New to Eviduct? Try the real protected MCP gateway immediately with a free, short-lived test tenant. No merchant account or customer data required.

One endpoint. Only the tools you approve.

Connect Eviduct as your AI host's remote MCP server. First approve each upstream public-data tool, then connect through one protected URL and remove the original direct MCP connections.

Protected Streamable HTTP serverhttps://eviduct-mvp.onrender.com/mcp/gateway
What a catalog install cannot do. Installing Eviduct does not intercept or reroute unrelated MCP integrations. The host creates an independent client for each MCP server. The protected path is effective only for approved tools accessed through this URL.

Set up the trust boundary once.

The gateway supports several tenant-approved routes behind one MCP endpoint, but it does not approve untrusted services automatically.

01

Get management access

Request an evaluation. The operator provides a company management key. Paid self-service is only available after Stripe is configured.

Request an evaluation
02

Approve an upstream tool

In the console, inspect an HTTPS MCP endpoint. Pick the exact tool and manually approve the narrow read-only input contract.

Open gateway console
03

Issue an agent identity

For Codex and Claude Code, create a separate revocable evg_ token. For ChatGPT custom MCP, use the OAuth consent flow.

04

Replace direct connections

Remove original provider entries. If the AI host still sees the direct MCP tool list, Eviduct is not your exclusive trust boundary.

Client / 01

OpenAI Codex

Codex CLI and its supported editor integration can use a remote Streamable HTTP MCP server with bearer-token authentication. Configure the token in your own environment, not a repository.

After adding Eviduct, remove the original provider entries from your Codex MCP configuration. The host will then discover the neutral tools from Eviduct instead of provider-written descriptions.

Codex MCP documentation
~/.codex/config.toml
[mcp_servers.eviduct_trust]
url = "https://eviduct-mvp.onrender.com/mcp/gateway"
bearer_token_env_var = "EVIDUCT_GATEWAY_TOKEN"
Check the connectioncodex mcp list

Set EVIDUCT_GATEWAY_TOKEN to the separately issued evg_ token before starting Codex.

Client / 02

Claude Code

Register the remote HTTP server and send your separately issued bearer token. The gateway serves every route approved by your team under a neutral tool name.

Keep the token in a local secret store and remove untrusted direct provider MCP connections from Claude Code.

Claude Code MCP documentation
Shell command
claude mcp add --transport http eviduct-trust \
  https://eviduct-mvp.onrender.com/mcp/gateway \
  --header "Authorization: Bearer $EVIDUCT_GATEWAY_TOKEN"
Check the connectionclaude mcp list

The EVIDUCT_GATEWAY_TOKEN environment variable must be defined in the shell that registers the server.

GitHub Copilot

Use the repository's portable MCP configuration or your Copilot MCP server settings. The authenticated HTTP gateway requires a tenant-issued evg_ token, supplied through a Copilot-managed secret or environment variable, not committed to Git.

For GitHub-hosted Copilot, register a secret whose name begins with COPILOT_MCP_. Copilot supports an environment substitution reference in the Authorization header. Remove original direct provider MCP server entries.

GitHub Copilot MCP documentation
.mcp.json / MCP server configuration
{
  "mcpServers": {
    "eviduct": {
      "type": "http",
      "url": "https://eviduct-mvp.onrender.com/mcp/gateway",
      "headers": {
        "Authorization": "Bearer ${COPILOT_MCP_EVIDUCT_GATEWAY_TOKEN}"
      },
      "tools": ["*"]
    }
  }
}
Where the token livesCOPILOT_MCP_EVIDUCT_GATEWAY_TOKEN

Use a supported Copilot environment/secret reference. The token is issued only after your tenant's read-only tool routes have been approved.

Client / 03

ChatGPT custom MCP

Eligible ChatGPT workspaces can create a custom remote MCP connection using OAuth. Eviduct issues resource-bound, revocable access and refresh tokens after your company management key authorizes the connection.

Availability and publishing depend on ChatGPT workspace permissions. This is a custom MCP connection, not a claim that Eviduct is already published in the public plugin directory.

ChatGPT official setup instructions
Custom MCP server URL
https://eviduct-mvp.onrender.com/mcp/gateway
  1. Open ChatGPT Plugins and add a custom MCP server, if your workspace allows it.
  2. Enter the protected HTTPS URL above and select OAuth authentication.
  3. Complete the Eviduct consent page using your partner management key, then scan tools.
  4. Review the approved tool list before enabling or publishing. Remove equivalent direct MCP integrations.
OAuth discovery/.well-known/oauth-protected-resource/mcp/gateway

Client authorization never gives the model permission to add or approve new routes.

Installation is finished when the boundary is real.

The test is not just whether a status indicator says “connected”. Inspect your agent's actual tool inventory and verify that untrusted provider descriptions are gone.

01

Approved-only inventory

The host sees tool names beginning with evd_ and human-authored input contracts, not the provider's own descriptions.

02

Single route to provider

The original provider MCP connection has been removed or disabled in the host. Otherwise the model can bypass Eviduct.

03

Policy denial

An unexpected field or changed upstream schema fails before the upstream tools/call. Review the reason in your tenant's dashboard.

04

Measurable calls

Allowed, denied and failed requests appear in the tenant's 30-day operational report. No semantic correctness score is invented.

Open private configurationRun the public verification