Getting started

Quickstart

This page shows the shortest path to putting an existing MCP server behind AvertGate. Tool calls and results are processed on your machine.

For customers and proof-of-concept partnersAvertGate is sold to enterprises; the CLI is provided when your demo and proof of concept begin. This quickstart is the path your engineer follows then.

1. Create the starter files

npx @avertgate/cli init

The command writes two files to the current folder: a sample policy.yaml and a .env for settings.

2. Edit the policy

The policy says which tools the agent may call. A tool that is not listed is denied, so the tool names here must match the tools your upstream MCP server really exposes. The example below matches the filesystem server started in step 3:

agent: quickstart-agent

tools:
  - name: "read_text_file"    # read-only: free
    allow: true
  - name: "list_directory"    # read-only: free
    allow: true
  - name: "write_file"        # write: human approval
    allow: true
    require_approval: true
  - name: "move_file"         # irreversible-ish: denied
    allow: false

defaults:
  unlisted_tools: deny
  fail_closed: true

3. Start the gateway

Point UPSTREAM_COMMAND at your real MCP server:

UPSTREAM_COMMAND="npx" \
UPSTREAM_ARGS="-y @modelcontextprotocol/server-filesystem /tmp" \
npx @avertgate/cli start

Using another MCP server?Replace the tool names with the ones your server lists. Any tool you forget is denied, which is the intended fail-safe.

4. Point your client at AvertGate

In your MCP client's configuration (agent framework, IDE, etc.) reference the AvertGate process instead of the real server. Every tool call now passes through the policy check, the inspectors and the audit log.

5. Verify

npx @avertgate/cli verify    # verify chain integrity
npx @avertgate/cli report    # executive summary

Try it in shadow firstIf you don't want to block live traffic yet, start with --shadow. Decisions are made and recorded but no call is stopped. See Shadow mode.