Gateco

What Gateco MCP server does

The Gateco MCP server gives an AI agent access to organizational knowledge without bypassing Gateco’s access policies. Retrieval results are evaluated for the supplied principal before content is returned, so denied chunks are not exposed to the model; metadata such as a denial count and decision can still be returned.

Available MCP tools cover the main retrieval and identity workflows:

• gateco_retrieve searches with vector, keyword, hybrid, or grep modes.
• gateco_ask produces grounded answers with policy-filtered sources and is available on Team+.
• gateco_check_access simulates access decisions and is available on Growth+.
• gateco_list_connectors reports connectors and their readiness levels.
• gateco_list_principals lists identity principals.
• gateco_list_groups lists synchronized and local groups with live member counts.
• gateco_resolve_principal finds a principal by email or provider subject.

How it works

Gateco sits between an agent and the organization’s indexed content. A retrieval request includes a query and can identify the relevant principal and connector. Search mode controls how matching is performed: vector search uses semantic similarity, keyword search uses ranked full-text matching, hybrid search combines vector and keyword results, and grep supports exact or regular-expression matching.

The service applies access policies before returning content. This makes the MCP server suitable for assistants that need to search shared company knowledge while preserving document-level restrictions. gateco_ask builds an answer from policy-filtered retrieval results rather than exposing unrestricted search output.

Setup and configuration

Install the Python package with the MCP extra:

pip install gateco[mcp]

The MCP server reads GATECO_API_KEY for API-key authentication. Keys use explicit scopes. A key with the retrieve scope can call retrieval, answer, connector-listing, principal, resolution, and—on backends from 2026-10-02 onward—group-listing routes. The key takes precedence over a stored login session.

Operations not covered by the key routes require a user session created with gateco login. A stored session is read from ~/.gateco/credentials.json when no API key, environment key, or access token is supplied. Keep that file on one machine because token refresh rotates credentials.

Tools and capabilities

The Gateco MCP server supports both knowledge access and directory discovery. Retrieval can be narrowed with a connector and principal, while hybrid searches can tune the vector-versus-keyword balance. Grep mode supports exact patterns, including regular expressions and case-sensitivity options.

The access simulator is distinct from ordinary retrieval: gateco_check_access requires a user session and cannot be called with an API key. Group listing has a version-dependent exception: a retrieve-scoped key works with a backend from 2026-10-02 onward, while older backends require a user session.

Limitations and notes

Feature availability depends on the Gateco plan. Grounded answer synthesis requires Team+, and access simulation requires Growth+. API keys also need the appropriate scope; an insufficient scope or a session-only route returns an authorization error.

This listing describes the MCP tools exposed by the SDK, not every namespace in the underlying Python client. The broader SDK includes administration, ingestion, policy, billing, audit, and connector-management APIs, but those capabilities are not listed as MCP tools here.