DSX Agent Gateway Overview

DSX Agent Gateway provides an authenticated, tenant-aware /mcp endpoint for discovering and invoking approved Model Context Protocol (MCP) servers. For component and request-flow details, refer to the architecture.

When to Use Agent Gateway

Use Agent Gateway to:

Provide a single, authenticated MCP endpoint for multiple MCP servers
Derive tenant identity from verified JSON Web Token (JWT) claims
Limit each tenant to an approved set of MCP targets
Apply per-tenant request limits before traffic reaches MCP servers
Discover MCP servers from Kubernetes Services, or configure static HTTP endpoints
Route selected MCP requests to remote gateway shards
Monitor the gateway, rate-limit service, bridge, and bundled dependencies

Agent Gateway does not replace authorization inside an MCP server. The gateway forwards the caller’s bearer token to the selected server so that the server can enforce its own policy.

Who Uses Agent Gateway

Operators deploy Agent Gateway, and operators and tenants use the gateway to discover and invoke approved MCP servers. Tenants can access a subset of MCP servers based on their tenant policy, and operators can access all MCP servers.

This documentation supports the following audiences:

Audience	Primary Tasks
MCP client developer	Connect a client, initialize MCP, discover capabilities, and invoke an approved tool or prompt.
MCP server developer	Publish a server through Kubernetes discovery or a static upstream definition.
Platform operator	Deploy the chart, configure identity and tenant policy, connect an optional bridge, and operate the service.

How Requests Reach MCP Servers

Agent Gateway can route requests to MCP servers in two ways: directly, and through an optional bridge.

When routing directly (without the bridge), the gateway verifies the caller’s JWT and derives a tenant ID from verified claims. It applies tenant authorization and rate limiting before it routes the request to an allowed MCP target.

The gateway supports two target types:

A selector target discovers Kubernetes Service ports marked with appProtocol: agentgateway.dev/mcp.
A static target connects to a configured HTTP or HTTPS MCP endpoint.

The optional bridge adds cross-shard routing. A shard is a deployment domain with its own Agent Gateway and MCP servers, typically a Kubernetes cluster or logical site. An entry gateway routes to a bridge hub, and bridge leaves forward requests through the gateway in each selected shard. The bridge uses NATS request-reply traffic provided by the DSX Event Bus.

The architecture guide explains both request paths and their session behavior.

Relationship to DSX Exchange

DSX Exchange includes the DSX Event Bus, AsyncAPI schemas, and Agent Gateway. You can deploy Agent Gateway without the DSX Event Bus when the gateway can reach every MCP target.

The DSX Event Bus becomes a runtime dependency when you enable the Agent Gateway bridge. The bridge uses NATS to discover reachable gateway shards and route MCP request-reply traffic between its hub and leaves. The AsyncAPI schemas describe DSX Event Bus message contracts, not MCP methods.

Next Steps

Use the following guides to learn more about Agent Gateway:

Guide	Use It to
Client Quickstart	Authenticate an MCP client, initialize a connection, and make a request.
Architecture	Understand components, request processing, direct and bridged routing, and state boundaries.
Publish an MCP Server	Register a Kubernetes Service or configure a static MCP target.
Deployment	Install the chart and configure identity, tenant access, rate limiting, and optional bridge roles.
Operations	Monitor components, diagnose failures, and manage upgrades or outages.
Configuration Reference	Find chart settings, defaults, limits, and security responsibilities.
Supported Capabilities	Review supported MCP methods and direct or bridge profile limitations.