---
title: MCP Server
description: Connect AI agents to your Gates rules engine and decision logs over MCP.
---

> The Gates MCP server is an early alpha release. Tools, parameters, and headers may change in backwards-incompatible ways without notice while we iterate on the design. Available to Pro plan customers.

The Gates MCP server lets an AI agent connect directly to your account so it can list gates, inspect rules, browse decision logs, and (optionally) edit rules. It speaks the [Model Context Protocol](https://modelcontextprotocol.io) over streamable HTTP.

A typical use case: ask an agent *"why did this signup get blocked?"* — it calls `list-decision-logs` filtered by email, fetches the full entry with `get-decision-log`, and explains which rule matched and why.

### Endpoint

```bash
https://app.usercheck.com/mcp/gates
```

Transport is streamable HTTP. There is no SSE-only or stdio variant.

### Authentication

Send your Pro account API key as a Bearer token. Use the same key you use for the [Decision Endpoint](/docs/gates/decision-endpoint).

```bash
Authorization: Bearer <YOUR_API_KEY>
```

The key determines both the account *and* the environment the server operates in (production, staging, or development). To work with a different environment, use a key issued for that environment.

MCP tool calls are not counted against your monthly API quota.

### Read vs write mode

By default the server only exposes read tools. To expose the write tools (`add-rule`, `update-rule`, `reorder-rules`), set the `Gates-Mode` header to `write`:

```bash
Gates-Mode: write
```

Omit the header — or set it to `read` — to keep the connection read-only. This is the recommended default for agents that should only observe.

### Connect from Claude Code

Add the server with `claude mcp add`:

```bash
claude mcp add --transport http usercheck-gates \
  https://app.usercheck.com/mcp/gates \
  --header "Authorization: Bearer <YOUR_API_KEY>"
```

To enable write mode, add a second header:

```bash
claude mcp add --transport http usercheck-gates \
  https://app.usercheck.com/mcp/gates \
  --header "Authorization: Bearer <YOUR_API_KEY>" \
  --header "Gates-Mode: write"
```

Or add the entry directly to your `.mcp.json`:

```json
{
  "mcpServers": {
    "usercheck-gates": {
      "type": "http",
      "url": "https://app.usercheck.com/mcp/gates",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>",
        "Gates-Mode": "write"
      }
    }
  }
}
```

Verify the connection with `claude mcp list`. The agent will then see the tools described below.

### Read tools

- `list-gates` — list all gates in the account and environment.
- `get-gate` — fetch a gate and its ordered rules.
- `list-decision-logs` — browse recent decisions for a gate, with filters and a 24h / 7d / 30d window.
- `get-decision-log` — fetch a single decision with its full input and evaluated data.

### Write tools

Only available when the `Gates-Mode: write` header is set.

- `add-rule` — append a new rule to a gate.
- `update-rule` — replace the fields of an existing rule.
- `reorder-rules` — reorder a gate's rules.

### Error responses

- `401`: missing or invalid bearer token
- `403`: account is not on a Pro plan
- `429`: standard API rate limit exceeded