Published tools
1 toolsearch
A smaller catalog gives the model a focused starting point. Calls are checked again.
Gateway Lab / A focused permission boundary
Pick the tools
for the task.
An agent choosing music can search without controlling the room. A host can build a queue while leaving the volume alone.
I built PanelForge’s gateway to make those boundaries explicit: which tools a resource publishes, what a user may do, and which account the backend receives.
Explore the recorded requestsActual gateway execution · fictional services · 14 October 2026
Recorded execution / interactive replay
The right tools
for this task.
Choose a fictional task. Try an action. Inspect the actual gateway’s response from the local test.
The gateway boundary
Ready to replayWhat should this task be able to do?
Find tracks, then try to add one. The second action is outside the Scout’s published tool set.
Observed response—
Upstream tool calls—
Backend user—
The request also claims to be someone else.
The recorded request supplies _meta.user_id: 202. The authenticated caller is user 101. On an allowed call, the gateway replaces that claim before forwarding.
These controls replay recorded results. The full archived gateway ran locally; auth answers, user records, permission settings and music operations were fictional fixtures. Nothing plays, changes volume or calls a live service here.
With JavaScript off, use the captured request transcript and receipt below.
Inspect this recorded request Choose an action first
Sent to the gateway
Choose an action to see its actual request.
Returned to the caller
Choose an action to see its actual response.
The local backend counted every tool call.
Complete captured transcriptA native profile has a different boundary Explore the actual fallback behavior
Profiles curate the catalog.
User policy still decides access.
The same /mcp/task URL resolved to different native tools for two fictional users. The actual MCP server registered only those tools. A guessed off-profile tool did not run its handler.
Unknown profile names fall back to the master catalog. A failed fresh profile lookup does too. A failed fresh permission lookup blocks tool execution. That distinction matters.
Select a recorded native request.
Explore its catalog or execution result.
What ran, what was substituted 17 asserted requests · actual source
The actual gateway
- Complete archived Express gateway entrypoint
- Sanctum verifier, dispatch and MCP SDK bearer middleware
- Resource scope middleware
- PermissionCache and metering middleware
- Proxy catalog allowlist and call rejection
- Gateway-authored user metadata overwrite
- Native MCP profile registration and tool handlers
- Source
40185b05486ff5c3ed8c6b1ff6f7653851f4080c- Source tag
- v5.11.24
- Observed run
- 2026-10-14 21:59:25 UTC
- Verification
- 17 asserted HTTP/MCP requests. 65 existing tests passed across 6 suites. Gateway exited 0.
The local substitutes
- Laravel token verification answers
- Laravel profiles, permissions, budgets and user records
- Music backend and all provider actions
- Usage ingestion endpoint
Scope of this proof
No real credentials, private catalog, external provider, production Redis or notification delivery. The fixture used an explicit loopback request allowlist. Caller bearer tokens were absent at the fake music backend.
OAuth consent and issuance, real provider credential lookup, batch identity isolation, native engine permissions and cache refresh timing were outside this run.
The public receipt keeps tool-call response bodies and counters. Catalogs are shortened to actual tool names, with hashes of the raw recorded catalog responses.
Recorded receiptBrowser recording / replay of executed evidence
Four attempts at the boundary
One gateway, several distinct checks
A tool list is only
the beginning.
A curated resource helps the model start with useful tools. The gateway also checks the caller’s resource scope and per-user policy before forwarding an allowed tool. For a user-aware resource, the authenticated identity replaces a client-supplied account claim.
The complete committed gateway entrypoint ran in an isolated local fixture. The interaction above replays its actual results. Native profile behavior is explored separately, including the current fallback to the master catalog.