MCP gateway

DioscHub is an MCP gateway. Everything the assistant does in your systems passes through it: when the LLM decides to call a tool, DioscHub discovers that tool, forwards the signed-in user’s auth to the MCP server that owns it, and holds any state-changing call behind an approval step until the user says yes. Your servers stay plain Model Context Protocol — they never import a DioscHub SDK or know it exists.

This page is a map, not a lesson. Everything it links already lives in the Build and Operate pillars; this threads it into one subsystem view for when you’re thinking “the MCP gateway” rather than “I’m building” or “I’m operating.”

Tip

The shortest path, end to end: write a tool → meet the contract → forward the user’s auth → gate the dangerous ones → register it → watch it in production.

Build a server

Start here if you’re writing the thing the gateway talks to.

Quickstart: your first MCP tool Empty file to an assistant calling your tool, in a few minutes.

MCP server development The overview — the thin contract on top of vanilla MCP that lets the gateway discover and call your tools.

The DioscHub MCP contract Transport, tool naming, the fields the gateway reads, and the response shape it expects.

The TypeScript framework Optional: @dioschub/client’s server-side twin — createMcpServer implements the whole contract for you.

Forward identity through the gateway

How the signed-in user’s credential reaches your tool — and why the model never sees it.

Forward the user's auth to your server The BYOA header flow on every tools/call, and the 401/403 split that drives re-auth.

Implement the bind endpoint The server-to-server call that binds a user's identity to the connection the gateway forwards.

Gate what it can do

The gateway is where dangerous calls are held for a human, and where files cross without the model seeing them.

Gate state-changing tools behind Consensus Put an approval step in front of any tool that writes, so the user reviews it before it runs.

Read and write files from a tool Fetch or return a user's file over a side channel — the bytes never pass through the model.

Register & operate it

Wire the server into an assistant, then watch it run.

MCP servers & Toolsets Register a conduit instance, attach it to an assistant, and organize a large tool catalog.

MCP health & error logs See which servers are reachable and read the gateway's per-call error trail.

---

The terms above — MCP server, MCP instance, MCP tool, Toolset, conduit — are each defined once in the glossary.