MCP gateway

One gateway. Every tool.

You connect to us. We connect to your customers’ tools — and secure the access.

Launches August 17, 2026

How it works

Two steps to ship. We handle the rest.

01Step one

Register your agents.

Name the app your agents run under and pick the scopes it may ever ask for — one form, one-time secret, no provider paperwork.

Name it

An app id and a display name.

Pick scopes

Per tool, from the catalogue.

Activate

One-time secret, then it is live.

afctl applications register --app-id my-agent

console

Agents

Every agent your org has registered with Fabriq

02Setup · step two

Integrate with AF.

Mint a token for your own user ID, then call tools through the gateway. The Python SDK is the shipping client.

Python SDKagent.py

# pip install agentic-fabriq-sdk
from af_sdk import MCPClient

token = await af_client.get_mcp_token(
    external_user_id="customer_8842",
)

async with MCPClient(
    method="token",
    app_id=AF_APP_ID,
    app_secret=AF_APP_SECRET,
    af_token=token["access_token"],
    gateway_url=AF_GATEWAY_URL,
) as client:
    await client.call_tool(
        "gmail_send_email",
        {"to": "bob@example.com", "subject": "Hi"},
    )

Drag into your coding agent

Claude Code · Cursor · Codex

coming soon

Integrate Agentic Fabriq (B2B2C) into this codebase.

Install: pip install agentic-fabriq-sdk
Env: AF_API_URL, AF_APP_ID, AF_APP_SECRET, AF_GATEWAY_URL

Build three paths, in this order:

1. Connect a tool for one of our users
   POST {AF_API_URL}/api/v1/apps/{AF_APP_ID}/external-users/{our_user_id}/oauth/{provider}/initiate
   headers: X-App-Id, X-App-Secret
   body: {"connection_id": "<our_user_id>-<provider>", "scopes": [...]}
   redirect the user to the returned oauth_url.

2. Mint a per-user MCP token (server-side only)
   POST {AF_API_URL}/api/v1/apps/{AF_APP_ID}/external-users/{our_user_id}/token
   -> {"access_token": "...", "expires_in": 3600}

3. Call tools as that user
   from af_sdk import MCPClient
   MCPClient(method="token", app_id=..., app_secret=..., af_token=...,
             gateway_url=AF_GATEWAY_URL)
   then client.list_tools() and client.call_tool(name, arguments).

Rules:
- Never store provider access or refresh tokens in our database. Fabriq vaults them.
- The only user identifier we send is our own user ID.
- Keep AF_APP_SECRET server-side; never ship it to a client.
- Treat a 401 from the gateway as "mint a new token", not "re-run OAuth".

POST/oauth/{provider}/initiateConnect a tool

GET/connectionsWhat they connected

POST/tokenMint a scoped token

POST/connections/{id}/disconnectRevoke

/api/v1/apps/{app_id}/external-users/{user}

03Everything else