Model Context Protocol
An MCP gateway for your agents. An MCP server for you.
Put the MCP servers your agents use behind the gateway key they already send with every model call: approved and pinned tools, grants per key, guardrails on arguments and results, and every tool call on the same trace as the model calls around it. And connect Claude, ChatGPT, Claude Code or another assistant to INFRO, to ask what your AI spent and why a request failed, with your own role.
INFRO is in private early access. The catalog, the docs, and the API contract are public today, and the gateway is deployed. The console opens with an early-access account, billing opens in stages, and anything beyond v1 is marked Later. Early access details
Two directions
Both live on mcp.infro.io and share nothing else: different endpoints, credentials and plans. The gateway governs what your agents can do with your tools; the server lets you ask INFRO about everything else.
- For
- Agents in production that call tools: GitHub, Linear, Sentry, Supabase, Stripe, your internal services.
- Endpoint
- mcp.infro.io/gateway/mcp
- Credential
- The gateway key the agent already sends with its model calls
- Plan
- Business and up
- For
- The people who run AI: spend, requests, traces and findings, and the changes they confirm.
- Endpoint
- mcp.infro.io/mcp
- Credential
- Your own sign-in from the assistant, or a management token
- Plan
- Reading, projects and keys from Startup; every other change from Team
MCP gateway
An MCP gateway sits between AI agents and the Model Context Protocol servers they call. Without one, each agent holds each server's token, sees whatever tools the server lists that day, and keeps its own record of what it called, if any. INFRO's MCP gateway is the gateway your model calls already go through, so tools get the controls requests have: keys, projects, environments, guardrails, traces and an audit log. INFRO never runs a tool or hosts a server; the servers and their accounts stay yours.
Credentials stay with INFRO
An admin registers each server once with its token. INFRO adds it on every call, so no agent, prompt or config file holds it.
Approved, pinned definitions
Agents get the tool definition an admin approved, served by INFRO. A tool whose definition changes on the server is refused until someone reviews the difference.
Grants per gateway key
Denied by default. Give a key one server's read tools, all of its tools, or a named few. Rotating the key keeps its grants.
Guardrails on arguments and results
Arguments are validated against the approved definition, and your organization's guardrails check what goes into a tool and what comes back.
Tool calls on the trace
Send one trace id with model calls and tool calls, and
GET /v1/tracesreturns the whole run: each tool call with its outcome, latency and sizes.Kill switches on every plan
Disable a server, block a tool, delete a grant or stop all tool traffic in one audited action. Turning access off is never plan-gated.
Connect an agent with one URL and the key it already has.
Any MCP client that speaks Streamable HTTP and sends an Authorization header works. The aggregated endpoint lists every tool the key was granted, named <server>_<tool>; a per-server endpoint keeps the server’s own names.
Checked recipes for OpenAI Agents SDK, Claude Agent SDK, LangChain, Vercel AI SDK, Google ADK, Mastra and CrewAI, and for editors, are on Connect an agent. Servers that only accept OAuth sign-in cannot be registered yet.
import asyncio
import os
from agents import Agent, Runner
from agents.mcp import MCPServerStreamableHttp
async def main() -> None:
async with MCPServerStreamableHttp(
name="infro",
params={
"url": "https://mcp.infro.io/gateway/mcp",
"headers": {
"Authorization": f"Bearer {os.environ['INFRO_API_KEY']}",
},
},
) as infro:
agent = Agent(name="Triage", mcp_servers=[infro])
result = await Runner.run(agent, "Which open issues are labeled bug?")
print(result.final_output)
asyncio.run(main())MCP server
The INFRO MCP server at mcp.infro.io/mcp gives your assistant 18 tools over your organization: usage and estimated provider cost, requests and traces, findings, spend limits and configuration, and a small set of changes it makes only after you confirm. It works with Claude, ChatGPT, Claude Code, Cursor, VS Code, Windsurf and Codex.
- How is our INFRO organization doing this month?get_overview
- Which model cost us the most in the last 7 days?query_usage
- Why did our most recent failed request fail?search_requests → get_request
- Show me the run checkout-123 step by step.get_trace
- Set a $20 monthly spend limit on the Search project that blocks when reached.set_spend_limit, after you confirm
- It acts as you, with your current role, in the one organization you chose, narrowed by what you allowed.
- It never returns prompts or completions, and no tool takes or returns a provider credential or key secret.
- A change needs the version you last read and your confirmation, and is written to the audit log.
- Owners and admins can turn assistant access off for the whole organization in one setting.
- It never calls a model. Assistant calls are not gateway requests and do not count against your plan.
Add it to your assistant.
In Claude and ChatGPT, add https://mcp.infro.io/mcp as a custom connector and sign in: you choose one organization and what the assistant may do. Claude Code, Codex, Cursor and VS Code sign in the same way; Windsurf and scripts use a management token.
Reading is included from the Startup plan, with projects and keys editable there too; every other change needs the Team plan. The full tool list is on MCP tools.
claude mcp add --transport http infro https://mcp.infro.io/mcpFAQ
Does INFRO have an MCP gateway for our agents' tools?
Yes, from the Business plan. It puts INFRO between your agents and the MCP servers they use: GitHub, Linear, Sentry, Supabase, Stripe or your own internal tools. An admin registers each server once with its credential, approves its tools and grants them to gateway keys. Agents connect to one endpoint with the gateway key they already use for model calls. On every call INFRO adds the server's credential so the agent never holds it, serves only the tool definition an admin approved and refuses a tool whose definition has changed since, validates the arguments, applies your guardrails to the arguments and the result, and records the call on the same trace as the agent's model calls. INFRO never runs a tool or hosts a server, and tool calls are not priced or counted against your request allowance.
Can I connect Claude, ChatGPT or Cursor to INFRO?
Yes, through the INFRO MCP server at mcp.infro.io/mcp. Claude and ChatGPT connect by signing in from the assistant: you choose one organization and what the assistant may do, and it acts with your own role. Claude Code, Codex, Cursor and VS Code can sign in the same way; Windsurf and scripts use a management token. The assistant can answer questions such as which model cost the most last week or why a request failed, and make a small set of changes you confirm, such as setting a spend limit. It never calls a model, never sees prompts or completions, and every change it makes is written to the audit log. Reading is included from the Startup plan; changes beyond projects and keys need the Team plan.
Is the MCP gateway the same as the INFRO MCP server?
No. The MCP gateway is for your agents: it governs the tools they call on your own MCP servers, with a gateway key. The MCP server is for you: it lets an AI assistant read and operate your INFRO organization, with your sign-in or a management token. They share the host mcp.infro.io and nothing else: different endpoints, credentials and plans.
Does the MCP gateway stop prompt injection?
No, and no gateway can promise that: a tool result is text the model reads, and no pattern detector, scan or approval step reliably stops a model following instructions hidden in it. What the gateway does is narrow what an injected instruction can reach. A key sees only the tools granted to it, a tool whose definition changed is refused until an admin reviews it, each new or changed definition is scanned for known tool-poisoning shapes, guardrails check arguments and results, and the console warns before one key's grants combine private data, untrusted content and a way to send data out.
Which agents and MCP servers work with the gateway?
Any MCP client that speaks Streamable HTTP and can send an Authorization header. The docs have checked recipes for the OpenAI Agents SDK, Claude Agent SDK, LangChain, Vercel AI SDK, Google ADK, Mastra and CrewAI, and for editors. On the server side, any MCP server reachable over HTTPS that takes no authentication or a token in a header; servers that only accept OAuth sign-in, such as Notion, Vercel and Asana, cannot be registered yet, and the deprecated HTTP+SSE transport is not supported.
Every other question about INFRO is on the FAQ.
Get started
Give your agents tools you can account for.
The control plane that routes, prices and caps your model calls, around the tools your agents call too.