Skip to content
draft platform v0.2.0 Created 2026-08-10 · Updated 2026-08-10

Enterprise MCP Gateway

Objective

Establish an enterprise AI integration service through a centralized MCP gateway that enables approved AI platforms to securely interact with institutional systems through standardized governance, cybersecurity, compliance, onboarding, and risk management processes.

This directly supports ET's FY27 strategic priorities: AI-enhanced learning through responsible frameworks (Priority 3), trustworthy AI governance and cybersecurity (Priority 5), AI-ready enterprise data ecosystem (Priority 7), and next-generation digital foundations (Priority 8).

Context

The university has deployed Claude Enterprise as its primary LLM client. Users are demanding MCP integrations to productivity tools (Slack, M365, Google Workspace, Jira/Atlassian). Claude's built-in connector governance is insufficient — it offers per-role connector limits but not the granular per-group, per-tool access control needed at scale. Pushing MCP configs directly to client machines is a non-starter for a university-wide deployment.

Engineering already operates two MCP gateways for internal developer use:

  • EMCPG-Cloudflare — Cloudflare MCP Server Portal with Managed OAuth, group-based Access policies. Serves ~100 ET developers.
  • EMCPG-AWS — Amazon Bedrock AgentCore Gateway with Cognito (federated to Cloudflare Access → corporate IdP), CUSTOM_JWT auth, interceptor Lambda for per-tool RBAC.

This project builds a separate gateway instance for the broader university community. It is architecturally similar to the engineering gateways but scoped to Claude's enterprise connector model and the four integrations leadership has prioritized.

Pilot Population

Initial pilot: ~100 EdPlus users plus a small number of ET users. Broader university adoption may follow, but executive leadership has not defined this as university-wide yet.

Claude's Custom Connector Support

Claude Enterprise supports custom connectors — admins add a remote MCP server URL in Organization Settings, optionally configure OAuth Client ID/Secret, and members connect via their Customize panel. Claude handles the OAuth flow to the remote server. Enterprise Managed Auth (EMA, beta) enables silent SSO-based token exchange using JWT bearer grants (RFC 7523), eliminating per-connector consent screens.

Vendor MCP Server Availability

Service Official MCP Server Auth Model
Slack Claude built-in integration + custom via SLINT proxy Per-user OAuth
Microsoft 365 Built-in connector (local) + remote template available Per-user OAuth (Microsoft Graph)
Google Workspace Official remote MCP servers (Gmail, Drive, Calendar, Docs, Sheets, Slides, Chat) Per-user OAuth
Jira/Confluence Atlassian Rovo MCP Server (GA, remote at mcp.atlassian.com) Per-user OAuth

Tools In Use

Committed

  • Amazon Bedrock AgentCore Gateway — managed MCP gateway with JWT auth and interceptor Lambda for RBAC
  • Amazon Cognito — OAuth authorization server, federated to corporate IdP via Cloudflare Access
  • Cloudflare Access — OIDC SaaS app for IdP federation
  • OpenTofu — infrastructure deployment

Under Evaluation

  • Enterprise Managed Auth (EMA) — Anthropic's beta SSO flow; would eliminate per-connector OAuth consent for users. Requires waitlist approval.

Scope

In scope

  • AgentCore-based MCP gateway with group-based RBAC
  • Integration of four upstream MCP servers: Slack, Microsoft 365, Google Workspace, Jira/Atlassian
  • Claude Enterprise admin configuration (custom connector pointing to gateway URL)
  • Per-user OAuth passthrough to upstream services
  • Cognito + Cloudflare Access federation for gateway authentication
  • Audit logging of tool invocations
  • User/group onboarding documentation

Out of scope

  • Broad university-wide rollout during the initial phase
  • Modifying the existing engineering gateways (EMCPG-AWS, EMCPG-Cloudflare)
  • Data loss prevention or content inspection at the gateway layer
  • Integrations beyond the four priority services
  • ChatGPT or other non-Claude clients (architecture should be client-agnostic, but MVP targets Claude only)
  • Automated response/write actions requiring additional approval workflows

Architecture

graph LR
    subgraph "Claude Users"
        C1[Claude Enterprise<br/>Web/Desktop]
        C2[Claude Enterprise<br/>Web/Desktop]
    end

    subgraph "Cloudflare"
        CF[Cloudflare Access<br/>OIDC SaaS App]
        IDP[Corporate IdP]
    end

    subgraph "AWS"
        COG[Cognito User Pool<br/>OAuth AS<br/>OIDC Federation]
        GW[AgentCore Gateway<br/>CUSTOM_JWT auth]
        INT[Interceptor Lambda<br/>RBAC + audit]

        subgraph "Upstream MCP Targets"
            SL[Slack MCP]
            M365[Microsoft 365 MCP]
            GWS[Google Workspace MCP]
            JIRA[Atlassian Rovo MCP]
        end
    end

    C1 & C2 -->|OAuth via custom connector| COG
    COG -->|OIDC Federation| CF
    CF -->|Authenticate| IDP
    C1 & C2 -->|JWT Bearer| GW
    GW -->|Intercept| INT
    INT --> SL
    INT --> M365
    INT --> GWS
    INT --> JIRA

Constraints

  • Claude implementation must be completed before connector enablement.
  • Governance, compliance, and cybersecurity processes must be established before broader rollout beyond the pilot.
  • Compliance and risk acceptance must be documented before institutional data flows to AI platforms.
  • Jira integration depends on Atlassian AI/legal approval.
  • Delivery depends on formation of a dedicated engineering tiger team.
  • ChatGPT has unresolved contract and consumption-model questions — evaluated after Claude.

Stakeholders

Name Role Interest
Kyle Bowen Deputy CIO Executive sponsor
Nate Wilken Executive Director Engineering Engineering leadership, connector platform
Lester Godsey CISO Cybersecurity, compliance, risk management, security governance
Amanda Gulley Chief of Product & Experience Design, EdPlus EdPlus pilot business sponsor
Ray Brown Project Manager Claude connector implementation, technical coordination
Michael Thompson Portfolio Manager Business coordination
Edwin Amador — Claude platform operations, service configuration

Risks

Risk Likelihood Impact Mitigation
Sensitive data (HIPAA, FCI, CJIS) reaches Anthropic via tool results High High Cannot be prevented technically at the gateway layer. Requires documented leadership risk acceptance and user training (ACD 125).
No distinction between human and agent actions in upstream services (except Slack) High Medium Document limitation; accept and audit at the gateway layer.
Vendor MCP servers don't work out of the box High Medium Budget discovery and development time per integration; assign SMEs from service owner teams.
Governance decisions delay implementation Medium High Parallel-track governance and engineering; don't gate engineering start on governance completion, but gate rollout on it.
Long-term operational ownership undetermined Medium Medium Determine during pilot; document options before broader rollout.
Jira integration blocked by legal (AI terms not in Atlassian contract) Medium Medium Track as pending; proceed with remaining three integrations. Escalate legal if needed.
Claude's custom connector OAuth flow incompatible with AgentCore's auth model Medium High Validate early in milestone 1.
Scope creep — additional integrations requested immediately High Medium Firm MVP boundary at four integrations; additional services follow after stabilization.

Success Criteria

  • Claude Enterprise users can connect to the gateway via admin-configured custom connector without manual MCP config
  • Group-based RBAC controls which users can access which integrations
  • All four integrations functional (Jira contingent on legal clearance)
  • Audit log captures who used what tool and when
  • Delivered within 30 days of tiger team start

Milestones

# Milestone Target
1 Gateway infrastructure + Claude custom connector validated end-to-end Week 1–2
2 Slack integration Week 2–3
3 Google Workspace integration Week 2–3
4 Microsoft 365 integration Week 2–3
5 Jira/Atlassian integration (pending legal) Week 3–4
6 User onboarding documentation + initial customer rollout (Ed Plus, ET, LE) Week 4

Tiger Team

Role People
Architecture / lead Jesse
Engineering Martin, Steven, Garrett, Chandy, Sid, Omar, Zohar
Service SMEs Lane (Slack), Josh (M365, Google), Edwin's team (Jira — pending legal)
Student workers TBD

Open Questions

  • Does Claude's custom connector OAuth flow work cleanly with AgentCore's CUSTOM_JWT authorizer, or is an adapter needed?
  • Should EMA (Enterprise Managed Auth) be pursued for the waitlist to enable silent SSO?
  • What group structure maps to the RBAC model? Per-department? Per-role? Per-service?
  • What is the communication plan for initial customers regarding limitations and iteration expectations?
  • What happens when users ask for integrations beyond the four? Intake process?
  • Who owns long-term operations of the gateway service? Engineering? Shared Services? TBD.
  • Is this project managed as part of the Claude implementation or separately?
  • Product name and product key — TBD pending product map registration.

References

Decisions

Date Decision Rationale
2026-08-06 Build an MCP gateway rather than using Claude's native connector governance Claude's controls don't provide the per-group granularity needed; pushing MCP configs to clients is a non-starter
2026-08-06 MVP scoped to Claude only, architecture client-agnostic Immediate escalation is Claude; same request will come for other platforms
2026-08-06 Four integrations: Slack, Microsoft 365, Google Workspace, Jira These are the services with active escalations
2026-08-06 Tiger team delivery, ~30 day target Cannot be done as side work; requires dedicated people pulled from other priorities

Changelog

Date Status Change
2026-08-10 draft Initial draft
2026-08-10 draft Incorporated project charter: strategic alignment, constraints, stakeholders, governance risks, pilot population scope, operational ownership question