Sealgate MCP Server

smithery badge MCP Registry

The Model Context Protocol (MCP) server for Sealgate, the AI data-leak-prevention platform: a security gateway and data firewall that sits between AI agents (Claude, ChatGPT, Cursor, Copilot) and your organisation's data and tools.

This server is a thin MCP proxy. It forwards a small set of tool calls to a Sealgate gateway, which you configure with two environment variables. Sealgate runs managed release hosts (the remote MCP gateway at mcp.sealgate.ai and the Management API at dashboard.sealgate.ai), and demo or self-hosted orgs run their own, so this bridge stays host-agnostic: you supply the URL and key.

Tools

Connect to the hosted gateway

Sealgate runs a managed remote MCP gateway at https://mcp.sealgate.ai/mcp. It is a per-user proxy that aggregates every MCP server you have enabled behind one Streamable HTTP endpoint and enforces Sealgate's access-control policies on every call. There is nothing to install: point your client at the endpoint and sign in through the browser.

Endpoint:   https://mcp.sealgate.ai/mcp
Transport:  streamable HTTP (remote, not stdio)
Auth:       OAuth 2.1 in the browser, no key to paste

Client	Add it
Claude	Add to Claude opens the Add custom connector dialog with the name and URL filled in. Claude flags it as suggested by an external link; that is expected. On Team and Enterprise plans an admin adds it.
ChatGPT	Settings → Connectors → Advanced settings → turn on Developer mode. Back on Connectors, click Create, paste the endpoint, and name it. Start a new chat so the tools menu refreshes.
Claude Code	claude mcp add --transport http --scope user sealgate https://mcp.sealgate.ai/mcp Then run /mcp in a session to sign in.
Cursor	Not working? Add the endpoint by hand under Settings → MCP.
VS Code	Add to VS Code requires Copilot agent mode.
Goose	Install in Goose Adds it as an extension over streamable HTTP.
Grokbot	Add a remote MCP server pointing at https://mcp.sealgate.ai/mcp over streamable HTTP, then sign in through the browser.
Any MCP client	Add a remote server at https://mcp.sealgate.ai/mcp over streamable HTTP. Cline, Zed and Windsurf all work; each spells the config differently (VS Code servers, Cursor and Cline mcpServers, Zed context_servers, and Windsurf wants serverUrl where everyone else wants url).

Every one-click button routes through an https:// install URL, since GitHub strips custom URL schemes such as cursor:// from links.

How OAuth works

The gateway is an OAuth 2.1 authorization server, so most clients connect with no API key at all. The flow uses dynamic client registration (RFC 7591) and client ID metadata documents, mandatory PKCE (S256), and issues refresh tokens via the offline_access scope, so a session stays connected without re-authenticating every hour. Discovery, consent, and token endpoints all live on the gateway origin, so self-hosted single-origin deployments work with no extra configuration.

API key in the URL

Clients that cannot run an OAuth flow can pass a Sealgate API key as a URL path segment instead:

https://mcp.sealgate.ai/mcp/{api_key}/?client={label}

Replace {api_key} with the key from your dashboard and {label} with an optional session label. This is not OAuth and not an Authorization header; the key travels in the path.

mcp.sealgate.ai is the managed release host. Demo and self-hosted orgs run their own gateway host, so substitute your own URL where needed.

Connect your messaging apps

The same gateway fronts Sealgate's messaging connectors (the Beeper desktop app plus the sealgate-stdiod tunnel), so any client above can read and send across your chat networks. Every message an agent reads or sends passes through the same policy checks and lands in the same audit log as every other tool call.

Codex + iMessage in one command: the companion repo Edison-Watch/codex-imessage wires Codex to iMessage through the gateway with a single install step.

Configuration

Set two environment variables, both issued or hosted by your organisation:

If either is unset, every tool returns a clear configuration message instead of failing, so registry probes and --help never crash.

Install

Prefer the hosted gateway above. The npm package is the stdio alternative for clients that cannot use a remote server; it runs via npx and needs the two environment variables from Configuration. Also published in the official MCP Registry as ai.sealgate/gateway and io.github.Edison-Watch/sealgate-mcp.

{
    "mcpServers": {
        "sealgate": {
            "command": "npx",
            "args": ["-y", "@sealgate/mcp"],
            "env": {
                "SEALGATE_GATEWAY_URL": "https://dashboard.sealgate.ai",
                "SEALGATE_API_KEY": "your-sealgate-api-key"
            }
        }
    }
}

VS Code spells the same block as servers with "type": "stdio". Ready-made files for each client live in examples/.

Usage

# Run over stdio (default transport)
npx -y @sealgate/mcp

# Show usage
npx -y @sealgate/mcp --help

Set SEALGATE_MCP_TRANSPORT=http (with an optional PORT, default 3000) to serve streamable HTTP instead of stdio.

Develop

Requires Bun.

bun install
bun run src/index.ts --help   # run from source
bun test                      # run tests
bun run build                 # bundle to dist/
make ci                       # lint, typecheck, dead-code, and the rest

Links

• Website: https://sealgate.ai
• Docs: https://docs.sealgate.ai
• Developer docs, API reference, and integration guides: SealGate developer docs
• Connect guides: https://sealgate.ai/connect
• Contact: hello@sealgate.ai

License

MIT. Copyright GPU-EVM LTD (Sealgate). See LICENSE.