Ask about an internal API response
Read an order or service status through a narrowly allowed route. The AI receives the response while GateRook attaches the required authentication.
APIs & logs · MCP integration
Connect your HTTP API to AI without handing over its API key.
Expose a selected HTTP service through an MCP endpoint. GateRook adds the connection’s authentication, constrains destinations and paths, and separates read requests from requests that need approval. Use it for internal APIs or services with an HTTP interface.
Connection in GateRook
stage-api
HTTP API
stage / QA- Name / environment
- stage-api / stage
- Base URLs
- https://api.stage.internal
- Allowed paths
- /v1/orders/**
- Credentials type
- bearer
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Fetch order 48213 from the stage API and report its status. Do not retry or modify it.
http_get · arguments
{
"connection": "stage-api",
"path": "/v1/orders/48213"
}Example result
{
"status": 200,
"ok": true,
"method": "GET",
"url": "https://api.stage.internal/v1/orders/48213",
"json": {
"id": 48213,
"status": "pending",
"total": "149.00"
},
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with HTTP API and AI
Compare API and database state
Expose an API connection alongside a read-only database connection to investigate differences between the application view and stored records.
Review a proposed service change
Use http_request for a supported write method. GateRook shows the actual request for approval before sending a permitted mutation.
From service to MCP
How to connect HTTP API
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select HTTP API. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Choose an API scope and credential
Identify the HTTPS base URL and the specific routes needed for the task. Obtain a service credential with appropriately limited permissions and identify any GET routes that change state.
Configure the HTTP connection
Open Connections, choose Add connection and HTTP API. Set base URLs and allowed paths. Select the authentication type and enter its token, API key or password in the connection form.
Set transport and test behavior
Use the server’s TLS configuration, adding a private CA when necessary. Configure a safe test path. Test connection may identify required network allowlist or certificate settings for you to review.
Test and choose the exposed tools
Run Test connection, then finish Add to endpoint. Expose http_get for reads. Enable http_request only when you intend to review actions that may change service state.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure HTTP API in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Name / environment | stage-api / stage | Choose HTTP API in Connections. |
Base URLs | https://api.stage.internal | Requests must remain under a configured base URL, including any base path. |
Allowed paths | /v1/orders/** | Path globs restrict which routes the agent may access. |
Credentials type | bearer | Supported modes: none, bearer, API key in a header, API key in the query, and basic authentication. |
Token | Enter in GateRook (write-only) | The gateway adds Authorization. The agent does not need to supply the service token. |
GET paths that change state | /v1/orders/*/retry | Mark side-effecting GET routes. http_get refuses them; http_request requires approval. |
Test path | /v1/orders?limit=1 | Use a safe GET or HEAD path for the connection test. |
Know what you expose
HTTP API tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
http_get | Send GET or HEAD to permitted routes with authentication supplied by GateRook. Off by default on prod. | Read only |
http_request | Send a supported HTTP method. Requests classified as mutations require approval. | Approval |
Before you enable access
- Allowed base URLs and paths constrain destinations. This connector is not an unrestricted web browser or arbitrary network proxy.
- A GET route is not automatically harmless: configure any known side-effecting GET paths explicitly.
- Production disallows query-string API keys, plain HTTP and same-origin redirect following. Redirect following is off by default.
- HTTP response size and execution limits apply. The remote service’s credential permissions remain authoritative.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
HTTP API connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Can I connect an API without a dedicated MCP server?
Yes. GateRook’s HTTP connector exposes generic HTTP tools over MCP and adds the configured service authentication. Define the permitted base URLs and paths before connecting the AI app.
Can I create named tools from an OpenAPI definition?
The core supports OpenAPI templates for an existing HTTP connection, but this desktop build does not yet offer OpenAPI import in Connectors. The setup in this guide uses the available http_get and http_request tools.
Can the agent see my API key?
The configured secret is added by GateRook when it sends the request. Do not put it in the prompt or tool arguments. Response content is still service data, so expose only routes appropriate for your AI app.
What happens to a GET endpoint that changes data?
Add its path to GET paths that change state. http_get will refuse it, and an otherwise permitted http_request requires human approval.
Keep exploring
Connect the rest of your stack
MySQL
Connect MySQL to an MCP-compatible AI app with GateRook. Explore schemas, run read-only SQL, review changes and keep database credentials out of prompts.
Loki
Connect Loki to AI through MCP. Search and follow scoped logs with GateRook, using native queries, bounded time ranges and private credentials.
MCP servers
Put an existing stdio or Streamable HTTP MCP server behind GateRook. Review discovered tools, configure secret injection, choose endpoint modes and audit calls.
Your infrastructure, on your terms
Bring HTTP API into the conversation.
Start with one connection. Choose what your AI can do.