Bounded infrastructure access for AI agents
Letting an AI agent work on real infrastructure means deciding exactly what it may touch. WingGate exposes a narrow, audited MCP channel instead of handing the agent a login: fixed tool sets, project-scoped grants and a record of every call.
Why agents need a constrained channel
The common shortcut — giving an agent SSH keys or a shell on a jump host — grants it everything the account can do, including lateral movement, and leaves little useful record of which action served which task.
WingGate takes the opposite shape: the agent authenticates with a project-scoped MCP credential, discovers only assets in Projects it is granted, and calls a fixed set of tools whose permissions cannot be widened at runtime.
How it works
-
Issue a credential
An Owner or Admin creates an MCP credential inside a Project. The bearer value is shown once, at creation time, and is stored hashed afterwards.
-
Discover endpoints
The MCP client asks the WingGate API for the authorized assets' connector MCP endpoints. It never talks to the service data plane.
-
Call fixed tools
The client connects to the connector's Streamable HTTP ingress and invokes the tools allowed by the Project/asset MCP configuration — one-shot, non-PTY shell.exec, the file tool group, and browser tools on browser assets.
-
Audit every call
Each initialize and tool call is recorded in the Organization audit view with actor, asset and outcome, so you can reconstruct what the agent did and why it was allowed.
Capability boundaries
These limits are properties of the implementation, not configuration promises:
What the agent can do
- Run one-shot, non-interactive commands via shell.exec within the configured tool set.
- Read, list and search files through the file tool group on granted assets.
- Use typed search (file.find, file.grep) when a Runner is installed on the asset.
What the agent cannot do
- No interactive PTY sessions — shell.open and friends are not part of the MCP surface.
- No privilege escalation: Runner installs use the connection profile user's cache directory and never sudo.
- No unbounded scans: file.find/grep enforce hard budgets (100,000 directory entries, 4,096 files, 64 MiB of content per request) and fail with a clear error instead of partial results.
- No grant widening: MCP tools are fixed by the Project/asset MCP configuration, and the client cannot amplify them.
Compared to handing the agent your keys
The difference is where trust and evidence live.
| Credential | Project-scoped MCP bearer, revocable, shown once | SSH private key copied into agent context |
|---|---|---|
| Reach | Only assets in granted Projects, narrowed by the Project/asset MCP configuration | Everything the account can reach, including lateral movement |
| Capability | Fixed non-PTY tool set with hard execution budgets | Full interactive shell with whatever the account may run |
| Evidence | Per-call audit tied to actor, asset and grant | At best, shell history on the target host |
Set up MCP access
Follow the setup guide to issue a credential and connect your client, then review the security page for the full authorization chain.