MCP Gateway Integration

Use MCP Gateway to connect hosted MCP servers to a Dawn workspace, link selected capabilities, and make custom tools available to the agents that should use them.

What MCP Gateway is for

MCP Gateway lets Dawn call remote MCP servers from inside normal agent conversations.

Use it when your team has a hosted MCP server for an internal system, specialist API, custom workflow, or public provider that Dawn does not support as a first-party integration yet. Dawn’s native integrations remain the recommended path when a provider already has a dedicated Dawn integration.

This is different from MCP and API Credentials. That page is about external clients calling Dawn. MCP Gateway is about Dawn calling a hosted MCP server.

Before you start

  • A Dawn workspace where you are an owner or manager.
  • A hosted HTTPS MCP endpoint, for example https://mcp.example.com/mcp.
  • The authentication details required by that server.
  • A clear idea of which capabilities should be available to which agents.

Dawn does not run local stdio MCP servers. The server must be hosted and reachable by Dawn over HTTPS.

Supported authentication modes

Choose the mode that matches the MCP server:

  • No auth: for test or explicitly public MCP endpoints.
  • Bearer token: Dawn sends Authorization: Bearer ... to the MCP server.
  • Static headers: Dawn sends the headers you provide as JSON, for example {"X-Api-Key":"..."}.
  • MCP OAuth: use Connect MCP OAuth when the server advertises MCP OAuth metadata and should issue refreshable access tokens.

Store credentials in the connection. Do not paste MCP server secrets into agent prompts or memory pages.

Connect MCP Gateway in Dawn

  1. Open Integrations in Dawn.
  2. Click Add connection.
  3. Choose MCP Gateway.
  4. Enter the hosted MCP endpoint URL.
  5. Choose the authentication mode.
  6. Enter the bearer token or static headers if that mode requires them.
  7. Use Connect MCP OAuth instead if the server supports MCP OAuth and you want an OAuth connection.
  8. Validate the connection.

Validation checks that Dawn can reach the endpoint and negotiate with the MCP server. If validation fails, fix the endpoint or authentication before linking capabilities.

After validation, Dawn discovers linkable MCP capabilities exposed by the server.

Capabilities can include MCP tools, resources, and prompts, depending on what the server advertises and what Dawn can classify safely. Link only the capabilities agents should actually use.

Start narrow:

  1. Link one or two read-focused capabilities first.
  2. Assign them to one test agent.
  3. Ask a known-answer question that should require the MCP capability.
  4. Confirm the answer uses the expected system.
  5. Add broader or write-capable capabilities only after the read path is working.

Assign capabilities to agents

Connecting an MCP server does not automatically give every agent access to every capability.

Assign linked MCP capabilities to the agent profiles that need them. A support agent might get customer lookup. A release agent might get deployment status. A planning agent might get read-only product metrics.

Keep assignments specific. It is easier to debug and govern an agent that has a small, intentional tool set.

Write tools and safety

Dawn classifies MCP capabilities as read, write, unknown, or blocked based on MCP metadata, names, descriptions, and annotations.

  • Read-focused capabilities are the safest starting point.
  • Write-capable tools are still gated by the agent’s write-tool policy.
  • Destructive or unclear capabilities may be blocked or withheld from runtime use.

If you operate the MCP server, expose clear tool names, descriptions, and MCP annotations such as readOnlyHint or destructiveHint. That helps Dawn classify the capability correctly.

What not to use MCP Gateway for

  • Do not use it for Dawn’s native providers when a first-party integration already fits the job.
  • Do not use it for local stdio servers on a user’s machine.
  • Do not use it to share personal secrets through prompt text.
  • Do not connect broad write-capable servers to general-purpose agents without testing and policy review.

Troubleshooting

  • Connection fails: check the endpoint is HTTPS, reachable from Dawn, and not a local or private-only address unless your deployment explicitly allows that network path.
  • Authentication fails: confirm the selected auth mode matches the server and that bearer tokens or static headers were pasted without extra whitespace.
  • OAuth does not start: the MCP server may not advertise the protected resource and authorization metadata Dawn expects for MCP OAuth.
  • No capabilities appear: validate the endpoint again and confirm the server exposes MCP tools, resources, or prompts.
  • A capability is missing: the capability may be classified as unknown or blocked. Add clearer MCP metadata or annotations on the server.
  • The agent does not use the tool: confirm the capability is linked, assigned to the active agent profile, and allowed by the agent’s write-tool policy if it can perform writes.