> ## Documentation Index
> Fetch the complete documentation index at: https://docs.machine0.io/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Gateways

> CLI reference for managing MCP gateways that aggregate multiple MCP servers behind one endpoint.

A gateway aggregates multiple upstream MCP servers behind a single authenticated endpoint. Point an agent (for example one running inside a VM) at the gateway URL and it sees every upstream server's tools through one connection.

```bash theme={"theme":"css-variables"}
machine0 gateways new my-gateway
machine0 gateways servers add my-gateway deepwiki --url https://mcp.deepwiki.com/mcp
machine0 gateways get my-gateway
```

## The gateway endpoint

Each gateway is served at:

```
https://app.machine0.io/gateways/<name>
```

Authenticate with your machine0 API key in the `x-api-key` header. The endpoint speaks stateless Streamable HTTP (JSON responses, no sessions, no SSE). Example MCP client configuration for Claude Code:

```bash theme={"theme":"css-variables"}
claude mcp add --transport http my-gateway \
  https://app.machine0.io/gateways/my-gateway \
  --header "x-api-key: <your-api-key>"
```

Only HTTP(S) upstream servers are supported. Upstream URLs must be public — private, loopback, and link-local addresses are rejected. Upstream servers that require OAuth (Notion, Linear, and most hosted MCP servers) are supported via `gateways servers auth`; static authentication headers are not yet supported.

***

## gateways ls

List gateways, sorted by name.

```bash theme={"theme":"css-variables"}
machine0 gateways ls
machine0 gateways ls --json
```

***

## gateways get

Show gateway details, or a single server's details. Each server is live-probed and the `Auth` column shows two independent facts — whether OAuth credentials are stored, and whether the upstream is reachable:

| Auth value                 | Meaning                                                   |
| -------------------------- | --------------------------------------------------------- |
| `authorized`               | OAuth credentials stored and accepted by the upstream     |
| `authorized (unreachable)` | credentials stored, but the upstream is currently down    |
| `unauthenticated`          | the upstream requires OAuth — run `gateways servers auth` |
| `unreachable`              | the upstream did not respond                              |
| `--`                       | no authentication required (or server disabled)           |

```bash theme={"theme":"css-variables"}
machine0 gateways get <name>
machine0 gateways get <name> [serverName]
```

***

## gateways new

Create a new, empty gateway. Fails if the name is already taken.

```bash theme={"theme":"css-variables"}
machine0 gateways new <name>
```

***

## gateways rm

Delete a gateway. Clients using its endpoint stop working immediately.

```bash theme={"theme":"css-variables"}
machine0 gateways rm <name>
machine0 gateways rm <name> --yes   # skip the confirmation prompt
```

***

## gateways servers add

Add an HTTP MCP server to a gateway.

```bash theme={"theme":"css-variables"}
machine0 gateways servers add <gateway> <name> --url <url>
```

```bash theme={"theme":"css-variables"}
machine0 gateways servers add my-gateway deepwiki --url https://mcp.deepwiki.com/mcp
```

***

## gateways servers auth

Authenticate an OAuth-protected upstream server. Opens your browser for the provider's consent screen; once you approve, the CLI reports success and the gateway starts attaching the credentials to that server's requests. Tokens are stored encrypted and refreshed automatically.

```bash theme={"theme":"css-variables"}
machine0 gateways servers auth <gateway> <serverName>
```

```bash theme={"theme":"css-variables"}
machine0 gateways servers add my-gateway notion --url https://mcp.notion.com/mcp
machine0 gateways get my-gateway                  # notion: unauthenticated
machine0 gateways servers auth my-gateway notion  # browser consent
machine0 gateways get my-gateway                  # notion: authorized
```

Changing a server's URL clears its stored credentials (they are never replayed to a different host). Re-run `auth` after a URL change.

***

## gateways servers deauth

Remove a server's stored OAuth credentials (log out). The server shows as `unauthenticated` again until you re-run `auth`.

```bash theme={"theme":"css-variables"}
machine0 gateways servers deauth <gateway> <serverName>
```

***

## gateways servers remove

Remove a server from a gateway by name.

```bash theme={"theme":"css-variables"}
machine0 gateways servers remove <gateway> <serverName>
```

***

## gateways servers update

Update a server's attributes with repeatable `-a key=value` flags.

```bash theme={"theme":"css-variables"}
machine0 gateways servers update <gateway> <serverName> -a <key=value>...
```

Supported server attributes:

```bash theme={"theme":"css-variables"}
# Prefix all of a server's tool names (avoids collisions between upstreams)
machine0 gateways servers update my-gateway deepwiki -a tools.prefix=dw_

# Only expose specific tools / hide specific tools (mutually exclusive)
machine0 gateways servers update my-gateway deepwiki -a "tools.include=[ask_question]"
machine0 gateways servers update my-gateway deepwiki -a "tools.exclude=[read_wiki_contents]"

# Clear the whole tools config
machine0 gateways servers update my-gateway deepwiki -a tools=''

# Temporarily disable a server without removing it
machine0 gateways servers update my-gateway deepwiki -a disabled=true

# Change the upstream URL
machine0 gateways servers update my-gateway deepwiki -a url=https://new.example.com/mcp
```

Setting any `tools.*` attribute replaces the whole tools config — for example, setting `tools.prefix` clears a previously set `tools.include`.

Without a server name, `update` changes the gateway itself:

```bash theme={"theme":"css-variables"}
# Rename a gateway (the endpoint URL changes with it)
machine0 gateways servers update <gateway> -a name=<new-name>
```

***

## gateways registry ls

List the curated MCP server registry — vetted remote MCP servers you can add to a gateway. Shows each entry's endpoint URL, authentication method, and tool count.

```bash theme={"theme":"css-variables"}
machine0 gateways registry ls
machine0 gateways registry ls --json
```

***

## gateways registry get

Show a registry entry's details, including its full tool list (with the date the list was last verified).

```bash theme={"theme":"css-variables"}
machine0 gateways registry get <entryName>
machine0 gateways registry get linear
machine0 gateways registry get linear --json
```

To add a registry server to one of your gateways, use its URL with `gateways servers add`, then authenticate:

```bash theme={"theme":"css-variables"}
machine0 gateways servers add my-gateway linear --url https://mcp.linear.app/mcp
machine0 gateways servers auth my-gateway linear
```

Note: `gateways servers auth` uses OAuth dynamic client registration, which Linear and Sentry support but Slack does not (Slack requires a pre-registered Slack app). Check an entry's readme (`gateways registry readme <entryName>`) for per-server auth caveats.

***

## gateways registry readme

Print a registry entry's readme — setup notes, auth requirements, and caveats for that server.

```bash theme={"theme":"css-variables"}
machine0 gateways registry readme <entryName>
```