# Organization gateway

The organization gateway is one MCP URL for the whole organization, shown in the dashboard as **Organization Gateway**. A person adds it to Claude, Cursor, or any other MCP client, signs in once with their Speakeasy account, and reaches every MCP server they have access to, across all projects. As their access changes, so does what they see. People no longer add servers one at a time or keep that list in step with their access.

The organization gateway works like a [gateway endpoint](/docs/ai-control-plane/mcp-gateway/gateway-endpoints) and serves the same tools: agents discover member servers with `list_servers`, `describe_server`, and `describe_tools`, call them with `execute_tool`, and check pending sign-ins with `connection_status`. The difference is that there is nothing to create or maintain. Its members follow each person's access.

## Access requirements

> Any member of the organization can use the organization gateway. Looking up its URL through the API or the [Platform MCP](/docs/ai-control-plane/reference/platform-mcp) requires the `org:read` scope. Which servers each person reaches depends on their own access, as described in [Which servers a person reaches](#which-servers-a-person-reaches).

## Find the Organization Gateway

The **Organization Gateway** card sits at the top of the server list under [**MCP Gateway > MCP**](https://ai.speakeasy.com/@self/projects/default/mcp), next to any gateway endpoints the organization has created.

![The Organization Gateway card on the MCP Servers page, beside a gateway endpoint](/assets/docs/ai-control-plane/mcp-gateway/organization-gateway-card.webp)

Click **Open** on the card to see the gateway's endpoint URL. Under **Install**, choose an agent to see its setup steps. The URL takes the form `https:///mcp/gateway/`.

The URL is also available in two other places:

- On a device enrolled in the [device agent](/docs/ai-control-plane/reference/device-agent), the menu bar app links to the organization gateway.
- In an agent connected to the [Platform MCP](/docs/ai-control-plane/reference/platform-mcp), asking for the organization gateway URL returns it, or the reason the organization has none.

## Connect an MCP client

The first time a client connects, it opens a browser to sign in. In the examples below, replace the URL with the organization's gateway URL.

### Claude Code

Run this command, then open `/mcp` in Claude Code and choose **Authenticate**:

```bash
claude mcp add --transport http --scope user \
  'speakeasy' \
  'https://<organization host>/mcp/gateway/<organization slug>'
```

### Claude

On Team and Enterprise plans, an Owner adds the connector for the organization under **Organization settings > Connectors** by choosing **Add > Custom > Web** and pasting the gateway URL. Each person then opens **Settings > Connectors** and clicks **Connect** to sign in.

On Pro and Max plans, each person opens **Settings > Connectors > Add custom connector** in Claude on the web or desktop and pastes the gateway URL.

### Cursor

On the **Organization Gateway** page, choose **Cursor** under **Install**, then click **Add to Cursor** to add the gateway to Cursor's MCP settings in one step.

### OpenAI Codex

Run these two commands. The second one signs in:

```bash
codex mcp add 'speakeasy' \
  --url 'https://<organization host>/mcp/gateway/<organization slug>'
codex mcp login 'speakeasy'
```

Any other MCP client that supports remote servers connects the same way: add the URL as a remote MCP server and sign in when prompted.

## Which servers a person reaches

The gateway works out its members each time it is called, from the person's live access:

- Every MCP server in the organization the person can connect to is a member. That covers public servers and servers where the person holds the `mcp:connect` scope through [team access](/docs/ai-control-plane/mcp-gateway/access/team-access) or their [role](/docs/ai-control-plane/org-admin/roles-and-permissions).
- Members come from every project. Each one is named `project.server`, so servers with the same name in two projects stay distinct.
- Access changes take effect on the next call. Granting someone access to a server adds it to their gateway, and removing access takes it away. Nothing needs to be edited on the gateway itself.

## Sign-in and upstream connections

Only people sign in to the organization gateway. API keys, agent keys, and workload identities are refused. Agents that run without a person should connect to a server's own URL or to a [gateway endpoint](/docs/ai-control-plane/mcp-gateway/gateway-endpoints) instead.

Servers that need their own upstream OAuth grant, such as a SaaS service, still need each person to connect them once. Until they do, calls to that server fail while the rest of the gateway keeps working. People can ask their agent to check the connection status, as described in [Check which members are connected](/docs/ai-control-plane/mcp-gateway/gateway-endpoints#check-which-members-are-connected). Upstream credentials stay with the project that owns each server, so a person connects each service the same way they would on the server directly.

## Turn the gateway off

An admin can turn the organization gateway off with the **Enabled** switch at the top of the **Organization Gateway** page.

![The top of the Organization Gateway page, with the Enabled switch on the right](/assets/docs/ai-control-plane/mcp-gateway/organization-gateway-header.webp)

## When the Organization Gateway is missing

The organization gateway signs people in through a [Speakeasy authorization server](/docs/ai-control-plane/mcp-gateway/access/user-sessions#shared-authorization-servers) that belongs to the whole organization rather than to one project. Organization admins can see these under **Organization settings > Speakeasy Authorization Servers**.

The **Organization Gateway** card doesn't appear when the organization has no organization-level Speakeasy authorization server, or has more than one. Deleting that authorization server also removes the gateway. The gateway is served on the organization's platform host, not on a [custom domain](/docs/ai-control-plane/org-admin/custom-domain).

## Organization gateway or gateway endpoint

| | Organization gateway | Gateway endpoint |
| --- | --- | --- |
| Setup | None | Created by an admin in a project |
| Members | Every server the person can reach, in every project | Servers an admin adds |
| Who can sign in | People only | Set by the gateway's own authentication and team access |
| Settings | On or off | Custom instructions, team access, authentication, addresses |

Use the organization gateway as the default URL for people in the organization. Use a gateway endpoint when a team needs a curated set of servers, its own instructions, or access for agents that run without a person.

---

Index of every Speakeasy page for agents: [llms.txt](https://www.speakeasy.com/llms.txt). AI control plane and MCP gateway content in one file: [llms-full.txt](https://www.speakeasy.com/llms-full.txt). Any page is available as markdown by appending `.md` to its URL or by requesting it with `Accept: text/markdown`.