Custom MCP server
Define and configure a custom MCP server behind the P0 AI Gateway when P0 does not ship a predefined server for it.
A custom MCP server is one you define yourself, for any MCP server P0 doesn't ship a predefined definition for. The gateway reaches it in one of two ways: it proxies requests to a server you host outside it, or it runs a Docker container that hosts the server for you. Once configured, it behaves like any other server behind the P0 AI Gateway: agents reach it through the gateway URL, and every tool call is authenticated and checked against policy.
Prerequisites
A registered Gateway component, with the gateway deployed in your environment.
Configure the custom MCP server
Follow the shared steps in Add an MCP server to name the server and choose its gateway.
Credential source
Credential source determines how the gateway authenticates to the upstream server. A custom server supports three sources: OAuth, Native credentials, and GCP WIF federation (Preview).
OAuth
With OAuth, the gateway authenticates as the user making the call, using a user-delegated token. Set Credential source to OAuth and leave Grant type on Authorization code. The upstream server must allow one of the following client authentication methods:
Arbitrary clients with token-authentication method equal to
none
If the server requires scopes, add those in the "scopes" box.
Native credentials
Choose Native credentials when the upstream server accepts a session token the gateway mints, rather than a user-delegated OAuth token. The gateway signs the token and sends it to the upstream on each call.
If the upstream needs extra claims in that token, add them in the optional Claims field.
Claims
Extra claims to add to the minted JSON Web Token (JWT), written as a JSON object that parses to a valid JWT payload. Use LiquidJS template syntax to insert values from the access request.
No
For example, to set a scopes claim from the role in the access request:
Once you've selected an access resource (Access control method), you may click "available variables" to view available template variables in the page sidebar:
Only variables listed in your gateway's NATIVE_CREDENTIAL_ALLOWED_CLAIMS list may be set using claims. By default these are only the scopes and exp claims.
Leave Claims empty to send the token with its default claims.
GCP WIF federation (Preview)
Choose GCP WIF federation when the upstream server accepts Google Cloud workload identity federation credentials. The gateway federates into Google Cloud as its own identity and passes a short-lived, policy-scoped credential to the upstream on each call.
This source needs an installed GCP Workload Identity Federation component. Select the one to federate through in the Federation provider field. If your organization has no GCP Workload Identity Federation component installed, the install fails.
Federation provider
An installed GCP Workload Identity Federation component to federate through.
Yes
Definition
To define a custom server, choose Custom here.
Server type
The Server type determines how the gateway reaches the server. A custom server supports two types: External and Container (Preview).
External proxies requests to an MCP server hosted outside the gateway, reachable at a fixed URL:
Server URL
URL of the externally hosted MCP server.
Yes
Label
Human-friendly label for this server.
Yes
Container (Preview) runs a Docker container that hosts the MCP server. The gateway starts the container and routes tool calls to it:
Label
Human-friendly label for this server.
Yes
Docker entrypoint
Command the container runs on start. Use LiquidJS template syntax to insert request parameters and credentials.
Yes
Docker image
Image that hosts the MCP server.
Yes
Location field name
Name of the field an agent must supply to route calls to this server, for example project or account.
Yes
Location field description
Description of the value an agent passes for the location field.
Yes
Server details
These fields apply to the server itself:
Agent prompt
Describes the argument list (argv) an agent should pass to request access.
Yes
Access control method
The Access control method sets how the gateway decides which tool calls to allow. Pick one of three options. The default is Annotation.
Annotation (Preview) gates access by what each tool does. Tools fall into three groups: read-only, write (non-destructive), and destructive. An agent asks for one or more groups, and the gateway allows any tool in a group it was granted. A tool with no label counts as destructive. There are no extra fields to set.
Tool (Preview) gates access by tool name. An agent asks for the exact tools it needs, and the gateway allows only those. There are no extra fields to set.
Native gates access in the upstream environment's own IAM, scoped to an installed access-management integration:
Resource
An installed access-management resource that gates the server. It must be an installed, requestable integration with iam_write capability in your organization. The install fails otherwise.
Yes
Access command prefix
A prefix added to the request arguments when an agent requests access, for example role MyAccessRole.
Yes
Next steps
Define the agentic access policies that determine which agents and users may call the custom MCP server, and what they may do.
Last updated