Configuring MCP Gateway with app.yaml

MCP Gateway's app.yaml file defines core MCP Gateway settings. You can use this file to define all your permissions, including access control, tool groups, and tool customizations. It's located in the config file created during set up, and populates automatically as you create Agent Profiles, Custom Tools, and Tool Groups.

Parameters

default

Required: True
Type: List of Strings
This defines the default behavior for all consumers that are not explicitly stated. You can state allow of block followed by a list of tool groups.

  default:
    block: []

note

In order to "allow all" use block: [] and allow: [] to "block all"

consumers

Required: False
Type: List of arrays
A list of arrays which explicitly states the access permissions for a specific consumer group.

    consumers:
      consumerGroup: # name of consumer group
        block: 
          - toolGroup 

toolGroups

Required: False
Type: Map of objects
A map of objects, each with a name and a services map. Each service maps to an MCP server, and can reference either all tools using *, or specific tools as an array of strings.

  toolGroups:
    - name: group1 
      services: 
        serverName1: # name of the server. 
          - myTool1 # name of tools in the group
          - myTool2
        serviceName2: "*" # the user can use a * to signify all the tools in one service 

auth

Required: False
Type: boolean
Enables basic API key authentication for controlling access to MCP Gateway.

  auth:
    enabled: false

toolExtensions

Required: False
Type: Map of objects A map of customized tools, organized by service. Use this to override tool parameters or descriptions without modifying the original tool.

  toolExtensions:
    services: 
      serviceName1: 
        toolName: 
          childTools:
            - name: customToolName
              description:
                action: rewrite
                text: "description of custom tool"
              overrideParams:
                my-param: overridenParam

Default configuration

This is the default configuration for the your app.yaml. By default all requests via MCP Gateway are allowed.

Default Configuration

permissions:
  default:
    block: []
  consumers: {}
  toolGroups: []
  auth:
    enabled: false
  toolExtensions:
    services: {}    

Example

Below is an example of a fully configured app.yaml

Example

  permissions:
    default:
      allow: 
        - group1
        - group2
    consumers:
      developers: 
        block: 
          - group1 
      marketing:
        block: 
          - group2 
  toolGroups:
    - name: group1 
      services: 
        serviceName1: 
          - myTool1
          - myTool2
        serviceName2: "*" 
    - name: group2
      services:
        serviceName3:
          - myTool3
  auth:
    enabled: false 
  toolExtensions:
    services: 
      serviceName1: 
        toolName: 
          childTools:
            - name: customToolName
              description: 
                action: rewrite
                text: "description of custom tool"
              overrideParams: 
                my-param1: overriddenParam