Your agent asks for a tool. Before that request reaches the MCP server, the gateway runs the same checks in the same order, every time. This page walks through them once, so the rest of the docs have something to hang off.
Two kinds of caller reach the gateway, and each has its own credential:
mcphub login. Their client talks to the local proxy on
127.0.0.1:7777, which attaches a fresh token to each request.API keys are refused here with "API keys cannot call tools". A key acts as the person who created it, with all of their grants, which is the shared credential Statio exists to replace. See People and agents.
The first segment of the path names the server, /<server-name>/mcp. The
gateway looks it up inside the caller's organization. A name that does not
resolve is a 404, and a suspended server is refused with the reason it was
suspended.
MCP clients post every request to the same /mcp endpoint, so the tool's name
is not in the URL. The gateway reads it from the JSON-RPC body of a
tools/call. Protocol requests such as initialize and tools/list are not
tool calls: they pass through, and they are not recorded as calls.
When a client asks for the tool list, the gateway removes the tools the caller is not allowed to run before the list reaches the agent. An agent granted two of twelve tools sees two.
A person's token is bound to a key held on their enrolled device, and each request carries a proof signed with that key over the request body. A stolen token without the device key does not work, and a request whose body was changed in transit fails the check.
Agents have no device, so this step does not apply to them. Their tokens are short-lived and each agent's credential can be revoked on its own instead.
The gateway checks the organization's subscription and usage before doing any work for the call:
| Refusal | When |
|---|---|
402 Payment Required | The subscription is not active |
429 Usage Limit Reached | One of the plan's usage limits is reached; the message names which |
429 Rate Limit Exceeded | More requests per minute than the plan allows |
Nothing is granted by default. The caller needs a grant on the server, which covers every tool on it, or a grant on this tool. A person's own deny still wins over a team grant. See Permissions.
Each decision is cached for 15 seconds, so a new grant or a revocation takes up
to 15 seconds to reach the gateway. If the permission service cannot be
reached, a decision the gateway already holds keeps being served, and the
gateway retries every 30 seconds, so a call that worked a moment ago keeps
working through the outage. A call it has never decided is refused with a 503 and
a message saying it could not be checked, rather than allowed.
The call's arguments are scanned for injection patterns against your organization's security policy before anything is forwarded. A call that fails is refused with "Request blocked by security policy".
Only now does the gateway fetch the upstream credential from the vault and add it to the request, after stripping every credential the caller sent. The MCP server receives your Stripe key or GitHub token. The agent never sees it. See Credentials.
The server's response is scanned for secrets on the way back. Depending on your security policy, a secret found there is masked or the response is blocked before it reaches the agent.
Every tool call is recorded in Activity, allowed or not: the tool, the
server, who called it, the status, how long it took, and an error code when it
failed. A refusal by Statio is marked STATIO_<status>, so a policy 403 and
a 403 from the upstream API are never the same row. See
Reading the audit log.
Note
A request refused before its server is known (a bad token, an unknown server name) is returned to the caller but has no server to record against, so it does not appear in Activity.