Connect an AI¶

Point any AI assistant at Gate and it works as you. It can only see and do what you already can, and everything it does is logged under your name.

Open Connect an AI in the console. At the top is your Gate endpoint, one URL for every client:

https://<gate name>/api/v1/gate/mcp

Clients sign in with a personal token: give it a label (which client), press + Create token, and copy it. It is shown once.

Open WebUI for the whole company¶

One connection for everyone: Open WebUI tells Gate who is chatting with a signed, five-minute identity, and Gate runs every tool call as that person. Nobody pastes a token. You need Open WebUI 0.6.31 or later, and a Gate account with the same email for each person (an Active Directory sync creates them).

Connect an AI → Open WebUI → + Create the company connection. It shows two lines once, for example:
```
ENABLE_FORWARD_USER_INFO_HEADERS=true
FORWARD_USER_INFO_HEADER_JWT_SECRET=...
```
Add them to the Open WebUI container's environment and restart it.
In Open WebUI (0.11 or later): Settings → Admin → Integrations → External Tool Servers → +. Click the Type until it says MCP Streamable HTTP, then fill in Name (Acutis Gate), ID (acutis-gate: required for MCP even though it says optional, or Save silently does nothing), URL and Auth: Bearer with the key. Press Verify Connection (the circular arrows): it should say Connection successful. Save, then Save on the page. (Older Open WebUI: Admin Panel → Settings → External Tools → +.) Use the URL and the Bearer key Gate showed you.

Just me, no admin

You can also add Gate to Open WebUI with your personal token as the Bearer key. Only do that for a one-person Open WebUI: a shared token makes everyone who chats there act as you.

In a chat, each person turns Gate on from the tools icon next to + → Tools → Acutis Gate.

On the Linux or Mac appliance, the chat is already running at https://<gate name>:8443.

Claude Desktop¶

Settings → Developer → Edit Config, and add this to claude_desktop_config.json (the console fills in your URL and token):

{
  "mcpServers": {
    "acutis-gate": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://<gate name>/api/v1/gate/mcp",
               "--header", "Authorization: Bearer <your token>"]
    }
  }
}

Cursor and VS Code¶

Create .cursor/mcp.json in your project (or .vscode/mcp.json for Copilot). The console shows the exact file to paste.

See what your AI gets¶

Connect an AI → What this AI can do as you → Run the check lists exactly which apps and actions an assistant gets when it connects as your account, against the guardrails in force right now.

Let your AI help run Gate (admins)¶

As an admin, your AI also gets Gate's own read-only helper tools (named gate__…). Ask in plain words:

"Run Gate's health check and tell me what to fix first."
"Why was lchen denied this morning?"
"What would msmith's AI get?"
"Draft guardrails from the last 30 days."

It can explain and draft, never change Gate: you save drafted rules in Guardrails yourself. Only admins see these tools, and every call is in the audit trail. Once your guardrails are enforced, add this rule so admins keep them:

{"id": "admins-run-gate-helper", "who": ["role:admin"], "effect": "allow", "do": ["read"], "on": ["gate://tools/*"]}

More: Ask your AI to help run Gate.

Add your apps¶

My apps → Add an app for everyone takes any app that speaks MCP over HTTP: Microsoft 365, the HR system, finance, CRM, firewalls, monitoring. Choose how people sign into it:

Each person's own sign-in or own key: every request carries that person's identity (recommended).
One shared account: a labelled fallback for apps without per-person access; logged as shared.
No sign-in needed.

Each app's actions appear to assistants as shortname__action, and guardrails address them as shortname://tools/<action>.