How the MCP gateway works

What it does

The MCP gateway sits between your MCP client (Claude Code, claude.ai, an agent built on an MCP SDK, or any client that speaks streamable HTTP) and the MCP servers your organisation registers. Each request is authenticated, checked against your organisation's rate limits and access rules, forwarded to the server, and logged as a tool call you can attribute to a key, team, user or customer.

• Authentication with a CoreValue API key or virtual key, sent in Authorization: Bearer. Keys in the URL (?key=) are refused, because a URL ends up in access logs. Clients that can only sign in with OAuth, such as claude.ai, sign a member in through CoreValue instead, once client sign-in is turned on for the organisation on Gateway › MCP servers.
• No credential forwarding. Only content-type, accept, mcp-session-id, mcp-protocol-version and last-event-id reach the MCP server. Your CoreValue key never does. When a server needs its own credential, CoreValue adds the one stored for that server — or, for a server that uses OAuth, an OAuth token for that server. See Servers that need their own sign-in.
• Streaming passes through unbuffered, including progress notifications.
• Tool-call logging: method, tool name, status, latency and attribution for every call. See Tool-call logging and cost.

Endpoints

Register servers on Gateway › MCP servers (see Add MCP servers). Each has an id. Clients can connect to:

• https://gateway.corevalue.dev/mcp — one endpoint for all of your organisation's enabled servers. Tool names are prefixed with the server id, as <server-id>__<tool>.
• https://gateway.corevalue.dev/mcp/<server-id> — a single server.

For Claude Code:

claude mcp add --transport http corevalue \
  https://gateway.corevalue.dev/mcp \
  --header "Authorization: Bearer $COVA_API_KEY"

Any other client that accepts a header needs the same two things: the endpoint, and the Authorization header. See Connect MCP clients.

To attribute tool calls to an end user or a customer, send Cova-User-Id and Cova-Customer-Id on each request, as on the LLM gateway. They are read for logging and never forwarded to the MCP server.

To try a server with a model before connecting a client, use Gateway › Playground. See Try tools in the playground.

Limits

• Tool calls are not priced. Their cost is recorded as unknown, never as $0, and they are excluded from spend totals.
• Streamable HTTP only. stdio and the legacy SSE transport are not supported.

To decide which teams, members and keys may call which tools, see Access rules for tools and agents.