The Gateway's MCP server

Last updated October 15, 2026

Ask an AI agent about your Gateway where you already work: "why did my last few requests fail?", "which key spends the most this week?", "is a provider cooling down?". The Gateway's own MCP server gives Claude Code, Codex, claude.ai, ChatGPT and other MCP clients tools that read your usage and cost, request logs, one request's routing and content, keys, plan and provider health, and, if you allow it, a few that change keys. It comes with the Gateway Pro, Scale and Enterprise plans.

The URL is the same for everyone:

https://api.temprhq.io/mcp/admin

It isn't the MCP connectors, which pass calls on to your MCP servers. This server is Tempr's own. It reads, and changes keys only in the narrow ways described under Changing keys, when you turn that on.

Signing in or using a management key

The server takes either of two credentials:

Credential	For	What it can read
Signing in through the app	claude.ai, ChatGPT, Claude Desktop, and coding tools that sign in to MCP servers, such as Claude Code, Codex, Cursor and Zed. The app opens Tempr's sign-in and consent page, as it does for connectors.	Your own Gateway, or, if you're an owner or admin of an organization when you connect the app, the organization's; other members read their own. The consent page says which, and that doesn't change later: if you stop being an owner or admin, the app stops working until you connect it again. Every tool is available.
A management key (`Authorization: Bearer tmk_...`)	Coding tools, workflows such as n8n's, scripts and CI, where a fixed credential is simpler than a browser sign-in.	The key's account, personal or organization. Its scopes decide which tools appear (see the table below): give it `logs:read` for request logs, and `keys:write` for the tools that change keys.

Either way, the account must be on a paid-up Pro, Scale or Enterprise plan. Through an app signed in on Free, each tool answers that the plan doesn't include it; a management key whose account isn't on one is refused with 403 plan_required, as on the management API.

Adding it to each app

App	How
Claude Code	`claude mcp add --transport http tempr-gateway https://api.temprhq.io/mcp/admin`, then run `/mcp` to sign in. With a management key instead, add `--header "Authorization: Bearer tmk_..."`. See the Claude Code guide.
Codex	In `~/.codex/config.toml`, add the server below and put the management key in `TEMPR_MANAGEMENT_KEY`. To sign in instead, leave out `bearer_token_env_var` and run `codex mcp login tempr-gateway`. See the Codex guide.
claude.ai and Claude Desktop	Add a custom connector in the Connectors settings, paste the URL, and sign in to Tempr. Claude Desktop set up with Tempr as its inference provider takes the server in its third-party inference settings instead: see the Claude Desktop guide.
ChatGPT	Under Plugins, choose Add, then Add custom MCP server: paste the URL as the Server URL and keep OAuth as the authentication.
Other coding tools and n8n	Each guide has a section on it: Cursor, Cline, Kilo Code, Continue, Zed, Crush, OpenCode, GitHub Copilot and n8n.
Anything else	Any MCP client that supports remote servers over Streamable HTTP, with OAuth or a bearer header.

[mcp_servers.tempr-gateway]
url = "https://api.temprhq.io/mcp/admin"
bearer_token_env_var = "TEMPR_MANAGEMENT_KEY"

The Portal's MCP connectors page shows the URL and which Gateway you'll read.

Tools

Each tool runs the management API call beside it, so it answers with the same fields and the same checks.

Tool	What it returns	Scope	Same as
`get_usage_summary`	Requests, failures, error rate, tokens, cost and latency for a range, over time and by model, provider and key (the 25 costliest of each), with guardrail and prompt-cache totals.	`usage:read`	Metrics
`list_requests`	Request log rows for a range and filters (key, model, status, session, end user, plan, metadata), newest first, a page at a time.	`logs:read`	Request logs
`get_request`	One request: fallback and key-rotation attempts, guardrail outcome, cache, the plan that paid, metadata; and with `include_content`, the captured prompt and answer.	`logs:read`	One request
`list_keys`	Virtual keys with their limits, team, status, expiry and last use. Never a secret.	`keys:read`	List keys
`get_plan_status`	Plan, requests used this period and included, rate limit, overage so far, retention, content capture and redaction.	`usage:read`	Plan
`get_provider_health`	Providers, models and provider keys cooling down and until when, and each provider's error rate over 24 hours.	`usage:read`	Provider health
`test_guardrails`	Your guardrail patterns' verdict on a piece of text, and the text as they'd redact it. No LLM check; nothing stored.	`keys:read`	Test guardrail settings
`create_key`	A key that expires within 90 days, with optional models, budget and rate limits. Its secret comes as a one-time Portal link, never in the answer.	`keys:write`	Create a key
`tighten_key`	Lowers a key's budget or rate limits, narrows its models, or brings its expiry forward. Refuses anything that loosens.	`keys:write`	Change a key
`revoke_key`	Revokes one key at once.	`keys:write`	Revoke a key

The reading tools are marked read-only, so apps that ask before a tool changes something don't need to ask. The three that change keys appear only when you've allowed them, aren't marked read-only, and revoke_key is marked destructive, so apps ask you first.

Changing keys

An agent can create a key for a CI job, tighten one, or revoke one that leaked, only when all of these hold:

It uses a management key with the keys:write scope ("Create, change and revoke keys" in the Portal). An app signed in through OAuth only reads.
The account has turned on Key changes by AI agents on the Portal's MCP connectors page: you, for your own Gateway, or an owner or admin, for an organization's. It's off until then.

And only in these ways:

A new key expires within 90 days, and its secret never reaches the agent. The answer holds a link to the Portal, where you, or an owner or admin for an organization's key, show the secret with a button press and copy it, once, within 10 minutes. After that the link is spent, and the secret is gone from Tempr.
Tightening only tightens: a lower budget or rate limit, some of the models the key already allows, an earlier expiry. A change that would loosen a key is refused; make it in the Portal.
Revoking is one key at a time.
At most 20 changes an hour from each management key. Each one is in an organization's audit log as that management key, "via the Gateway's MCP server", and so is the secret being shown.

Guardrail, data-loss prevention and capture settings, budget rules, retention, provider keys, management keys, members and billing never change through MCP.

Captured prompts and answers

get_request returns what was sent and answered only when the agent asks for it with include_content, and only when Tempr captured it (content capture on, in the Gateway's settings). Secrets and personal data are masked first, the same masks as redaction plus your own data-loss prevention rules, and each body is cut to its first 8 KB. For an organization, every read of a request's content is in the audit log (Organization → Compliance), with who read it and through which app.

Text from outside

Request logs hold text your apps' users, models and providers wrote: model names (a caller can make one up), error messages and finish reasons, session and end-user ids, metadata, the MCP methods and tools a client named, the LLM check's verdict, prompts and answers. An agent reading them could be steered by instructions hidden in that text. So the usage, request list and request tools put every such value in an object named untrusted, wherever it appears, say so at the top of every answer, and tells the agent, in its instructions and each tool's description, to treat it as data. And since it changes nothing unless you allow it, then only creates short-lived keys, tightens or revokes, never returns a key's secret, and reaches no more than you can see in the Portal, there's little an injected instruction could make it do.

Limits and records

Each management key, or each person and the Gateway they read, can make 120 tool calls a minute, each call in a batch counting on its own; more answers 429. Calls don't count against your plan's requests and aren't in your request logs, so reading usage doesn't change it.
At most 20 key changes an hour from each management key.
Reads of captured content are in an organization's audit log, as above. A management key's last use is on its row in the Portal.
Like the connectors, the server is stateless: send one JSON-RPC message, or a few in a batch, per POST. It doesn't open a stream for the server to send on (GET answers 405).

For organization owners and admins

On the Portal's MCP connectors page:

Owners and admins may use the Gateway's MCP server is on by default. Turned off, neither apps nor management keys can use it, and connected apps stop at their next call. The management API itself still works.
Allowed apps, the connectors' list, applies here too.
Key changes by AI agents, off by default, lets agents with a management key that has keys:write change keys.
Every connected app is listed with what it reaches (MCP servers, the Gateway, or both), and any of them can be disconnected at once.

A member who isn't an owner or admin can still connect an app to read their own Gateway, if they have one; the organization's settings don't reach it.

Errors

Credential problems are HTTP errors in the Gateway's usual shape. Without a credential, or with an expired token, the answer is 401 with WWW-Authenticate: Bearer resource_metadata="https://api.temprhq.io/.well-known/oauth-protected-resource/mcp/admin", scope="mcp", which tells an MCP client where to sign in. A management key's errors are the management API's.

Status	Code	Meaning
`401`	`sign_in_required`	No credential. Sign in through the app, or send a management key.
`401`	`invalid_token`	The token is invalid, expired or revoked, was issued for another URL (a connector's token doesn't reach this server), the person left the organization it was signed in for, or the token reads the organization's Gateway and the person is no longer an owner or admin.
`403`	`insufficient_scope`	The token doesn't carry the `mcp` scope.
`403`	`gateway_mcp_disabled`	The organization has turned the Gateway's MCP server off.
`403`	`connector_app_not_allowed`	The organization's allowed apps don't include this one.
`429`	`rate_limit_exceeded`	More than 120 tool calls in a minute. `Retry-After` says when to try again.

A tool that can't answer, because the plan doesn't include the server, the key lacks the scope, or an argument is wrong, returns a tool result marked as an error with the reason, so the agent can tell you.

For developers

Sign-in follows the MCP authorization spec, as for the connectors: the resource is https://api.temprhq.io/mcp/admin, the scope mcp. A token reaches the resources the app asked for when it signed in: one for the connectors, even the all-servers URL, doesn't reach this server, and one for this server doesn't reach the connectors, unless the app asked for both. A token can't be widened to this server at the token endpoint, and Enterprise Managed Auth signs apps in to the connectors only.
Protocol versions 2025-03-26 to 2026-07-28 are accepted at initialize. The server offers tools only; resources/list and prompts/list are empty.
Tool results are JSON text: the management API's answer, with outside text moved under untrusted.

Previous← Management API NextClaude Code →