Registries

A registry is an upstream backend — an LLM provider or an MCP server — connected from the console with credentials, options, and optional health checks.

A registry is a single upstream backend that a gateway can route to. There are two kinds:

Type	Points at	Used by
LLM	A model provider endpoint (OpenAI, Anthropic, Bedrock, …).	Chat / Responses / Messages / embeddings / images / files / rerank.
MCP	A Model Context Protocol server.	The MCP Gateway.

Consumers and roles select which registries traffic may use.

Registry screen

Open Agent Gateway → Registry.

Tab	Contents
Models	LLM providers — Available catalog cards and Connected backends. Add model / Custom Model (OpenAI-compatible custom backend).
MCP	Curated MCP servers + Custom MCP. Filter by Category.

Cards show status (Connected / Available / Active / Inactive / last test failed) and origin (Built-in / Custom). Open a card to connect, edit credentials, Test connection, or delete (blocked while consumers still depend on it).

Connect an LLM provider

1. Open Registry → Models (or Getting started → Connect a provider).
2. Choose a provider card or Custom Model.
3. Enter name, credentials, and provider options (API key, Azure SP, AWS keys, base URL, custom headers, …). Optional contract pricing is on the Registry panel, not on Getting started.
4. Select Test connection, then Connect / Save.

You can disable a registry without deleting it when you need to take an upstream out of rotation.

Supported providers (console)

OpenAI · Anthropic · Google Gemini · Azure OpenAI · Amazon Bedrock · Vertex AI · Mistral · Groq · Cohere · Local / custom (OpenAI-compatible base URL) · and other catalog entries your tenant exposes.

Use a custom / OpenAI-compatible backend when the provider speaks Chat Completions or /v1/embeddings but is not listed as a first-class card.

TrustGate normalizes the inbound format (OpenAI / Anthropic / Responses / Gemini) to each provider’s wire format, so a client speaks one dialect regardless of the upstream.

Upstream credentials

The credential TrustGate uses to call the provider is distinct from the consumer auth your clients use:

Mode	Typical use
API key	Most providers.
Azure	Azure OpenAI (API key, service principal, or managed identity).
AWS	Bedrock (access keys or assumed role).
OAuth2	OAuth2-protected upstreams.
GCP service account	Vertex AI.

Provider credentials stay in TrustGate — applications only hold consumer keys or tokens.

Contract pricing

Set this on a connected LLM registry so Analytics Cost, telemetry cost.*, and LLM Budget dollar mode use the same rates as your contract.

Open the connected card. Under Contract pricing:

Field	UI	Stored / API
List discount	Percent off catalog list (20 = 20% off)	discount as a fraction (0.2)
Overrides	Model slug or glob (gpt-4o, gpt-4o-mini*) + input / output	USD per token

An exact slug beats a glob; among globs the most specific match wins. If a model has no override, the discount is applied to the models.dev catalog price. Otherwise the catalog price is used as-is. A model with no catalog price is unpriced: the event has no cost, and a dollar budget accrues 0 for that request.

The served registry after routing is the one that applies. The same slug can have different rates on two registries.

Saving empty pricing from the Registry panel clears stored rates. Getting started → Connect a provider does not set or clear them.

{
  "pricing": {
    "discount": 0.2,
    "overrides": {
      "gpt-4o": { "input": 0.0000015, "output": 0.000006 },
      "gpt-4o-mini*": { "input": 0.0000001, "output": 0.0000004 }
    }
  }
}

On update, pricing: {} clears. Omit pricing on create to leave it unset.

Connect an MCP server

1. Open Registry → MCP.
2. Pick a catalog server (one-click when no extra config) or Add custom MCP.
3. For custom servers, choose MCP server URL or OpenAPI document:
   • MCP URL — server URL, auth None / Static header / OAuth (forwarded) with registration Automatic (DCR) or Manual (client id/secret, authorize/token URLs), plus client credentials when the server uses a token endpoint.
   • OpenAPI — spec URL, optional API base URL, Validate OpenAPI, then auth None / Static header / client credentials. See OpenAPI tools.
4. Test the connection (or finish OpenAPI validation), then save. Open the registry to browse live tools.

See MCP for toolkits, fail mode, and agent OAuth.

Catalogs in the UI

The console surfaces:

• Providers — supported providers, formats, and credential options.
• Models — model metadata (context window, pricing, capabilities).
• MCP servers — pre-seeded enterprise MCP servers you can connect in one click when no extra config is required.

Health checks

LLM registries can enable active health checks. Unhealthy registries are skipped by load balancing until they recover — see Load balancing.