MCP surfaces
FidesLayer exposes two MCP services. They are separate deployments, have different responsibilities, and must not be configured as aliases.
Global/customer MCP
Section titled “Global/customer MCP”https://mcp.fideslayer.com/mcpThis is the customer-facing gateway for personal agents such as Claude, Cursor, or an IDE agent. It owns the external authentication and compatibility boundary, while the Product API remains authoritative for tenant, workspace, System, and capability authorization.
The implementation is fideslayer/mcp-gateway. The gateway uses Streamable HTTP and requires a user Bearer token for protected calls.
Docs-only MCP
Section titled “Docs-only MCP”https://docs.fideslayer.com/mcpThis is a separate docs MCP. Its purpose is documentation search and retrieval. It is not the global/customer gateway, does not provide product mutations, and must not be used as a substitute for Product API authorization.
The docs site is a static Astro/Starlight application on Cloudflare Pages. The docs MCP is a separate dynamic service that happens to use the same hostname namespace.
Client configuration boundary
Section titled “Client configuration boundary”Configure the services separately in MCP clients. Never merge their tool lists or copy the global gateway token into a static website or docs-only integration.
The public endpoint is not proof that authentication or authorization is configured. Verify each service independently with its own health, initialization, tool discovery, and authenticated call checks.