One governed door for every MCP tool call.
ST Gate is our own MCP gateway, built in-house — a critical component of Sentinel Telemetry. Every Model Context Protocol client your people run routes through one governed entry point, so an ungoverned tool never reaches your code or your systems unseen.
- Approved-server registry
- Full tool-call audit
- Credential brokering
- Fail-open
What ST Gate does.
ST Gate proxies every MCP client through one place you control — and turns an ungoverned sprawl into a single, audited, policy-enforced door.
- Claude Code
- Cursor
- Windsurf
- VS Code
- Claude desktop
- ChatGPT desktop
Why MCP needs a gate.
The Model Context Protocol lets AI agents and apps call external tools and servers — read files, hit APIs, run actions. That power is exactly why it needs governance. Left ungoverned, every engineer wires up their own MCP servers: unknown tools, reaching into your systems, with no registry and no audit trail.
Shadow tools
Anyone can point an agent at any MCP server. Security has no inventory of what's reachable, and no way to say no.
No audit trail
Tool calls execute directly from the client. When something goes wrong, there's no record of what was called or with what arguments.
Credentials in configs
Tokens end up pasted into local client configs — copied, synced, and leaked far beyond where they should live.
Built in, not bolted on.
Approved-server registry
You decide which MCP servers your people can reach. Anything not on the list is blocked at the gate — no shadow tools, no exceptions you didn't sign off on.
Full tool-call audit
Every tool call — which server, which tool, which arguments, from whom — is recorded and stitched to one employee identity, ready for your SIEM.
Credential brokering
Secrets stay in ST Gate, not in local client configs. The gateway injects credentials at call time, so tokens never sprawl across machines.
Every client, one door
CLIs, desktop apps, Cursor, Windsurf, and VS Code all route through the same governed entry point — one policy, everywhere.
Fail-open by design
If ST Gate is down, slow, or wrong, it never hangs an engineer's agent. Governance in the path, never in the way — the same hard release gate as the rest of the platform.
On your infrastructure
ST Gate runs where ST Hub runs — on-prem or your own cloud, air-gap capable. No tool call is proxied through anyone else's servers.
ST Gate is our own gateway, developed in-house and source-available to licensed customers — your security team can read exactly how every tool call is governed before it runs.