> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.hoop.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Gateway

> Protocol-aware MCP proxy with tool-level policy and audit.

export const ConnectionTemplate = ({config}) => {
  const defaultConfig = {
    name: "Connection",
    description: "Connection description",
    coverImage: "",
    features: {
      tlsTerminationProxy: {
        native: false,
        oneOff: false
      },
      audit: {
        native: false,
        oneOff: false
      },
      dataMaskingGoogleDLP: {
        native: false,
        oneOff: false
      },
      dataMaskingMSPresidio: {
        native: false,
        oneOff: false
      },
      guardrails: {
        native: false,
        oneOff: false
      },
      credentialsOffload: {
        native: false,
        oneOff: false
      },
      interactiveAccess: {
        native: false,
        oneOff: false
      }
    }
  };
  const finalConfig = Object.assign({}, defaultConfig, config);
  const renderIcon = enabled => {
    return enabled ? <Icon icon="check" /> : <Icon icon="xmark" />;
  };
  return <div>
      <h2>Before you start</h2>
      <p>To get the most out of this guide, you will need to:</p>
      <ul>
        <li>Either <a href="https://use.hoop.dev">create an account in our managed instance</a> or <a href="/docs/getting-started/installation/overview">deploy your own hoop.dev instance</a></li>
        <li>You must be your account administrator to perform the following commands</li>
      </ul>

      {finalConfig.requirements && <>
          <h2>Requirements</h2>
          <p>{finalConfig.requirements.description}</p>
          {finalConfig.requirements.items && <ul>
            {finalConfig.requirements.items.map(item => <li>{item}</li>)}
          </ul>}
        </>}

      <h2>Features</h2>
      <p>The table below outlines the features available for this type of connection.</p>

      <ul>
        <li><strong>Native</strong> - Accessible via a native connection using hoop as proxy protocol to the resource.</li>
        <li><strong>One Off</strong> - This term refers to accessing the resource from Hoop Web Console.</li>
      </ul>

      <table>
        <thead>
          <tr>
            <th>Feature</th>
            <th>Native</th>
            <th>One Off</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td>TLS Termination Proxy</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.native)}</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.oneOff)}</td>
            <td>The local proxy terminates the connection with TLS, enabling the connection with the remote server to be TLS encrypted.</td>
          </tr>
          <tr>
            <td>Audit</td>
            <td>{renderIcon(finalConfig.features?.audit?.native)}</td>
            <td>{renderIcon(finalConfig.features?.audit?.oneOff)}</td>
            <td>The gateway stores and audits the queries being issued by the client.</td>
          </tr>
          <tr>
            <td>Data Masking (Google DLP)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Data Masking (MS Presidio)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Guardrails</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.native)}</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.oneOff)}</td>
            <td>An intelligent layer of protection with smart access controls and monitoring mechanisms.</td>
          </tr>
          <tr>
            <td>Credentials Offload</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.native)}</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.oneOff)}</td>
            <td>The user authenticates via SSO instead of using database credentials.</td>
          </tr>
          <tr>
            <td>Interactive Access</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.native)}</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.oneOff)}</td>
            <td>Interactive access is available when using an IDE or connecting via a terminal to perform analysis exploration.</td>
          </tr>
        </tbody>
      </table>

      {finalConfig.resourceConfiguration?.credentials && <>
      <h2>Configuration</h2>
      <table>
        <thead>
          <tr>
            <th>Name</th>
            <th>Type</th>
            <th>Required</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          {Object.entries(finalConfig.resourceConfiguration.credentials).map(([key, credential]) => {
    if (typeof credential === 'string' || credential.hidden) return null;
    return <tr key={key}>
                <td>{credential.name}</td>
                <td>{credential.type}</td>
                <td>{credential.required ? 'yes' : 'no'}</td>
                <td>
                  {credential.description?.split(/(\[[^\]]+\]\([^)]+\))/).map((part, index) => {
      const linkMatch = part.match(/\[([^\]]+)\]\(([^)]+)\)/);
      if (linkMatch) {
        return <a key={index} href={linkMatch[2]} target="_blank" rel="noopener noreferrer">{linkMatch[1]}</a>;
      }
      return part;
    })}
                </td>
              </tr>;
  }).filter(Boolean)}
        </tbody>
      </table>
      </>}
    </div>;
};

The `mcp` connection type relays Model Context Protocol traffic as opaque HTTP. That covers data masking in transit. It cannot tell a model calling `delete_issue` from the same words appearing inside a tool result.

The MCP Gateway parses every JSON-RPC message in both directions, which makes a class of controls expressible that a byte relay cannot offer:

* **Tool-level allow and deny lists.** Hoop strips denied tools from `tools/list` before the model sees them, so it never attempts a call you would have blocked.
* **Approval holds on individual tool calls.** A matched `tools/call` parks for human review while the rest of the session keeps working.
* **Rug-pull detection.** Hoop fingerprints each tool's name, description and input schema, then kills or flags the session when a server rewrites one mid-conversation.
* **Sampling and elicitation gating.** Hoop denies both by default, so a compromised server cannot drive your LLM or phish your users through its own dialogs.
* **Budgets.** Cap calls per session, per-tool rates, and result size.
* **Structured audit.** Session review names the tool that ran, its argument digest, how long it took and which rule blocked it, in place of request and response blobs.

Guardrails and data masking still apply, and they now run on the free-text fields MCP has: tool-call arguments, tool descriptions and result text leaves. Masking cannot corrupt the JSON-RPC envelope, and guardrails no longer match against protocol framing, which removes a common source of false positives.

Hoop proxies remote MCP servers and local `stdio` servers. A stdio server runs either on the agent, so you can offer an `npx`-style server as a shared connection without hosting it yourself, or on each user's own machine, for servers that need their working tree and their credentials.

<ConnectionTemplate
  config={{
"id": "mcpproxy",
"name": "MCP Gateway",
"description": "Protocol-aware MCP proxy with tool-level policy and audit.",
"category": "ai-and-llms",
"icon-name": "mcp",
"tags": [
"ai",
"llm",
"security",
"proxy",
"mcp"
],
"overview": {
"description": "Hoop parses every JSON-RPC message, so you control the tool call instead of the byte stream. Allow or deny individual tools, hold sensitive calls for review, catch a server that rewrites a tool description mid-session, and read an audit trail that names the tool instead of dumping an HTTP blob."
},
"setupGuide": {
"accessMethods": {
  "webapp": false,
  "cli": false,
  "native": true,
  "runbooks": false
}
},
"resourceConfiguration": {
"type": "httpproxy",
"subtype": "mcpproxy"
},
"features": {
"tlsTerminationProxy": {
  "native": true,
  "oneOff": false
},
"audit": {
  "native": true,
  "oneOff": false
},
"dataMaskingGoogleDLP": {
  "native": false,
  "oneOff": false
},
"dataMaskingMSPresidio": {
  "native": true,
  "oneOff": false
},
"guardrails": {
  "native": true,
  "oneOff": false
},
"credentialsOffload": {
  "native": true,
  "oneOff": false
},
"interactiveAccess": {
  "native": false,
  "oneOff": false
}
},
"documentationConfig": {
"path": "quickstart/ai-and-llms/mcp-gateway"
}
}}
/>

### Choosing between MCP and MCP Gateway

The `MCP` connection type is a byte-level HTTP relay. Choose it when you need TLS termination, session recording and data masking in front of a remote MCP endpoint.

The `MCP Gateway` connection type parses the protocol. Choose it when you need control that names a tool: allow and deny lists, per-tool approvals, rug-pull detection, budgets, or an audit trail a reviewer can read.

Both types can run side by side against the same upstream server, so you can move one connection at a time.

### Transports

* `streamable-http` is the current remote MCP protocol. Set the server URL.
* `sse` is the legacy HTTP+SSE protocol, still used by some hosted servers.
* `stdio` is a local server the agent spawns as a child process. Supply the command and any environment the child needs.
* `client-stdio` is the same command, run on the machine of whoever connects. Inspection still happens in the agent; only the process moves.

Both stdio transports take a command instead of a URL. They differ in one thing: which machine runs it.

|                              | `stdio`                            | `client-stdio`                                     |
| ---------------------------- | ---------------------------------- | -------------------------------------------------- |
| Runs on                      | The agent host                     | Each user's own machine                            |
| Sees                         | The agent's filesystem and network | The user's working tree, SSH agent, logged-in CLIs |
| Started by                   | The agent, shared by all users     | `hoop connect`, one process per user               |
| Runtime must be installed on | The agent image                    | Each user's machine                                |
| Client points at             | The gateway's MCP endpoint         | `http://127.0.0.1:8081/mcp`                        |

Choose `stdio` for a server that is the same for everyone: a hosted API wrapper, a shared database tool. Choose `client-stdio` for a server that is only useful next to the user: filesystem, git, or anything that should act as that person rather than as a shared service account.

[Talk to our team](https://dub.sh/G85aUr8) if you want to discuss your setup before deploying.