Tools Gateway

Tools Gateway connects your MCP servers to one Nexus endpoint. Each app uses a Nexus client API key, and you decide which tools that key can use.

MCP (Model Context Protocol) lets AI apps use tools, such as a document search or an issue tracker. Add each server once in Nexus, then connect your apps to Nexus instead of setting up each server in every app.

Plan access

Add an integration

An integration is a connection to one MCP server. Select the machine that will run or connect to the server, then open Tools Gateway > Integrations > Add integration.

Give the integration a name and choose a connection type.

Remote MCP endpoint

Use this for a server that provides a Streamable HTTP endpoint.

1. Select Remote MCP endpoint.
2. Enter the server's MCP URL.
3. If the server requires authentication, enter its Request headers, one NAME=value per line. For example: Authorization=Bearer <server-token>.
4. Select Add integration.

Use the MCP URL supplied by the server. The URL cannot contain credentials, query parameters, or a fragment. Put credentials in the request headers.

Local MCP command

Use this for a server that runs as a local process and communicates through standard input and output (stdio).

1. Select Local MCP command.
2. Enter the server's Command and Arguments, with one argument per line.
3. Add any required Environment variables, one NAME=value per line.
4. Select Add integration.

The command and its dependencies must be available on the selected Nexus machine. Nexus starts the command when it discovers or runs a tool.

After discovery, check Available tools. Nexus prefixes each tool name with its integration ID. For example, search from an integration with the ID docs appears as docs.search.

Give an app access

Client API keys have no tool access by default. To grant access:

1. Open Connections > Client API keys and create or edit the app's key.
2. Under Tool access, choose All tools, or choose Custom to set individual rules if your plan permits it.
3. Save the key. Copy a new key before closing its dialog; it is shown only once.
4. Return to Tools Gateway and copy the MCP address for the connection the app will use.
5. Add that address to the app's MCP settings and authenticate with the Nexus client API key.

The default address for an app on the same machine is:

http://127.0.0.1:3939/mcp

For clients that accept an authorization header, use:

Authorization: Bearer <nexus-client-api-key>

All tools includes every accepted tool from enabled integrations, including tools accepted later. Start with one integration so you can check what the app can access before adding more.

See Client Tokens for key management and Fleet for remote access.

Review new and changed tools

Tools found during an integration's first discovery are accepted automatically. After that, new tools and changes to a tool's description, inputs, or other published details appear under Needs review.

Read the tool's description and inputs, then select Accept. Until accepted, that version is hidden from clients and cannot run. This prevents a server from silently changing the tool instructions an AI app receives.

Set custom rules

Custom rules are included in Pro and Enterprise.

Choose Custom in a key's Tool access settings. Set a rule for an integration, expand it to set rules for individual tools, or use Any other tool for the remaining tools.

A rule for one tool takes priority over its integration's rule. The integration's rule takes priority over Any other tool. A tool with no matching rule or profile rule has no access.

For example, allow an issue tracker's tools, set Ask for creating issues, and Block for deleting them. Nexus follows these rules; it does not decide whether a call is risky.

Ask requires a client that supports MCP approval requests. Clients without this support cannot see or run tools set to Ask.

Hourly limits

Set a calls-per-hour limit beside an Allow or Ask rule. The limit applies to each tool, for each key, over the last 60 minutes.

For example, a limit of 20 on an integration lets each of its tools run 20 times per key. Blocked and declined calls do not count. Leave the limit blank or set it to 0 for no hourly limit.

Tool profiles

Use a profile when several keys need the same rules.

1. Open Tools Gateway > Profiles > Create profile.
2. Name the profile, set its rules, and save it.
3. In each key's settings, select it under Tool profile.

Each key can use one profile. Changes to the profile apply to every key that uses it. A key's own matching rule takes priority over the profile, including a rule for Any other tool. Leave the key's own rules unset where the profile should decide.

Detach a profile from all keys before deleting it.

If you downgrade, saved custom rules and profiles continue to apply. You can remove a profile from a key or simplify its access, but editing custom rules or profiles requires the paid capability again.

Manage integrations

Disable an integration to stop clients from seeing or running its tools. Remove it when it is no longer needed.

Saved credentials stay hidden. When replacing headers or environment variables, enter every value you want to keep. Changing a remote URL clears its saved headers; replacing a local command or its arguments clears its saved environment values. Enter the credentials again for the new destination.

Check activity

Open Tools Gateway > Activity to see which tool ran, which client key called it, its result status, and how long it took. Filter by tool activity status, integration, client key, or time.

Activity records approval decisions and error codes. Nexus does not retain tool arguments, tool results, or credentials in this history.

If a tool is missing or a call fails:

• No tools appear: Check that the integration is enabled and the client key has tool access.
• Needs review: Review and accept the tool in Integrations.
• Approval is unsupported: Use a client that supports MCP approval requests for tools set to Ask.
• Limit reached: Wait for earlier calls to leave the 60-minute window, or adjust the rule's limit.
• Integration unavailable: Check its URL or local command and any required credentials.