Authentication and Security

1. Authentication access to Gateway using Truefoundry Token or your IDP token: Any user/application requires a token to talk to the gateway - so that the gateway can identify the user and subsequently impose authorization rules on the user. This can either be a Truefoundry API key or your own IdP token. Truefoundry AI Gateway can verify your own IdP token and extract the user’s email from the token based on the SSO settings.
2. Access Control at Gateway layer: You can define at the gateway layer which users have access to which MCP servers and tools. This allows fine grained access control at an enterprise level. This is done via the MCP Server Group wherein you can define the users/teams that have access to the MCP server group.

3. External service authorization (MCP Server auth): This is the authorization implemented by the MCP Server for accessing the external service. Truefoundry allows MCP servers to be integrated with the following auth mechanisms:
   No Auth

   In this case, the authentication server can be accessed by anyone. This can be the case for demo APIs, or APIs that can be public like a Calculator MCP Server or Deepwiki MCP server(https://mcp.deepwiki.com/mcp)

   This is not recommended for any production MCP server or servers that provide access to some data.

   Header Based Auth

   Header-based authentication allows you to secure your MCP Server by requiring a specific API key or token in the request headers. This method is ideal for APIs that use static credentials for access control.For example, the Hugging Face MCP server follows Header Auth which requires your HuggingFace token to be sent in the header of the request.

   Header Based Auth are used by MCP servers that don’t support user-specific authentication methods like Oauth2 and instead have a static API key or token. In this case, all users calling the MCP server will use the same token.

   Oauth2 Based Auth

   In this case, every user will have their own token and the MCP server will grant access to only the resources that the user has access to. Oauth2 is supported by many of the popular MCP servers like Slack, Github, Atlassian, etc.

   Oauth based authentication is highly recommended for production MCP servers since it allows you to configure scopes to restrict access (e.g., read-only), unlike header authentication. OAuth2 allows users to revoke their own authorization, and users can only access resources they are permitted to use.

   To add an Oauth based MCP server to the AI Gateway and use it in the playground, follow the steps below:

   1

   Create an OAuth2 app in your provider's developer portal (e.g., GitHub, Google, etc.)

   • Set the redirect URI to:
     Copy

     Ask AI

     https://<tfy-control-plane-base-url>/api/svc/v1/llm-gateway/mcp-servers/oauth2/callback
     

     Replace <tfy-control-plane-base-url> with your TrueFoundry control plane URL.
   • Note your OAuth2 App ID, Secret, and required scopes.

   2

   Register your MCP Server in the AI Gateway

   • In the MCP Servers tab, click Add New MCP Server Group.
   • Click Add MCP Server and provide:
     • Endpoint URL: The URL of your deployed MCP Server
     • Authentication Type: Select OAuth2
     • OAuth2 App ID: The client ID from your OAuth2 app
     • OAuth2 App Secret: The client secret from your OAuth2 app
     • OAuth2 App Scopes: The required scopes for accessing provider resources

   For enhanced security, store your OAuth2 credentials in the TrueFoundry secrets store and reference their FQN in your configuration.

   3

   Using OAuth2 Authentication

   You can use the AI Gateway or MCP Gateway API to test and interact with your MCP Server using LLMs and tools.

   1. Click Add Tool/MCP Servers in the AI Gateway UI.
   2. For MCP Servers using OAuth2, click Connect Now to authorize the AI Gateway with your credentials.

   

   Authorize your MCP Server in AI Gateway

   • You can revoke your OAuth2 authorization at any time through the AI Gateway.

   

   Revoke your OAuth2 authorization

   3. Once authentication is successful, your MCP Server’s tools will appear in the list.

   

   MCP Server listed after authentication

   4. Select the tools you want to use and click Done.

MCP Gateway Authentication and Authorization Flow

​

Key Usecases

​

1. Truefoundry Users accessing Oauth Based MCP servers

​

2. End customers accessing Oauth Based MCP Servers

​

3. Developers / End Customers accessing Bearer Token Based MCP servers