> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/dsx-exchange/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/dsx-exchange/_mcp/server.

# DSX Agent Gateway Overview

DSX Agent Gateway provides an authenticated, tenant-aware `/mcp` endpoint for discovering and invoking approved Model Context Protocol (MCP) servers. For component and request-flow details, refer to the [architecture](/dsx-exchange/agent-gateway/architecture).

## When to Use Agent Gateway

Use Agent Gateway to:

* Provide a single, authenticated MCP endpoint for multiple MCP servers
* Derive tenant identity from verified JSON Web Token (JWT) claims
* Limit each tenant to an approved set of MCP targets
* Apply per-tenant request limits before traffic reaches MCP servers
* Discover MCP servers from Kubernetes Services, or configure static HTTP endpoints
* Route selected MCP requests to remote gateway shards
* Monitor the gateway, rate-limit service, bridge, and bundled dependencies

Agent Gateway does not replace authorization inside an MCP server. The gateway forwards the caller's bearer token to the selected server so that the server can enforce its own policy.

## Who Uses Agent Gateway

Operators *deploy* Agent Gateway, and operators and tenants *use* the gateway to discover and invoke approved MCP servers. Tenants can access a subset of MCP servers based on their tenant policy, and operators can access all MCP servers.

This documentation supports the following audiences:

| Audience             | Primary Tasks                                                                                                |
| -------------------- | ------------------------------------------------------------------------------------------------------------ |
| MCP client developer | Connect a client, initialize MCP, discover capabilities, and invoke an approved tool or prompt.              |
| MCP server developer | Publish a server through Kubernetes discovery or a static upstream definition.                               |
| Platform operator    | Deploy the chart, configure identity and tenant policy, connect an optional bridge, and operate the service. |

## How Requests Reach MCP Servers

Agent Gateway can route requests to MCP servers in two ways: directly, and through an optional bridge.

When **routing directly** (without the bridge), the gateway verifies the caller's JWT and derives a tenant ID from verified claims. It applies tenant authorization and rate limiting before it routes the request to an allowed MCP target.

The gateway supports two target types:

* A selector target discovers Kubernetes Service ports marked with `appProtocol: agentgateway.dev/mcp`.
* A static target connects to a configured HTTP or HTTPS MCP endpoint.

The **optional bridge** adds cross-shard routing. A shard is a deployment domain with its own Agent Gateway and MCP servers, typically a Kubernetes cluster or logical site. An entry gateway routes to a bridge hub, and bridge leaves forward requests through the gateway in each selected shard. The bridge uses NATS request-reply traffic provided by the DSX Event Bus.

The [architecture guide](/dsx-exchange/agent-gateway/architecture) explains both request paths and their session behavior.

## Relationship to DSX Exchange

DSX Exchange includes the DSX Event Bus, AsyncAPI schemas, and Agent Gateway. You can deploy Agent Gateway without the DSX Event Bus when the gateway can reach every MCP target.

The DSX Event Bus becomes a runtime dependency when you enable the Agent Gateway bridge. The bridge uses NATS to discover reachable gateway shards and route MCP request-reply traffic between its hub and leaves. The AsyncAPI schemas describe DSX Event Bus message contracts, not MCP methods.

## Next Steps

Use the following guides to learn more about Agent Gateway:

| Guide                                                                          | Use It to                                                                                          |
| ------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------- |
| [Client Quickstart](/dsx-exchange/agent-gateway/client-quickstart)             | Authenticate an MCP client, initialize a connection, and make a request.                           |
| [Architecture](/dsx-exchange/agent-gateway/architecture)                       | Understand components, request processing, direct and bridged routing, and state boundaries.       |
| [Publish an MCP Server](/dsx-exchange/agent-gateway/publish-mcp-server)        | Register a Kubernetes Service or configure a static MCP target.                                    |
| [Deployment](/dsx-exchange/agent-gateway/deployment)                           | Install the chart and configure identity, tenant access, rate limiting, and optional bridge roles. |
| [Operations](/dsx-exchange/agent-gateway/operations)                           | Monitor components, diagnose failures, and manage upgrades or outages.                             |
| [Configuration Reference](/dsx-exchange/agent-gateway/configuration-reference) | Find chart settings, defaults, limits, and security responsibilities.                              |
| [Supported Capabilities](/dsx-exchange/agent-gateway/supported-capabilities)   | Review supported MCP methods and direct or bridge profile limitations.                             |