> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/agentic-gateway.md).

# Agentic gateway

The Agentic Gateway integration puts runtime authorization in front of the MCP servers in your environment, so agents don't operate on loose delegation or standing privilege and every action stays attributable. The [P0 AI Gateway](/readme/agentic-control-plane.md) sits in the data path between your agents and your MCP servers, verifies the identity of the originator and the agent on every tool call, and evaluates each action against the authorization policy defined in the [P0 AuthZ Control Plane™ for Agents](/readme/agentic-control-plane.md) before it reaches its target.

{% hint style="info" %}
The Agentic Gateway integration is available as an opt-in capability. Contact P0 to enable it for your organization.
{% endhint %}

This integration has three components:

| Component                                                                                         | Use                                                                                                                                        |
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| [**Gateway**](/integrations/resource-integrations/agentic-gateway/gateway.md)                     | Registers your self-hosted P0 AI Gateway deployment with P0 so it can enforce policy and report activity.                                  |
| [**Identity provider**](/integrations/resource-integrations/agentic-gateway/identity-provider.md) | Enrolls an external identity provider so its JWT-authenticated agents are trusted at the gateway.                                          |
| [**MCP server**](/integrations/resource-integrations/agentic-gateway/mcp-server.md)               | Configures an upstream MCP server behind the gateway. Once configured, it becomes available to P0-managed agents across your organization. |

## Prerequisites

* An existing P0 account at [p0.app](https://p0.app/).
* A deployed P0 AI Gateway. See [Deploying the P0 AI Gateway](/getting-started/deploying-the-p0-mcp-gateway.md). This is a prerequisite for the [Gateway](/integrations/resource-integrations/agentic-gateway/gateway.md) component.

## How it works

1. [**Register the gateway**](/integrations/resource-integrations/agentic-gateway/gateway.md). After deploying the gateway into your environment, register it with P0 so the AuthZ Control Plane can supply policy and collect audit activity.
2. [**Enroll an identity provider**](/integrations/resource-integrations/agentic-gateway/identity-provider.md). Tell the gateway which token issuer to trust so its JWT-authenticated agents are accepted.
3. [**Configure upstream MCP servers**](/integrations/resource-integrations/agentic-gateway/mcp-server.md). Declare each MCP server you want to expose behind the gateway. P0 supports two kinds:
   * **Predefined**: P0-authored server definitions
   * **Custom**: servers you define yourself

## Next steps

* Connect your agents. Each developer points their own agent at the configured server through the gateway. For Claude Code, see [Use MCP servers with Claude Code](/integrations/resource-integrations/agentic-gateway/using-mcp-servers.md).

Once an agent connects, the gateway authenticates every tool call, authorizes it against policy, and logs it. See [Requesting access](/integrations/resource-integrations/agentic-gateway/requesting-access.md) for how agents request and use just-in-time access, and [Agentic Access Policies](/access-management/just-in-time-access/access-policies/agentic-access-policies.md) for governing those requests.