> ## Documentation Index
> Fetch the complete documentation index at: https://explore.airia.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Gateway/Deployment Creation

> Build a Gateway or Deployment: pick apps, connect credentials, and choose which tools to expose.

Gateways and Deployments are both built from the same three ingredients: the apps you want to use, the credentials that connect to them, and the specific tools you want exposed. What differs is the setup entry point and whether you pick apps yourself. For the full comparison, see [Deployments vs. Gateways](/mcps/admin-controls/deployments-vs-gateways).

This page covers the creation flow for each, plus the credential and tool steps they share.

<Note>
  Any user can create a `Personal` Gateway. Creating a `Tenant` Gateway requires the **Platform Admin** or **Security Admin** role. Only servers an admin has approved in [Server Management](/mcps/admin-controls/server-management) appear when you pick apps.
</Note>

## Create a Gateway

<Steps>
  <Step title="Open the Gateway List">
    Navigate to **Secure → Gateway → MCP Gateway** to open your Gateway List, then click **New Gateway**.
  </Step>

  <Step title="Name it and set visibility">
    Choose a **name** and a **visibility level**, `Personal` or `Tenant`. Names must be unique across your whole organization, not just among your own Gateways. See [Tenant vs. Personal Level Gateway Configs](/mcps/admin-controls/tenant-vs-personal-gateway-configs) if you're unsure which to pick.
  </Step>

  <Step title="Select apps">
    Pick the apps you want from the grid of servers your organization has approved. You can search by name and filter by category, and apps your admin has marked as Featured are pinned near the top. A single Gateway can include any number of apps.
  </Step>

  <Step title="Connect credentials and choose tools">
    Once you've picked at least one app, configure each one: connect its credentials and choose which of its tools to expose. See [Connect credentials](#connect-credentials) and [Choose tools](#choose-tools) below, since these steps are shared with Deployments.
  </Step>

  <Step title="Save">
    Save the Gateway. It's added to your Gateway List immediately, ready to connect to.
  </Step>
</Steps>

## Create a Deployment

A Deployment is always built around one app you've already chosen, so there's no app-selection step.

<Steps>
  <Step title="Open the app">
    Navigate to **Build → Components → MCP Servers → Available** and click into the app you want to deploy.
  </Step>

  <Step title="Start a new Deployment">
    Click **New Deployment**.
  </Step>

  <Step title="Name it and set scope">
    Fill in a **name** and an optional **description**, then choose which **project** it belongs to, or leave it available to every project.
  </Step>

  <Step title="Connect credentials and choose tools">
    Connect credentials and choose tools, the same as a Gateway. See [Connect credentials](#connect-credentials) and [Choose tools](#choose-tools) below.
  </Step>

  <Step title="Save">
    Save the Deployment. It's now available as a tool source wherever that project's agents are configured.
  </Step>
</Steps>

## Connect credentials

Whether it's the first app in a new Gateway or the single app behind a Deployment, credentials are handled the same way: inside the flow, one app at a time, with no separate setup screen. What you're asked for depends on how the app authenticates.

| Auth method                        | What you do                                                                                                                                                                                                                            |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **No authentication**              | Nothing. These apps connect automatically.                                                                                                                                                                                             |
| **API key**                        | Paste in a key. You can share it across your whole tenant so nobody else has to enter their own.                                                                                                                                       |
| **OAuth**                          | If your organization hasn't connected this app before, an admin may need to register it first. After that, you sign in with your own account, and your personal sign-in stays yours even if the underlying app registration is shared. |
| **Pass-through or token exchange** | Airia reuses your existing sign-in to Airia itself, so there's often nothing extra to configure.                                                                                                                                       |

If you've already connected an app in a previous Gateway or Deployment, it shows up already configured instead of asking you to sign in again. Each app's status is visible as you work through your list: `Configured`, `Needs Authentication`, or `Not Configured`.

See [Tenant vs. Personal Level App Credentials](/mcps/admin-controls/tenant-vs-personal-app-credentials) and [Supported Credential Types](/mcps/admin-controls/supported-credential-types) for how each method works.

## Choose tools

Once an app is connected, Airia pulls its live list of available tools so you can expose exactly the ones you want rather than everything the app offers. Use the search box to find specific tools, or **Select All** and **Deselect All** to act on whatever the current search or filter is showing. A running count tracks how many tools you've selected out of the total available. You need at least one tool selected per app before you can save.

Each tool is also checked for hidden prompt injection attempts as it loads, with a status badge next to it. See [Tool Scanning](/mcps/admin-controls/tool-scanning) for what those badges mean and what to do about a flagged tool.

### Why not expose every tool?

Every tool you expose adds to the context your AI has to read before it can act, and a long list of similar-sounding options makes it easier for a model to pick the wrong one. Choosing tools deliberately keeps your AI faster and more accurate. It also limits the blast radius if a connected app is ever misused, since only the actions you selected are reachable at all.

If a Gateway ends up exposing a large number of tools anyway, from one app or many, Airia suggests turning on [Radar](/mcps/admin-controls/radar) once you cross around 50 tools. Radar lets your AI search for the right tool on demand instead of holding the full list in context. You're always free to dismiss the suggestion and keep the full list.

## Add instructions (optional)

Both Gateways and Deployments can include a short block of written guidance that an agent reads before using your tools. It's useful for naming conventions, environment-specific details, or anything a plain tool definition can't convey on its own. See [Instructions Tool](/mcps/admin-controls/instructions-tool) for how to set it up.

## After you create it

A new Gateway appears in your Gateway List with a connection endpoint and a setup guide for common MCP clients like Cursor, Claude Code, and Claude, so you can use it outside Airia right away. It's also immediately selectable from the agent builder's tool section if you'd rather use it inside Airia.

A new Deployment has no connection endpoint of its own. Instead, it becomes available to attach as a tool source to any agent in the project you assigned it to.

Neither one is locked in once you save. Names, visibility, connected apps, credentials, and selected tools can all be revisited later. See [Editing a Gateway](/mcps/admin-controls/editing-a-gateway) for how to make changes after the fact.

## Related Resources

<CardGroup cols={2}>
  <Card title="Deployments vs. Gateways" icon="scale-balanced" href="/mcps/admin-controls/deployments-vs-gateways">
    Decide which one fits before you build
  </Card>

  <Card title="Server Management" icon="server" href="/mcps/admin-controls/server-management">
    Approve which apps your organization can use
  </Card>

  <Card title="Supported Credential Types" icon="key" href="/mcps/admin-controls/supported-credential-types">
    See how each authentication method works
  </Card>

  <Card title="Editing a Gateway" icon="pen-to-square" href="/mcps/admin-controls/editing-a-gateway">
    Change apps, credentials, and tools after you create one
  </Card>
</CardGroup>