MCP Gateway Prerequisites
Complete the following preparation before users connect their AI clients:
- License — The MCP Gateway requires the MCP_GATEWAY license. Without the license, Kron PAM hides the MCP Gateway screens and rejects every request to the gateway endpoint.
- Portal functions — An administrator assigns the portal functions listed in Table 2 to the administrators who manage the MCP Gateway.
- MCP servers and Realms — An administrator registers the MCP servers, adds them to MCP Server Groups, and creates Realms for the user groups that need access.
- Network access — Kron PAM reaches the upstream URL of each registered MCP server, and the workstations that run the AI clients reach the gateway endpoint.
- Gateway endpoint — Obtain the gateway endpoint from your administrator. The endpoint uses the format https://KronPAM_IP_Address:8446/mcp.
Required Portal Functions
Kron PAM controls the administration of the MCP Gateway through the portal functions listed in the following table. Assign the portal functions to user groups through function groups, as with other Kron PAM modules.
Portal Function | Grants Access To | Assign To |
|---|---|---|
kronpam.mcp.server.moduleVisibility | The MCP Servers tab under Devices > Inventory. | Administrators, operators, and viewers. |
kronpam.mcp.server.manage | The Add and Edit Server operations. | Administrators and operators. |
kronpam.mcp.server.delete | The Delete Server operation. | Administrators. |
kronpam.mcp.server.status.manage | The Enable Server and Disable Server operations. | Administrators and operators. |
kronpam.mcp.server.test.connection | The Test Connection operation. | Administrators and operators. |
kronpam.mcp.server.tools.viewer | The View Tools modal. | Administrators, operators, and viewers. |
kronpam.mcp.server.tools.refresh | The Refresh Tools button. | Administrators and operators. |
kronpam.mcp.server.group.manage | Creating, editing, and deleting MCP Server Groups. | Administrators and operators. |
kronpam.mcp.realm.moduleVisibility | MCP Server Groups as Realm resources under Policy > Realms. | Administrators, operators, and viewers. |
kronpam.mcp.realm.manage | Adding, editing, enabling, disabling, and deleting MCP Realms. | Administrators and operators. |
kronpam.mcp.gateway.logs.moduleVisibility | The MCP Gateway Logs page under Logging. | Administrators, operators, auditors, and viewers. |
kronpam.mcp.gateway.logs.content.viewer | The request and response content in the MCP Request Details modal. | Administrators and auditors. |
kronpam.mcp.gateway.logs.export | Exporting the MCP Gateway Logs. | Administrators and auditors. |