Documentation

What is ScopeGate?

ScopeGate is an AI Access Proxy Layer that sits between your AI agents and the external services they use. It enforces granular, per-agent permissions on top of MCP (Model Context Protocol) and OAuth — so each agent can only do exactly what you authorize.

How the MCP Proxy Works

When an AI agent makes a tool call via MCP, the request routes through ScopeGate before reaching the target service. ScopeGate checks the request against your permission policy: which agent is calling, what action it’s requesting, and whether that action is allowed. If the request passes, it’s forwarded transparently. If not, it’s blocked and logged.

Per-Agent Permission Control

Unlike native OAuth scopes (which are binary — an app either has access or it doesn’t), ScopeGate lets you define fine-grained rules per agent. For example: Agent A can read Google Drive files in the /reports folder but can’t write. Agent B can send Gmail but can’t read your inbox. Agent C has read-only Google Calendar access with a rate limit of 100 requests per hour.

Audit Trails & Logging

Every tool call that passes through ScopeGate is logged with metadata: which agent, what action, parameters, status, and duration. You get a full audit trail of what your AI agents are doing across all connected services — essential for compliance, debugging, and trust.

Getting Started

1. Sign up for a free ScopeGate account
2. Create a project and connect your first service (e.g., Google)
3. Define permission rules for your AI agent
4. Copy the MCP endpoint URL into your agent’s configuration
5. Your agent now accesses the service through ScopeGate’s permission layer

Supported Integrations

ScopeGate supports Google Drive, Gmail, Google Calendar, Google Sheets, Slack, Notion, GitHub, Twitter/X, LinkedIn, Google Ads, and OpenRouter. New integrations are added regularly.

Self-Hosting

The core ScopeGate engine is open-source (MIT license) and available on GitHub. You can run it yourself with no usage limits. ScopeGate Cloud adds multi-tenancy, team management, SSO, compliance exports, and hosted reliability on top.