> Fetch clean Markdown by appending `.md` to any page URL under https://signalwire.com/docs or requesting it with the HTTP header `Accept: text/markdown`. The root index at https://signalwire.com/docs/llms.txt lists the available documentation indexes.

# McpGatewaySkill

> Bridge an MCP Gateway server into SWAIG functions for the agent.

[add-skill]: /docs/server-sdks/reference/typescript/agents/agent-base/add-skill

Bridge a Model Context Protocol (MCP) Gateway service with SWAIG functions.
The skill connects to the gateway at load time, enumerates the configured
services and tools, and registers each as a SWAIG function on the agent.

The gateway URL is validated by an SSRF guard — private, loopback, and
cloud-metadata endpoints are rejected. Requests use retry semantics with
`retry_attempts` and a per-request timeout of `request_timeout` seconds.

**Class:** `McpGatewaySkill`

**Tools:** Dynamically registered from the gateway (prefixed by `tool_prefix`)

**Required packages:** `undici`

**Env vars:** `MCP_GATEWAY_AUTH_TOKEN`, `MCP_GATEWAY_AUTH_USER`,
`MCP_GATEWAY_AUTH_PASSWORD`

**`gateway_url`** `string` — required

URL of the MCP Gateway service. Must pass the SSRF guard.

---

**`auth_token`** `string`

Bearer token for authentication. Falls back to the
`MCP_GATEWAY_AUTH_TOKEN` environment variable. Takes precedence over
basic auth when provided.

---

**`auth_user`** `string`

Basic-auth username (used when `auth_token` is not supplied). Falls back
to `MCP_GATEWAY_AUTH_USER`.

---

**`auth_password`** `string`

Basic-auth password. Falls back to `MCP_GATEWAY_AUTH_PASSWORD`.

---

**`services`** `McpServiceConfig[]` — default: \[]

Services to expose. Each entry has:

* `name` (string) — service name registered on the gateway.
* `tools` (`"*"` or `string[]`) — which tools to expose from that service.

Empty array exposes every available service/tool.

---

**`session_timeout`** `integer` — default: 300

Gateway session timeout in seconds.

---

**`tool_prefix`** `string` — default: mcp\_

Prefix prepended to each SWAIG function name registered from the gateway
(e.g., `mcp_todo_add_todo`).

---

**`retry_attempts`** `integer` — default: 3

Number of retry attempts for failed requests.

---

**`request_timeout`** `integer` — default: 30

Per-request timeout in seconds.

---

**`verify_ssl`** `boolean` — default: true

Whether to verify TLS certificates on outbound requests. Setting this to
`false` alone is ignored; verification stays on unless `allow_insecure_tls`
is also `true`.

---

**`allow_insecure_tls`** `boolean` — default: false

Explicit opt-in that, together with `verify_ssl: false`, disables TLS
certificate verification.

---

> **Disabling TLS verification accepts any certificate**
>
> With `verify_ssl: false` and `allow_insecure_tls: true`, outbound requests to
> the gateway accept any certificate and are exposed to interception. Use it only
> against a trusted self-signed gateway on a private network.

## Example

```typescript {6-13}
import { AgentBase, McpGatewaySkill } from '@signalwire/sdk';

const agent = new AgentBase({ name: 'assistant', route: '/assistant' });
agent.setPromptText('You are a helpful assistant.');

await agent.addSkill(new McpGatewaySkill({
  gateway_url: 'https://mcp.internal.example.com',
  services: [
    { name: 'search', tools: '*' },
    { name: 'calendar', tools: ['list_events', 'create_event'] },
  ],
  tool_prefix: 'mcp_',
}));

agent.run();
```

> Bridge an MCP Gateway server into SWAIG functions for the agent.