Your first governed call

Use a test environment, one approved server, and a harmless read tool. This walkthrough starts with an available gateway. If you operate the deployment, complete deployment checks first.

Before you connect

You need an activated server, an identity authorized for a read tool, and an enabled credential binding when the upstream requires credentials. Obtain the governed MCP endpoint from the server’s connection details. The control-plane origin and runtime origin can differ.

Architecture / trust boundaryAM / 05

One governed path to your tools

Scroll the diagram sideways to see the full flow →

↻ Replay

01020304

4 / 4

Only an allowed call reaches the approved upstream. The gateway records audit metadata.

Read the full explanation

1. Administrators approve servers, policy, and credential bindings in the control plane.
2. A data plane validates and activates an approved runtime projection.
3. The client sends its identity and tool request to the data plane. Policy is enforced here.
4. Only an allowed call reaches the approved upstream. The gateway records audit metadata.

1. Connect your MCP client

Add the governed endpoint to your client’s remote MCP configuration. Complete the authentication flow supported by your deployment. Let the client perform the protocol exchange appropriate to the registered server’s compatibility profile.

Use the gateway endpoint, not the upstream server URL. Direct upstream access does not exercise Amelfi policy or audit.

2. Discover tools

Refresh the client’s tool list. Confirm that the intended read tool appears. Then check that a tool outside the caller’s permissions is absent. An empty list can be a correct policy result; do not widen access until you inspect the identity and policy decision.

3. Make a harmless call

Invoke the read tool using inputs accepted by its schema. Confirm the result matches the test fixture or record you selected. Record the time, target, and any correlation identifier provided by the client.

If you use the CLI, inspect its supported input and connection flags before invoking the tool:

gatewayctl call-tool --help

4. Verify enforcement

In a test client that permits an explicit tool-name request, attempt a tool the identity is not authorized to call. Expect a denial without upstream execution. A hidden discovery entry alone does not prove execution is blocked.

5. Inspect the audit evidence

Search the audit trail for the test window. Check actor or agent, tool, decision, policy version, and credential mode. Keep only metadata in the test record.

You are finished when the allowed call succeeds, unauthorized discovery stays hidden, a denied call cannot reach the upstream, and the corresponding decisions are traceable.

Implementation reference

Read the source contract.