Gateco MCP server
{
"mcpServers": {
"gateco": {
"command": "uvx",
"args": [
"gateco"
],
"env": {
"GATECO_API_KEY": "<gateco_api_key>"
}
}
}
}{
"mcpServers": {
"gateco": {
"command": "uvx",
"args": [
"gateco"
],
"env": {
"GATECO_API_KEY": "<gateco_api_key>"
}
}
}
}{
"mcpServers": {
"gateco": {
"command": "uvx",
"args": [
"gateco"
],
"env": {
"GATECO_API_KEY": "<gateco_api_key>"
}
}
}
}{
"servers": {
"gateco": {
"command": "uvx",
"args": [
"gateco"
],
"env": {
"GATECO_API_KEY": "${input:gateco_api_key}"
}
}
},
"inputs": [
{
"id": "gateco_api_key",
"type": "promptString",
"description": "Gateco api key",
"password": true
}
]
}{
"mcpServers": {
"gateco": {
"command": "uvx",
"args": [
"gateco"
],
"env": {
"GATECO_API_KEY": "<gateco_api_key>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall uvx gatecoversion 1.11.1
What it does
Gateco is an MCP server that sits between AI agents and vector stores, enforcing access policies before any document content reaches a model. It exposes tools for permission-gated retrieval, grounded answer synthesis, and access simulation, intended for developers building RAG pipelines that must respect organizational access controls.
- Query a document connector on behalf of a specific user and receive only the chunks that user's access policies permit.
- Generate a grounded answer from policy-filtered search results, with citations drawn only from content the principal is authorized to see.
- Dry-run an access check to determine whether a given principal would be allowed to retrieve specific content before executing a live query.
Tools this server exposes
| Tool | Does |
|---|---|
| gateco_retrieve | Executes a permission-aware retrieval against a connector using vector, keyword, hybrid, or grep search modes, returning only chunks the specified principal is |
| gateco_ask | Generates a grounded answer synthesized from policy-filtered chunks, with citations limited to content the principal is permitted to see (requires Team+ plan). |
| gateco_check_access | Performs a dry-run access simulation to preview whether a principal would be granted or denied access without executing a live retrieval (requires Growth+ plan) |
| gateco_list_connectors | Lists available connectors along with their readiness levels. |
| gateco_list_principals | Lists identity principals registered in the system. |
| gateco_resolve_principal | Looks up a principal by email address or identity provider subject ID. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.