Any user can create a
Personal Gateway. Creating a Tenant Gateway requires the Platform Admin or Security Admin role. Only servers an admin has approved in Server Management appear when you pick apps.Create a Gateway
Open the Gateway List
Navigate to Secure → Gateway → MCP Gateway to open your Gateway List, then click New Gateway.
Name it and set visibility
Choose a name and a visibility level,
Personal or Tenant. Names must be unique across your whole organization, not just among your own Gateways. See Tenant vs. Personal Level Gateway Configs if you’re unsure which to pick.Select apps
Pick the apps you want from the grid of servers your organization has approved. You can search by name and filter by category, and apps your admin has marked as Featured are pinned near the top. A single Gateway can include any number of apps.
Connect credentials and choose tools
Once you’ve picked at least one app, configure each one: connect its credentials and choose which of its tools to expose. See Connect credentials and Choose tools below, since these steps are shared with Deployments.
Create a Deployment
A Deployment is always built around one app you’ve already chosen, so there’s no app-selection step.Open the app
Navigate to Build → Components → MCP Servers → Available and click into the app you want to deploy.
Name it and set scope
Fill in a name and an optional description, then choose which project it belongs to, or leave it available to every project.
Connect credentials and choose tools
Connect credentials and choose tools, the same as a Gateway. See Connect credentials and Choose tools below.
Connect credentials
Whether it’s the first app in a new Gateway or the single app behind a Deployment, credentials are handled the same way: inside the flow, one app at a time, with no separate setup screen. What you’re asked for depends on how the app authenticates.| Auth method | What you do |
|---|---|
| No authentication | Nothing. These apps connect automatically. |
| API key | Paste in a key. You can share it across your whole tenant so nobody else has to enter their own. |
| OAuth | If your organization hasn’t connected this app before, an admin may need to register it first. After that, you sign in with your own account, and your personal sign-in stays yours even if the underlying app registration is shared. |
| Pass-through or token exchange | Airia reuses your existing sign-in to Airia itself, so there’s often nothing extra to configure. |
Configured, Needs Authentication, or Not Configured.
See Tenant vs. Personal Level App Credentials and Supported Credential Types for how each method works.
Choose tools
Once an app is connected, Airia pulls its live list of available tools so you can expose exactly the ones you want rather than everything the app offers. Use the search box to find specific tools, or Select All and Deselect All to act on whatever the current search or filter is showing. A running count tracks how many tools you’ve selected out of the total available. You need at least one tool selected per app before you can save. Each tool is also checked for hidden prompt injection attempts as it loads, with a status badge next to it. See Tool Scanning for what those badges mean and what to do about a flagged tool.Why not expose every tool?
Every tool you expose adds to the context your AI has to read before it can act, and a long list of similar-sounding options makes it easier for a model to pick the wrong one. Choosing tools deliberately keeps your AI faster and more accurate. It also limits the blast radius if a connected app is ever misused, since only the actions you selected are reachable at all. If a Gateway ends up exposing a large number of tools anyway, from one app or many, Airia suggests turning on Radar once you cross around 50 tools. Radar lets your AI search for the right tool on demand instead of holding the full list in context. You’re always free to dismiss the suggestion and keep the full list.Add instructions (optional)
Both Gateways and Deployments can include a short block of written guidance that an agent reads before using your tools. It’s useful for naming conventions, environment-specific details, or anything a plain tool definition can’t convey on its own. See Instructions Tool for how to set it up.After you create it
A new Gateway appears in your Gateway List with a connection endpoint and a setup guide for common MCP clients like Cursor, Claude Code, and Claude, so you can use it outside Airia right away. It’s also immediately selectable from the agent builder’s tool section if you’d rather use it inside Airia. A new Deployment has no connection endpoint of its own. Instead, it becomes available to attach as a tool source to any agent in the project you assigned it to. Neither one is locked in once you save. Names, visibility, connected apps, credentials, and selected tools can all be revisited later. See Editing a Gateway for how to make changes after the fact.Related Resources
Deployments vs. Gateways
Decide which one fits before you build
Server Management
Approve which apps your organization can use
Supported Credential Types
See how each authentication method works
Editing a Gateway
Change apps, credentials, and tools after you create one