Loading Gatelion
GatelionDocs
Open the console

Quick start

This guide takes you from a new account to an agent call that a colleague approves. You can follow it as it is: it uses JSONPlaceholder, a public test API that needs no sign-in and has no OpenAPI description. Nothing you send it is really saved. Creating a post returns a made-up post with the id 101.

Each step is short and links to a page with the details.

In the console, Get started follows the same steps for the environment you're in, and ticks each one off as you finish it. It's the first page you see after signing up, and it stays in the menu, with your progress, until you're done or click Hide this guide. After that, the console opens on the Dashboard.

You need:

  • A colleague with their own email address, who will approve the agent's request. You can't approve requests from an agent you own.
  • Claude Code, or another MCP client that can send custom headers.

1. Create your account

  1. Sign up. Gatelion is free to use. On the sign-up page, enter your organization's name, your name, your email and a password of at least 8 characters, with an upper and a lower case letter, a number and a symbol, twice. The page ticks off each rule as you type. If the page shows a box to agree to the Terms of Service and Privacy Policy, tick it. Click Create account. You become your organization's administrator.
  2. Confirm your email. Open the link in the email, or open the confirmation page and enter the code from the email. Enter your password and click Confirm and sign in. The link and code work for 24 hours.
  3. Set up a second factor. Admins must have one, so the console opens your Account page. Click Add an authenticator app or Add a passkey. Save the recovery codes it shows you once, then click I've saved them.

The console then opens Get started. Your organization starts with one environment, Production, and everything below happens in it. More about this in Sign-in security and Organizations, environments and roles.

2. Add a hosted Gateway

JSONPlaceholder is on the internet, so Gatelion can run the Gateway for you, with nothing to install.

  1. Open Gateways and click Add Gateway.
  2. Under Where it runs, choose Hosted by Gatelion. If the dialog also asks Which agents connect, keep Your own agents, with agent tokens.
  3. Enter a Name, for example hosted, and click Add Gateway.

The new row shows the Gateway's MCP address, with a copy button, and Being set up by Gatelion… until the Gateway is ready, which takes a few seconds. You need the address in step 9. An organization usually has one hosted Gateway, so if you already have one, use it. Details: Gateways.

3. Add a connection

A connection tells the Gateway where the system is and how to sign in to it.

  1. In Tools & agents → Connections, click Add connection.
  2. Enter the Name jsonplaceholder and the Address https://jsonplaceholder.typicode.com.
  3. Under Called by, choose your hosted Gateway, shown as hosted (hosted by Gatelion).
  4. Under How the Gateway signs in, choose No sign-in.
  5. Leave the other fields as they are, and click Add connection.

Details: Connect a system.

4. Describe the operations

JSONPlaceholder has no OpenAPI description, so you describe the two operations the agent may use. On the connection's row, click Import API description. Under Description, choose Describe the operations, and set the System key to posts. Every tool id of this connection starts with it.

  1. Get post, by hand. Click Add operation. Enter the Name Get post, keep the Method GET, and set the Path to /posts/{id}. Under Path parameters, id appears on its own: change its kind to Whole number. Leave Tool id empty, so it's made from the name: get_post.

  2. Create post, from a curl command. Click Paste a curl command, paste this command and click Add the operation:

    Terminal
    curl -X POST https://jsonplaceholder.typicode.com/posts \
  -H 'Content-Type: application/json' \
  -d '{"title":"Hello","body":"First post","userId":1}'

    The command is only read, never run. The console adds a POST operation for /posts, with the body fields title and body (text) and userId (whole number).

  3. Rename it. The new operation is named after its request, POST /posts, and its Tool id is post_posts. Change the Name to Create post and the Tool id to create_post. Do it now: a tool id can't change once it's imported.

  4. Preview and import. Click Preview. Check that the list shows posts.get_post as a read and posts.create_post as a write, both new. Click Import.

The connection now shows Described here. Details: If your API has no OpenAPI description.

5. Add the tools

Agents can only use the operations you add as tools. In Tools & agents → Tools, click Add tools. Choose the connection jsonplaceholder, tick Get post and Create post, and click Add selected tools. Details: Tools.

6. Write a policy

Until you save a policy, every call is denied. Open Policies and click Write a policy. The editor opens with one blank rule. Build these two rules, in this order:

OrderNameToolsConditionsThen
1read-postsGet postnoneAllow
2new-postCreate postnoneNeeds approval
  1. The first rule. In the blank rule's card, replace its name with read-posts. Under Tools, click Choose and tick Get post. Leave Then on Allow.
  2. The second rule. Click Add rule → Blank rule. Name it new-post, choose Create post under Tools, and set Then to Needs approval. Who confirms stays Your approvers.
  3. Save. Click Review and save, check the two rules it lists as added, and click Save as version 1.

Leave Agents empty, so the rules apply to every agent. Any other call falls through to Otherwise: Deny. Details: Write a policy.

7. Invite an approver

You're going to own the agent, issue its token, and let it act for you. Each of these means you can't approve its requests, so a colleague has to.

In Tools & agents → People, click Invite person. Enter your colleague's email and name, keep the Role Approver and the Environment Production, and click Send invitation. They get an email with an invitation code, set their own password, and set up their own second factor when they first sign in. Get started ticks this step off once they've accepted. Details: People and invitations.

8. Create an agent and its token

  1. Create the agent. In Tools & agents → Agents, click Create agent. Name it posts-agent, tick yourself under May act for, and click Create agent.
  2. Issue a token. On the agent, click Issue token, then Issue token again. Copy the token: it's shown only once.
  3. Copy your user id. In Tools & agents → People, copy the value in the User id column of your own row.

Details: Agents and tokens.

9. Connect Claude Code

On the Gateways page, copy your hosted Gateway's MCP address. Then, in a terminal, make a folder for the agent and add the Gateway as an MCP server:

Terminal
mkdir -p ~/posts-agent && cd ~/posts-agent
read -rs "TOKEN?Agent token: "; echo     # zsh; in bash use: read -rsp "Agent token: " TOKEN; echo
claude mcp add --scope project --transport http gatelion <MCP address> \
  --header "Authorization: Bearer $TOKEN" \
  --header "X-Gatelion-On-Behalf-Of: <your user id>"
unset TOKEN
chmod 600 .mcp.json

The token is now stored in .mcp.json in that folder, so keep the folder out of your repositories. Start claude in the folder from a terminal, trust the folder, approve the gatelion server, and run /mcp to check that it shows as connected. Details: Connect an MCP client.

10. Ask the agent

Ask Claude Code:

Text
Get post 1. Then create a post titled "Hello" with the body "First post" for user 1.

If Claude Code asks whether it may use a tool, allow it.

  • posts.get_post runs at once and returns Succeeded, with post 1.
  • posts.create_post comes back Waiting for approval, with an execution_id. Nothing has been sent to JSONPlaceholder yet.

11. Approve it

Your colleague signs in and opens Approvals, where the request is in the Waiting list. They select it and see the exact values the agent sent, and that rule new-post of policy version 1 needs the approval. They click Approve this operation. Within a few seconds, the Gateway checks the request again with the Control Plane and sends it to JSONPlaceholder, once.

If you open the request yourself, the console tells you why you can't decide it. Details: Decide approvals.

Then ask the agent to check on the post it created. It calls get_execution_status and gets Succeeded, with the new post, id 101.

12. See it in the audit trail

Open Executions & audit. Both calls are listed. Select posts.create_post to see the result, who approved it under which rule, and the timeline: from Agent asked; waiting for a person through Approved and Re-checked and released for execution to Sent to the system and Completed. The top of the page shows whether the audit chain is intact. Details: Executions and audit.

Get started now says All done. Your agents are governed., and leaves the menu.

When you're done trying, revoke the agent's token under Tools & agents → Agents, and delete .mcp.json.

Next

Still stuck? Contact support from the console.