Gateway

The OAuth layer you keep meaning to build.

PKCE, dynamic client registration, redirect policies, refresh, encrypted grant storage. None of this is why your users pay you. We’ve already built it. You attach it to whatever MCP server you already have — ours, FastMCP, or your own.

Reusable GatewaysGrant BrokeringFastMCP-readyRequest LogsClient Registration
OAuth boundary

Claude, ChatGPT, Cursor

Gets an MCP token only

Emcy Gateway edge

Handles discovery, PKCE, and token exchange

Your API

Sees the real signed-in user

Token A
Browser-visible MCP token for the client connection.
https://your-app.emcy.dev/mcp
Token B
Downstream API grant retained server-side and applied per tool call.
bearer eyJ... server-side only
Protected resource metadata
Authorization server discovery
PKCE and downstream grants

Emcy turned our OpenAPI spec into a production MCP server in under ten minutes. The OAuth layer just worked.

EL

Engineering Lead

Series B SaaS

We went from hosting our own MCP server to Emcy and cut our agent infrastructure cost by 60%.

CT

CTO

Developer Tools Startup

The embedded agent SDK let us ship AI features without building a separate integration layer.

PE

Product Engineer

Enterprise Platform

01

Auth, done

A week of reading specs, a month of fixing edge cases, then another month supporting it across every MCP client. Or: attach Gateway and move on. Same auth story, every client, no spec docs on your desk.

  • Skip the week of reading and the month of fixing.
  • Customer access tokens never touch the browser, ever.
  • When the next MCP client launches, your auth flow already supports it.
OAuth boundary

Claude, ChatGPT, Cursor

Gets an MCP token only

Emcy Gateway edge

Handles discovery, PKCE, and token exchange

Your API

Sees the real signed-in user

Token A
Browser-visible MCP token for the client connection.
https://your-app.emcy.dev/mcp
Token B
Downstream API grant retained server-side and applied per tool call.
bearer eyJ... server-side only
Protected resource metadata
Authorization server discovery
PKCE and downstream grants
02

Keep your runtime

You don’t have to migrate, rewrite, or move anything. If your MCP server runs somewhere — your laptop, a Fly box, FastMCP, our Host — Gateway becomes its public face.

  • Don’t move infra you don’t want to move.
  • Same auth flow no matter what’s behind it.
  • Swap the runtime later without changing the URL your users connect to.
emcy.ai / monitoring

Tool calls (24h)

2,188

+12% vs yesterday

Avg latency

142ms

p99: 380ms

Error rate

1.3%

29 failed of 2,188

Tool calls
Hourly volume over the last 24 hours
Today
Top tools
Most invoked tools this week
7 days

Recent tool calls

Live
orders.listSK89ms2s ago
payments.refundMR234ms8s ago
users.lookupPP67ms14s ago
inventory.checkSK112ms21s ago
Gateway is the production auth edge: one public URL, one auth story, one place for grants and request logs.

Emcy platform principle

Get started

Add Gateway the day your users need to sign in — whether the runtime lives on Emcy Host or your own infrastructure. Embed and external clients share the same edge.