> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devctrl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Gateway Overview

> The Devctrl gateway authenticates agents, enforces policies, and logs every tool call.

The Devctrl gateway is a managed service that sits between your AI agents and the tools they use. Every MCP request flows through the gateway — authenticated, authorized, rate-limited, and logged.

**Gateway endpoint:** `https://gateway.devctrl.ai/mcp`

## What it does

On every request, the gateway handles:

1. **Authentication** — verifies the agent's bearer token against identity credentials
2. **Rate limiting** — enforces request limits at session, project, and global levels
3. **Policy enforcement** — evaluates your CEL rules to allow or deny the tool call
4. **Proxying** — forwards allowed requests to the correct upstream MCP server
5. **Audit logging** — records every decision with full context

## Endpoints

| Method   | Path                         | Description                                                         |
| -------- | ---------------------------- | ------------------------------------------------------------------- |
| `*`      | `/mcp`                       | MCP StreamableHTTP endpoint — handles `tools/list` and `tools/call` |
| `POST`   | `/v1/tasks/sessions`         | Create a new task session                                           |
| `GET`    | `/v1/tasks/sessions/current` | Get the current task session                                        |
| `DELETE` | `/v1/tasks/sessions/current` | Delete the current task session                                     |

## Rate limiting

Requests are rate-limited at three levels to protect your project and the platform:

| Level       | Scope                   |
| ----------- | ----------------------- |
| **Session** | Per agent session       |
| **Project** | All agents in a project |
| **Global**  | Across the platform     |

When a limit is exceeded, the gateway returns a `429 Too Many Requests` response.

## Upstream authentication

The gateway supports two methods for authenticating with your upstream MCP servers:

| Method           | Description                                                            |
| ---------------- | ---------------------------------------------------------------------- |
| **Header-based** | Static headers (API keys, tokens) injected into every upstream request |
| **OAuth**        | Full OAuth lifecycle — automatic token refresh, retry on expiry        |

Credentials for upstream servers are encrypted at rest. Configure authentication when you [register an MCP server](/console/register-mcp-servers) in the console.

## Next steps

<CardGroup cols={2}>
  <Card title="Connect an agent" icon="plug" href="/gateway/connect-an-agent">
    Point your AI agent at the gateway.
  </Card>

  <Card title="Task sessions" icon="clock" href="/gateway/task-sessions">
    Create scoped, time-limited task tokens.
  </Card>
</CardGroup>