WingGate
Menu
EN 中文 Get started
Docs

API and Protocol Reference

This article is a map of WingGate's user-facing protocol surfaces — SSH and MCP — plus the Web Console that manages them. It deliberately stays at the working-overview level and does not repeat field tables, wire schemas or state machines.

Surfaces at a glance

  • SSH Gateway — WingGate's SSH endpoint that accepts SSH client connections. Authentication and authorization happen through the service's control plane; the service itself never listens on SSH TCP, and a connector with SSH Direct enabled has its own local listener.
  • MCP Streamable HTTP — the tool surface for AI agents. The endpoint lives on the wing-connector, not the service: the connector serves it directly and proxies tool traffic to the target over the reverse transport.
  • Web Console — the browser management surface for Organizations, Projects, assets, grants and audit. It is the primary way to administer the service.

Authentication

  • SSH Gateway user authentication supports SSH public keys, keyboard-interactive password + OTP, and Web one-time approval. Plain SSH password method is not supported.
  • MCP clients authenticate with a dedicated credential tied to a Project; the connector pins the credential fingerprint at session initialization and validates every session request.
  • Web session, access token, MCP credential, Agent credential and session stream tokens are distinct classes and are never interchangeable. Reauthentication for sensitive operations uses the reauth flow; one-time secrets appear only in the dedicated creation response.

Authorization model

Two fixed layers, both fail closed:

  • Management plane — the fixed Owner/Admin/Member role matrix governs management actions.
  • Data plane — an active coarse Project access grant for (project, user) is required for every session and every file/MCP operation. Roles never imply data-plane access.

Authorization rules are enforced on the service side for every request; there is no configurable rule engine.

Protocol stability

  • The MCP endpoint announces its protocol version (2025-06-18 at this writing) and its available tools during session setup, so clients discover the concrete tool surface at runtime instead of relying on a static document.
  • Field-level details change with releases; verify them against the endpoint you actually connect to.

MCP protocol notes

  • Protocol version 2025-06-18 over Streamable HTTP. POST accepts application/json and text/event-stream; GET is the SSE stream.
  • Each request carries the Project MCP credential. The wing-connector pins the credential fingerprint at session initialization and validates every session request; authorization happens against the service's control plane.
  • The tool set is filtered by the Project's enabled tool groups and the granted assets — a tool that no granted asset enables is not advertised at all.

Auditing

Every authentication, session, grant change, file operation and MCP call enters a unified audit path. The audit is append-only and organization-scoped; secrets and payload content are excluded by contract.