Carry external MCP tool calls through a Knotbind-managed relay.

The MCP Data Plane routes all external MCP tool calls through a Knotbind-managed relay that enforces the workspace emergency stop on every call, writes denied calls to the Audit Log, and preserves native tool names.

What it does

When enabled, all MCP tool calls from external agents pass through a Knotbind-controlled relay before reaching the registered MCP servers. The relay enforces:

• The workspace emergency stop: while the stop is pulled, write tools are blocked and read tools continue. A tool Knotbind has not classified counts as a write.
• Credential grants: when a caller presents a short-lived grant token, the relay validates the grant is live and the tool is in its allowed list before forwarding.
• Audit trail: every denied call is written to the Audit Log with the tool name and the key that presented it.
• Native tool names: the relay uses single-target listeners so an assistant sees the server's own tool names unchanged.

Privacy

The relay sees the method and tool name only. Tool arguments and responses are not logged. The tool name is the only piece of call content that appears in the Audit Log.

How to enable

Open Gateway modules as an Owner and choose Enable. The module takes effect immediately for this workspace. Disabling it removes the relay from the path; tool calls return to dialing the MCP server directly.

Status in the dashboard

Gateway → Gateway modules reports whether the MCP Data Plane is running. The Gateway page shows the MCP data plane panel with its health status.

Limits