Sealgate

Sealgate MCP Server

The Model Context Protocol (MCP) server for Sealgate, the AI data-leak-prevention platform: a security gateway and data firewall that sits between AI agents (Claude, ChatGPT, Cursor, Copilot) and your organisation's data and tools.

This server is a thin MCP proxy. It forwards a small set of tool calls to a Sealgate gateway, which you configure with two environment variables. Sealgate runs managed release hosts (the remote MCP gateway at mcp.sealgate.ai and the Management API at dashboard.sealgate.ai), and demo or self-hosted orgs run their own, so this bridge stays host-agnostic: you supply the URL and key.

Tools

Connect to the hosted gateway

Sealgate runs a managed remote MCP gateway at https://mcp.sealgate.ai/mcp. It is a per-user proxy that aggregates every MCP server you have enabled behind one Streamable HTTP endpoint and enforces Sealgate's access-control policies on every call. There is nothing to install: point your client at the endpoint and sign in through the browser.

Endpoint:   https://mcp.sealgate.ai/mcp

Transport: streamable HTTP (remote, not stdio) Auth: OAuth 2.1 in the browser, no key to paste

| Claude Code | claude mcp add --transport http --scope user sealgate https://mcp.sealgate.ai/mcp Then run /mcp in a session to sign in. | | Cursor | Not working? Add the endpoint by hand under Settings → MCP. | | VS Code | [Add to VS Code](https://vscode.dev/redirect/mcp/install?name=sealgate&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fmcp.sealgate.ai%2Fmcp%22%7D) requires Copilot agent mode. | | Goose | Adds it as an extension over streamable HTTP. | | Grokbot | Add a remote MCP server pointing at https://mcp.sealgate.ai/mcp over streamable HTTP, then sign in through the browser. | | Any MCP client | Add a remote server at https://mcp.sealgate.ai/mcp over streamable HTTP. Cline, Zed and Windsurf all work; each spells the config differently (VS Code servers, Cursor and Cline mcpServers, Zed context_servers, and Windsurf wants serverUrl where everyone else wants url). |

Every one-click button routes through an https:// install URL, since GitHub strips custom URL schemes such as cursor:// from links.

How OAuth works

The gateway is an OAuth 2.1 authorization server, so most clients connect with no API key at all. The flow uses dynamic client registration (RFC 7591) and client ID metadata documents, mandatory PKCE (S256), and issues refresh tokens via the offline_access scope, so a session stays connected without re-authenticating every hour. Discovery, consent, and token endpoints all live on the gateway origin, so self-hosted single-origin deployments work with no extra configuration.

API key in the URL

Clients that cannot run an OAuth flow can pass a Sealgate API key as a URL path segment instead:

https://mcp.sealgate.ai/mcp/{api_key}/?client={label}

Replace {api_key} with the key from your dashboard and {label} with an optional session label. This is not OAuth and not an Authorization header; the key travels in the path.

mcp.sealgate.ai is the managed release host. Demo and self-hosted orgs run their own gateway host, so substitute your own URL where needed.

Connect your messaging apps

The same gateway fronts Sealgate's messaging connectors (the Beeper desktop app plus the sealgate-stdiod tunnel), so any client above can read and send across your chat networks. Every message an agent reads or sends passes through the same policy checks and lands in the same audit log as every other tool call.

Codex + iMessage in one command: the companion repo Edison-Watch/codex-imessage wires Codex to iMessage through the gateway with a single install step.

Configuration

Set two environment variables, both issued or hosted by your organisation:

If either is unset, every tool returns a clear configuration message instead of failing, so registry probes and --help never crash.

Install

Prefer the hosted gateway above. The npm package is the stdio alternative for clients that cannot use a remote server; it runs via npx and needs the two environment variables from Configuration. Also published in the official MCP Registry as ai.sealgate/gateway and io.github.Edison-Watch/sealgate-mcp.

{

"mcpServers": { "sealgate": { "command": "npx", "args": ["-y", "@sealgate/mcp"], "env": { "SEALGATE_GATEWAY_URL": "https://dashboard.sealgate.ai", "SEALGATE_API_KEY": "your-sealgate-api-key" } } } }

VS Code spells the same block as servers with "type": "stdio". Ready-made files for each client live in examples/.

Usage

# Run over stdio (default transport)

npx -y @sealgate/mcp

Show usage

npx -y @sealgate/mcp --help

Set SEALGATE_MCP_TRANSPORT=http (with an optional PORT, default 3000) to serve streamable HTTP instead of stdio.

Develop

Requires Bun.

bun install

bun run src/index.ts --help # run from source bun test # run tests bun run build # bundle to dist/ make ci # lint, typecheck, dead-code, and the rest

Links

• Website: https://sealgate.ai
• Docs: https://docs.sealgate.ai
• Developer docs, API reference, and integration guides: SealGate developer docs
• Connect guides: https://sealgate.ai/connect
• Contact: hello@sealgate.ai

License

MIT. Copyright GPU-EVM LTD (Sealgate). See LICENSE.