, the logs:write access-policy token, and querying logs in Loki with LogQL.
- [Datadog](https://docs.mcpmanager.ai/enterprise/export-to-siem/datadog.md): How to forward MCP Manager logs to Datadog over OpenTelemetry: the per-site OTLP logs endpoint, the dd-api-key header, and the JSON-vs-protobuf caveat to verify before relying on it.
- [Honeycomb](https://docs.mcpmanager.ai/enterprise/export-to-siem/honeycomb.md): How to forward MCP Manager logs to Honeycomb over OpenTelemetry: the US and EU endpoints, the x-honeycomb-team ingest key, and how dataset routing works via x-honeycomb-dataset or service.name.
- [Splunk Observability Cloud](https://docs.mcpmanager.ai/enterprise/export-to-siem/splunk-observability-cloud.md): Why MCP Manager cannot forward logs directly to Splunk Observability Cloud — it has no OTLP logs intake — and how to deliver logs instead using a self-hosted OpenTelemetry Collector that translates OTLP to Splunk HEC.
- [Self-hosted OpenTelemetry Collector](https://docs.mcpmanager.ai/enterprise/export-to-siem/self-hosted-collector.md): How to forward MCP Manager logs to a self-hosted OpenTelemetry Collector: the OTLP/HTTP receiver on port 4318, the /v1/logs path, adding authentication with collector auth extensions, and using the collector as a universal fallback to any backend.
- [Admin API & MCP Server](https://docs.mcpmanager.ai/admin-api/overview.md): What the MCP Manager Admin API and MCP server are: a control-plane surface that lets an agent or script manage your MCP Manager configuration — servers, gateways, identities, hosts, teams, roles, logs, and integrations — with the same actions as the app, scoped by your role capabilities, over MCP to…
- [Connect an agent to the Admin MCP server](https://docs.mcpmanager.ai/admin-api/connect.md): How to create an MCP Manager admin access token and connect an agent or REST client to the admin MCP server: generate a Personal Access Token in Settings → MCP & API, copy the Connect URL, add the server to Claude or Cursor (or call the REST twin with curl), and confirm access with whoami.
- [Authentication & access](https://docs.mcpmanager.ai/admin-api/authentication.md): The MCP Manager Admin API access model: Personal Access Tokens (mcpm_pat_, SHA-256 hashed at rest, 1–90 day TTL) and OAuth 2.1 with RFC 8707 audience binding, the ff-mcpm-admin entitlement, per-operation capability gating, and the HTTP status codes the API returns on denied, malformed, and failed re…
- [Tool & endpoint reference](https://docs.mcpmanager.ai/admin-api/reference/overview.md): Index of every MCP Manager Admin API operation, grouped by domain. Each operation is exposed as an MCP tool and a REST endpoint from a single definition, so the reference documents both surfaces together, with parameters and the capability each one enforces.
- [Account & Access Tokens](https://docs.mcpmanager.ai/admin-api/reference/account.md): Admin API operations for confirming who you are and what your role permits, and for creating, listing, and revoking your own MCP Manager admin Personal Access Tokens.
- [Servers](https://docs.mcpmanager.ai/admin-api/reference/servers.md): Admin API operations for managing inbound MCP servers: create remote servers with open, header, or OAuth authentication, and rename, enable, disable, and delete them.
- [Identities](https://docs.mcpmanager.ai/admin-api/reference/identities.md): Admin API operations for managing the credential identities a server authenticates with: add, list, delete, enable, disable, set personal-versus-shared availability, and set an identity’s header tokens.
- [Gateways](https://docs.mcpmanager.ai/admin-api/reference/gateways.md): Admin API operations for gateways: create, rename, enable, disable, archive, and issue tokens; assign servers with an identity scheme and manage those assignments; and provision gateways to teams.
- [People, Teams & Roles](https://docs.mcpmanager.ai/admin-api/reference/people.md): Admin API operations for people: invite and deactivate users, assign roles and teams, and create, modify, list, and delete roles and teams.
- [Hosts](https://docs.mcpmanager.ai/admin-api/reference/hosts.md): Admin API operations for hosts and their gateway connections: create, rename, enable, disable, and delete hosts, and list, inspect, enable, and disable the connections between a host and a gateway.
- [Logging](https://docs.mcpmanager.ai/admin-api/reference/logging.md): Admin API operations for observability: query the MCP call logs with filters and pagination, list and inspect alerts, and configure OpenTelemetry log and trace forwarding.
- [What's coming](https://docs.mcpmanager.ai/admin-api/roadmap.md): The MCP Manager Admin API capabilities that are planned but not yet in the beta: reporting and a richer whoami, gateway rules and custom rule engines, per-assignment feature provisioning, an admin audit log, entitlement queries, multi-workspace targeting, a downloadable CLI, and proxying the docs MC…
- [Building Your Own MCP Server](https://docs.mcpmanager.ai/build-your-own-mcp-server/overview.md): A one-stop guide for developers building their own remote MCP server to run behind MCP Manager: the two things any server must do (expose Streamable HTTP and authenticate one of three supported ways), a decision tree for choosing an auth mode, a framework comparison across FastMCP, the TypeScript SD…
- [Build with FastMCP (Python)](https://docs.mcpmanager.ai/build-your-own-mcp-server/fastmcp.md): How to build a FastMCP (Python) MCP server that runs behind MCP Manager: serving Streamable HTTP rather than the unsupported legacy SSE transport, choosing among FastMCP's TokenVerifier, RemoteAuthProvider, OAuthProxy, OIDCProxy and OAuthProvider to match one of MCP Manager's three auth modes, the C…
- [Build with the TypeScript SDK](https://docs.mcpmanager.ai/build-your-own-mcp-server/typescript.md): How to build an MCP server on the official TypeScript SDK to run behind MCP Manager: serving Streamable HTTP with StreamableHTTPServerTransport, choosing between the SDK's full authorization server (mcpAuthRouter, with dynamic client registration) and resource-server mode (mcpAuthMetadataRouter + re…
- [Build on Cloudflare Workers](https://docs.mcpmanager.ai/build-your-own-mcp-server/cloudflare.md): How to build a remote MCP server on Cloudflare Workers that runs behind MCP Manager: serving Streamable HTTP from an McpAgent, using workers-oauth-provider as a full OAuth 2.1 authorization server with dynamic client registration, why its KV-backed client storage avoids the ephemeral-client problem…
- [Build with Spring AI (Java)](https://docs.mcpmanager.ai/build-your-own-mcp-server/java-spring.md): How to build a Java MCP server with Spring AI to run behind MCP Manager: serving the STREAMABLE protocol, choosing between the mcp-authorization-server module (the only JVM path to dynamic client registration, built on Spring Authorization Server) and the resource-server or API-key modules, and the…
- [Build with Go](https://docs.mcpmanager.ai/build-your-own-mcp-server/go.md): How to build a Go MCP server (official Go SDK or mcp-go) to run behind MCP Manager: serving Streamable HTTP, and why these frameworks are resource servers that verify bearer tokens rather than authorization servers with dynamic client registration — so you connect via MCP Manager's token-in-header o…
- [Debugging Your Self-Hosted Server's OAuth](https://docs.mcpmanager.ai/build-your-own-mcp-server/debugging-self-hosted-oauth.md): How to debug a self-hosted remote MCP server whose OAuth identity step fails even though the connection works: why a 'Client Not Registered' / client-ID-not-found error during dynamic client registration is almost always an ephemeral, per-instance client store on autoscaling hosts like Cloud Run, th…
- [Validate MCP Servers with Open Tools](https://docs.mcpmanager.ai/advanced/validate-mcp-servers.md): Confirm an MCP server connects and behaves correctly using free, open-source inspectors that run on your own machine — the official MCP Inspector and MCPJam. Both speak the raw protocol and need no LLM to validate connectivity and list a server's tools, resources, and prompts. Validate connectivity…
- [Gateway Resiliency](https://docs.mcpmanager.ai/advanced/gateway-resiliency.md): What happens when an MCP server in your MCP Manager gateway is down, offline, or unreachable: the gateway keeps every other server working, the offline server's tools drop off the list, and calls to it return a clear error and raise an admin alert. One server's outage is never a gateway-wide outage,…
- [Fix a Broken or Stale MCP Connection](https://docs.mcpmanager.ai/advanced/fixing-broken-connections.md): How to fix a remote MCP server connection that worked before and then broke because of a stale authorization held on the provider's side. Recognize the symptoms — an identity flagged Needs authentication or Disconnected, tool calls returning a re-authentication error, and no provider consent screen…
- [Agents that Pass Identities to MCP Manager](https://docs.mcpmanager.ai/advanced/agents-passing-identities.md): How to whitelist a headless agent for use with Claude and proxy credentials at the calling-user level through MCP Manager: create one token-based host for the agent, let each end user enroll and bring their own identity to mint a per-user access token, and have the agent map each user to their token…
- [Getting fresh data from Claude](https://docs.mcpmanager.ai/advanced/getting-fresh-data-from-claude.md): Why Claude (Claude.ai, Claude Desktop, Claude Code) sometimes answers from an earlier MCP response instead of re-querying, how to recognize it, how to confirm it in your gateway logs, and how to prompt around it so the data you act on is current. MCP Manager always returns live data from the source;…
- [Building a Custom Rule Engine](https://docs.mcpmanager.ai/advanced/building-a-custom-rule-engine.md): The developer reference for building a custom rule-engine webhook for MCP Manager: the request envelope, the pass/block/modify/error response shapes, modifiedPayload.body validation, the 30-second timeout, retries, the 16 MiB cap, and a complete Express example.
- [Custom Rule Engine Examples](https://docs.mcpmanager.ai/advanced/custom-rule-engine-examples.md): Six recipes for what a custom rule-engine webhook can do with the modify and block verdicts: slim verbose responses to cut tokens, strip or redact fields by name, summarize long text, scope data to the caller's identity, enforce a channel or project allowlist, and block on policy violations.
- [Building vs. Buying an MCP Gateway](https://docs.mcpmanager.ai/advanced/building-vs-buying.md): An honest look at building an MCP gateway in-house versus adopting one: why the proxy is the easy 5% and identity brokering, per-upstream OAuth, inline inspection, audit, and a constantly moving spec are where the real cost lives — the same reason teams don't build their own identity provider — plus…
- [Frequently Asked Questions](https://docs.mcpmanager.ai/advanced/faq.md): Answers to common MCP Manager questions: restricting a data source to specific tables, projects, channels, or folders; scoping who can use a single server such as Salesforce; whether a user can hold multiple roles and teams; applying different rules or tools to different groups by using separate gat…