Quick start

Overview

This guide will help you install the Secure MCP Gateway, generate a configuration, and connect it to Claude Desktop with a test echo server. You’ll be up and running in under 10 minutes.

This quick start uses the pip installation method and Claude Desktop as the MCP client. For other installation methods or clients, see the installation guide.

Prerequisites

Before starting, ensure you have:

Python 3.11 or higher - Check with python --version
pip 25.0.1 or higher - Check with pip --version
Claude Desktop - Download from claude.ai/download

If you don’t have these installed, refer to the installation guide for detailed setup instructions.

Step 1: Install the gateway

Create a virtual environment

python -m venv .secure-mcp-gateway-venv

# On macOS/Linux
source .secure-mcp-gateway-venv/bin/activate

# On Windows
.secure-mcp-gateway-venv\Scripts\activate

Install from PyPI

pip install secure-mcp-gateway

This installs the gateway and all dependencies, including the mcp CLI.

Verify installation

secure-mcp-gateway --version

You should see version 2.1.7 or higher.

Step 2: Generate configuration

The gateway uses a JSON configuration file that defines projects, users, servers, and guardrails.

secure-mcp-gateway generate-config

This creates a configuration file with:

Location (macOS): ~/.enkrypt/enkrypt_mcp_config.json
Location (Windows): %USERPROFILE%\.enkrypt\enkrypt_mcp_config.json

The generated config includes a default project, user, API key, and an echo server for testing.

What’s in the config?

The generated configuration includes:

Common settings - Log level, cache settings, telemetry configuration
Default project - Named “default_project” with a unique project ID
Default user - Email “default@example.com” with a unique user ID
API key - A 50-character random string for authentication
Echo server - A test MCP server that echoes back messages

{
  "common_mcp_gateway_config": {
    "enkrypt_log_level": "INFO",
    "enkrypt_use_remote_mcp_config": false,
    "enkrypt_mcp_use_external_cache": false,
    "enkrypt_tool_cache_expiration": 4,
    "enkrypt_gateway_cache_expiration": 24
  },
  "mcp_configs": {
    "<config-id>": {
      "mcp_config_name": "default_config",
      "mcp_config": [
        {
          "server_name": "echo_server",
          "description": "Simple Echo Server",
          "config": {
            "command": "python",
            "args": ["<path-to-echo-server>"]
          },
          "input_guardrails_policy": {
            "enabled": false
          },
          "output_guardrails_policy": {
            "enabled": false
          }
        }
      ]
    }
  },
  "projects": {
    "<project-id>": {
      "project_name": "default_project",
      "mcp_config_id": "<config-id>",
      "users": ["<user-id>"]
    }
  },
  "users": {
    "<user-id>": {
      "email": "default@example.com"
    }
  },
  "apikeys": {
    "<gateway-key>": {
      "project_id": "<project-id>",
      "user_id": "<user-id>"
    }
  }
}

Step 3: Install for Claude Desktop

Connect the gateway to Claude Desktop:

secure-mcp-gateway install --client claude-desktop

This command:

Reads your gateway configuration
Extracts the API key, project ID, and user ID
Updates Claude’s config file at:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json
Configures the gateway as an MCP server

You must restart Claude Desktop after installation for the changes to take effect.

What gets added to Claude’s config?

{
  "mcpServers": {
    "Enkrypt Secure MCP Gateway": {
      "command": "mcp",
      "args": [
        "run",
        "/Users/user/.secure-mcp-gateway-venv/lib/python3.13/site-packages/secure_mcp_gateway/gateway.py"
      ],
      "env": {
        "ENKRYPT_GATEWAY_KEY": "2W8UupCkazk4SsOcSu_1hAbiOgPdv0g-nN9NtfZyg-rvYGat",
        "ENKRYPT_PROJECT_ID": "3c09f06c-1f0d-4153-9ac5-366397937641",
        "ENKRYPT_USER_ID": "6469a670-1d64-4da5-b2b3-790de21ac726"
      }
    }
  }
}

{
  "mcpServers": {
    "Enkrypt Secure MCP Gateway": {
      "command": "mcp",
      "args": [
        "run",
        "C:\\Users\\user\\secure-mcp-gateway-venv\\Lib\\site-packages\\secure_mcp_gateway\\gateway.py"
      ],
      "env": {
        "ENKRYPT_GATEWAY_KEY": "2W8UupCkazk4SsOcSu_1hAbiOgPdv0g-nN9NtfZyg-rvYGat",
        "ENKRYPT_PROJECT_ID": "3c09f06c-1f0d-4153-9ac5-366397937641",
        "ENKRYPT_USER_ID": "6469a670-1d64-4da5-b2b3-790de21ac726"
      }
    }
  }
}

Step 4: Verify the connection

Restart Claude Desktop

Completely quit and restart Claude Desktop.

Check for the gateway

In Claude, look for the MCP server icon (🔌) in the bottom right corner. Click it to see “Enkrypt Secure MCP Gateway” listed.

Test the echo server

Ask Claude: “List all available MCP servers and their tools.”You should see:

Server: echo_server
Tools: send_echo_message

Use the echo tool

Ask Claude: “Use the echo server to send the message ‘Hello, Gateway!’”Claude will invoke the send_echo_message tool through the gateway, and you should receive the echoed response.

If you don’t see the gateway or encounter errors, check the troubleshooting section below.

Step 5: View gateway tools (optional)

The gateway itself provides management tools you can invoke from Claude:

enkrypt_list_all_servers - List all configured MCP servers
enkrypt_get_server_info - Get details about a specific server
enkrypt_discover_all_tools - Discover tools from all servers
enkrypt_secure_call_tools - Execute tools with guardrails
enkrypt_get_cache_status - View cache statistics
enkrypt_clear_cache - Clear cached data

Try asking Claude: “Use the gateway to get cache status.”

What’s next?

Add a real MCP server

Now that the gateway is working, add a real MCP server like GitHub:

secure-mcp-gateway config add-server \
  --config-name "default_config" \
  --server-name "github" \
  --server-command "npx" \
  --args="-y,@modelcontextprotocol/server-github" \
  --description "GitHub MCP Server"

You’ll need to set the GITHUB_PERSONAL_ACCESS_TOKEN environment variable. See the GitHub MCP Server documentation for details.

Enable guardrails

Protect your servers with input and output guardrails:

Get an Enkrypt API key from app.enkryptai.com/settings

Add it to your config:

# Edit ~/.enkrypt/enkrypt_mcp_config.json
# Set "enkrypt_api_key": "your-key-here" in common_mcp_gateway_config

Enable guardrails for a server:

secure-mcp-gateway config update-server-guardrails \
  --config-name "default_config" \
  --server-name "echo_server" \
  --input-policy '{"enabled": true, "policy_name": "Sample Airline Guardrail", "block": ["policy_violation"]}'

Set up monitoring

For production deployments, enable observability:

Run the OpenTelemetry stack:
cd infra docker-compose up -d
Access Grafana at http://localhost:3000
View traces in Jaeger at http://localhost:16686
Check metrics in Prometheus at http://localhost:9090

Troubleshooting

Gateway not showing in Claude

Verify the config file exists:

# macOS
cat ~/Library/Application\ Support/Claude/claude_desktop_config.json

# Windows
type %APPDATA%\Claude\claude_desktop_config.json

Check that the path to gateway.py is correct
Ensure Claude Desktop was restarted (not just the window, but the entire app)
Check Claude’s logs:
- macOS: ~/Library/Logs/Claude/
- Windows: %APPDATA%\Claude\logs\

”Gateway key is required” error

This means the gateway couldn’t find a valid API key. Verify:

The ENKRYPT_GATEWAY_KEY is set in Claude’s config
The key exists in the apikeys section of enkrypt_mcp_config.json
The key matches exactly (no extra spaces or quotes)

Echo server not found

If the echo server doesn’t appear:

Check the config file at ~/.enkrypt/enkrypt_mcp_config.json
Verify the args path points to the actual echo_mcp.py file
Test the server directly:
python <path-from-config>

Python version mismatch

If you see errors about Python versions:

Ensure you’re using Python 3.11+:
python --version
Create a new virtual environment with the correct Python:
python3.11 -m venv .secure-mcp-gateway-venv

Other MCP clients

Cursor

Install for Cursor instead of Claude Desktop:

secure-mcp-gateway install --client cursor

This updates ~/.cursor/mcp.json (or %USERPROFILE%\.cursor\mcp.json on Windows).

Claude Code

For the Claude Code CLI:

secure-mcp-gateway install --client claude-code

This runs claude mcp add to register the gateway.

Learn more

Installation guide

Docker, from source, and advanced installation options

Configuration

Configure servers, guardrails, and advanced settings

CLI reference

Complete command reference for managing the gateway

API reference

REST API documentation for programmatic management

Get Started

Core Concepts

Features

Deployment

Client Integration

Observability

Security

Guides

Overview

Prerequisites

Step 1: Install the gateway

Step 2: Generate configuration

What’s in the config?

Step 3: Install for Claude Desktop

What gets added to Claude’s config?

Step 4: Verify the connection

Step 5: View gateway tools (optional)

What’s next?

Add a real MCP server

Enable guardrails

Set up monitoring

Troubleshooting

Gateway not showing in Claude

”Gateway key is required” error

Echo server not found

Python version mismatch

Other MCP clients

Cursor

Claude Code

Learn more

Installation guide

Configuration

CLI reference

API reference

​Overview

​Prerequisites

​Step 1: Install the gateway

​Step 2: Generate configuration

​What’s in the config?

​Step 3: Install for Claude Desktop

​What gets added to Claude’s config?

​Step 4: Verify the connection

​Step 5: View gateway tools (optional)

​What’s next?

​Add a real MCP server

​Enable guardrails

​Set up monitoring

​Troubleshooting

​Gateway not showing in Claude

​”Gateway key is required” error

​Echo server not found

​Python version mismatch

​Other MCP clients

​Cursor

​Claude Code

​Learn more

Installation guide

Configuration

CLI reference

API reference

Overview

Prerequisites

Step 1: Install the gateway

Step 2: Generate configuration

What’s in the config?

Step 3: Install for Claude Desktop

What gets added to Claude’s config?

Step 4: Verify the connection

Step 5: View gateway tools (optional)

What’s next?

Add a real MCP server

Enable guardrails

Set up monitoring

Troubleshooting

Gateway not showing in Claude

”Gateway key is required” error

Echo server not found

Python version mismatch

Other MCP clients

Cursor

Claude Code

Learn more