Platform · 05 · gateway

Every tool call goes through the door.

MCP made tools plug in anywhere, which is excellent and terrifying. The gateway is where those connections get an identity, a permission, a rate limit, and a record.

gatewayone proxy, every protocol

agent
  │
  ├─ shell.exec ──────┐
  ├─ files.write ─────┤
  ├─ http.request ────┤──▶ velone gateway
  ├─ browser.click ───┤      identity
  └─ mcp.call ────────┘      policy
                             token mint
                             egress pin
                             evidence
                                │
                                ▼
                             the world

01 / the problem with mcp

A protocol for tools, with no model for permission.

MCP won, and it deserved to. But a server declares its tools and the client decides whether to call them, which means permission lives wherever the client happens to put it. In practice that is a config file, a wrapper, or nothing.

Connect twelve MCP servers to one agent and you have twelve independent trust decisions with no common audit surface. The gateway collapses them into one.

without

12 servers, 12 trust decisions

Each with its own credential, its own config, and no shared record.

with

12 servers, 1 boundary

One policy file, one token minter, one evidence chain.

02 / what it does

1
Terminate
Every outbound call from the sandbox resolves through the gateway, including DNS.
2
Authenticate
The call carries the session principal, so the upstream sees a named actor.
3
Authorise
Policy decides before a packet leaves, and pins the resolved IP against rebinding.
4
Attest
Request, decision, and response summary append to the evidence chain.

03 / surface

MCP servers: Register a server once; every tool it exposes inherits policy. New tools appearing after an upgrade are denied until someone allows them.
HTTP: An egress proxy with an allowlist, TLS pinning, request and response size caps, and per-host rate limits.
Secrets: Credentials are held in the control plane and injected at the proxy, so the sandbox never sees them.
Internal APIs: Reach services in your VPC without giving the sandbox network access to them. The gateway is the only route.
Browser: Managed Chromium sessions where navigation and downloads are subject to the same egress policy.
Rate limits: Per session, per tool, and per upstream, so a looping agent cannot exhaust a partner's quota.

04 / questions

Do we have to rewrite our MCP servers?

No. Register the server with the gateway and point the agent at the gateway instead of the server. The protocol is unchanged, so existing servers and clients work as they are.

Is the gateway a single point of failure?

It runs as a sidecar per host with a shared control plane, so an instance failure takes out one host's sandboxes rather than the fleet. Policy is cached locally and fails closed if the control plane is unreachable.

Can it see request bodies?

Yes, because it has to in order to enforce argument-level policy. What it retains is up to your redaction rules; by default bodies are hashed rather than stored.

keep reading

PolicyThe rules the gateway enforces.AdaptersWiring your harness into the gateway.SecurityHow egress control holds up under attack.

Ring 0

One door for every tool.

Bring the MCP servers you have already connected. We will put a single boundary in front of all of them.

Request access