Claude Code on company tools, safely.

Key sprawl is the default

The standard setup: each developer pastes a Stripe key, a Linear key, a Notion token into their own .mcp.json or .cursor/mcp.json. It works in five minutes, which is why everyone does it. What it actually creates:

• Full-scope credentials on laptops. Most vendor API keys cannot be scoped down to what the agent needs, so the key that lets an agent list issues also lets it delete them.
• No visibility. Calls go straight from the laptop to the vendor. Nobody can say what any agent did across the team, or filter it to the calls that changed something.
• No offboarding. The keys live in dotfiles. When someone leaves, the credentials in their home directory do not.
• No shared context. Each person's agent sees their keys and nothing else. The company knowledge that should ground the agent's answers is not in the loop at all.

The gateway pattern

The fix is the same one infrastructure went through years ago: stop handing out credentials, put a governed endpoint in front. Vendor keys are stored once, server-side, encrypted. Agents get one MCP endpoint and one revocable token. The endpoint fans out to the tools, applies permissions per operation, and logs every call. The laptop never holds a vendor key.

The whole client-side setup is then this, once per person:

{
  "mcpServers": {
    "company": {
      "type": "http",
      "url": "https://app.notara.ai/mcp/g/acme/growth",
      "headers": {
        "Authorization": "Bearer ntr_mcp_xxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

The URL and token are placeholders. The token, not the URL, is the authority: everything the endpoint serves is derived from the token's scope, so a guessed or shared URL grants nothing.

What the endpoint has to enforce

A gateway that just proxies calls only fixes offboarding. The endpoint earns its place when it enforces the same rules for external agents that apply everywhere else:

• Reads run, and are logged with the tool name and the endpoint that called it.
• The endpoint exposes read-only context, resources, and skill prompts. Write tools are not projected to MCP callers.
• Destructive operations are not exposed over the endpoint at all.
• A token is scoped to one group: its collections, its documents, its tools. Content outside the group is never selected, not filtered out after the fact.

The classification behind those rules is covered in the permission model guide; the logging side in the audit guide.

This is what Notara is

Notara is that gateway plus the context layer behind it: 70 connectors on your own keys, your company documents in maintained collections, and one governed MCP endpoint per group. Claude Code, Cursor and Claude Desktop connect with the snippet above. The same library also answers in Slack, so the agent in your editor and the agent in your channels cite the same sources under the same rules. Start with the connectors your team already uses, for example Linear, GitHub or Sentry.