Docker MCP Enterprise Gateway
One secure gateway for all your tools
Agents need access. Enterprises need control.
Say what agents can do. Prove what they did.
サーバ
Approve what the organization can reach. Unvetted servers are denied by default.
ツール
Expose only the tools a group needs, not the whole catalog a server ships.
ポリシー
Allow and deny by server, tool, transport, and call, evaluated before anything runs.
Revocation
Cut off a server or a tool and every session picks it up on the next call.
監査
A structured event per evaluation, tied to user and agent, streamed to your SIEM.
One enforcement point, whatever the server is.
Add a server once.
Publish it to those that need it.
Dynamic MCP keeps large catalogs affordable
A big catalog can consume an agent’s context before it does any useful work. With Dynamic MCP, the agent discovers and invokes tools as it needs them, so catalog growth stops taxing every request.
Approve once, publish by group
The groups you scope it to pick it up on their next session.
Connect the client once
One endpoint per client. Catalog and policy changes land without anyone reconfiguring anything.
Containerized servers run isolated
Each one in its own container, separated from the machine it was launched from.
Credentials stay in your store
Supplied when a tool runs, never distributed through client config files.
We already run the servers you are trying to govern.
We package and distribute MCP servers
We publish and version the servers your developers want, in registries you already trust.
We control how they execute
Isolated execution on the runtime you already run in production.
One control point across every source
Remote, internal, and Docker-packaged servers enforce the same identity, policy, and audit rules.
The same model covers the agent itself
Tools called from Docker Sandboxes and third-party clients follow one policy model, not two.
Plugs into the systems you already trust.
SSO and identity
Sign in through your provider. Policy follows the groups you already manage.
Audit and SIEM
Structured events per tool call, in the pipeline your security team already watches.
シークレット
Credentials are read at call time from the store that already holds them.
ポリシー
Write rules in the gateway, or delegate to the policy engine you already run.
Catalogs and registries
Publish private catalogs from registries you already operate, internal servers included.
Deploy it where your compliance team already said yes.
Managed in your cloud
Docker-operated, inside your own account or VPC. Data and traffic stay in your environment.
Air-gapped appliance
Private Kubernetes with no outbound connection. Catalogs, server images, and policy load from inside your network.
Docker-managed cloud
Multi-tenant, operated by Docker. Governed MCP without running the infrastructure.
Control agent execution. Control agent tool use. Audit both.
Docker Sandboxes
Governs agent execution: the network the agent can reach, the files it can touch, and which MCP servers load in each sandbox.
See Docker Sandboxes
MCP Enterprise Gateway
Governs agent tool use: which servers and tools any client can call, with identity, policy, and credentials applied to every call.
Docker AI Governance
Control and visibility across both: what an agent may execute in a sandbox, and what tools it may call through the gateway. One place to set policy, one record of what happened.
See AI Governance
Already governing MCP in production.
Thousands of developers
Multiple agent harnesses
Global semiconductor manufacturer
Replaced separate MCP configurations across several coding agents with one approved catalog for thousands of developers. Its platform team scopes access by identity group and revokes it organization-wide without redistributing anything.
Thousands of developers
Multiple agent harnesses
Consumer social platform
With hundreds of millions of monthly users, it retired a homegrown MCP proxy for a governed gateway: identity-bound policy, a record of every tool call, and internal servers reaching agents without handing credentials to developers.
よくある質問
What does the gateway actually do on each call?
It authenticates the user through your identity provider, resolves which servers and tools that user’s groups can reach, evaluates policy for the specific call, injects the credentials the call needs, routes it to the server, and records the decision.
Which clients can connect?
Clients that speak MCP, including Claude Code, Cursor, VS Code, Codex, ChatGPT Enterprise, and agents your teams build in house.
What kinds of servers can I connect?
Remote services over HTTP or SSE, containerized servers, and the internal servers your own teams build. Containerized servers run isolated in their own containers.
Where do credentials live?
In your approved secret store. The gateway supplies them when a tool runs, so long-lived credentials are not distributed through client configuration files.
Can it run fully air-gapped?
Yes. Catalogs, server images, and policy load from inside your network with no outbound connection.
How does this relate to Docker Sandboxes?
Sandboxes governs the environment an agent runs in. The gateway governs which servers and tools it can call. Either works alone, and many customers run both.
What is Dynamic MCP?
A way of exposing tools so the agent discovers and invokes what it needs instead of loading every definition up front, which keeps context usage flat as the catalog grows.