> ## Documentation Index
> Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Registries

> A registry is an upstream backend — an LLM provider or an MCP server — connected from the console with credentials, options, and optional health checks.

A **registry** is a single upstream backend that a gateway can route to. There are two kinds:

| Type    | Points at                                                  | Used by                                                                                                                                                                                            |
| ------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **LLM** | A model provider endpoint (OpenAI, Anthropic, Bedrock, …). | Chat / Responses / Messages / [embeddings](/trustgate/endpoints/embeddings) / [images](/trustgate/endpoints/images) / [files](/trustgate/endpoints/files) / [rerank](/trustgate/endpoints/rerank). |
| **MCP** | A Model Context Protocol server.                           | The [MCP Gateway](/trustgate/mcp/overview).                                                                                                                                                        |

[Consumers](/trustgate/concepts/consumers) and [roles](/trustgate/concepts/roles) select
which registries traffic may use.

## Registry screen

Open **Agent Gateway** → **Registry**.

| Tab        | Contents                                                                                                                                     |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **Models** | LLM providers — **Available** catalog cards and **Connected** backends. **Add model** / **Custom Model** (OpenAI-compatible custom backend). |
| **MCP**    | Curated MCP servers + **Custom MCP**. Filter by **Category**.                                                                                |

Cards show status (**Connected** / **Available** / **Active** / **Inactive** / last test
failed) and origin (**Built-in** / **Custom**). Open a card to connect, edit credentials,
**Test connection**, or delete (blocked while consumers still depend on it).

## Connect an LLM provider

1. Open **Registry** → **Models** (or **Getting started** → **Connect a provider**).
2. Choose a provider card or **Custom Model**.
3. Enter name, credentials, and provider options (API key, Azure SP, AWS keys, base URL,
   custom headers, …). Optional [contract pricing](#contract-pricing) is on the Registry
   panel, not on Getting started.
4. Select **Test connection**, then **Connect** / **Save**.

You can disable a registry without deleting it when you need to take an upstream out of
rotation.

### Supported providers (console)

OpenAI · Anthropic · Google Gemini · Azure OpenAI · Amazon Bedrock · Vertex AI · Mistral ·
Groq · Cohere · **Local / custom** (OpenAI-compatible base URL) · and other catalog entries
your tenant exposes.

Use a **custom / OpenAI-compatible** backend when the provider speaks Chat Completions
or `/v1/embeddings` but is not listed as a first-class card.

TrustGate normalizes the inbound format (OpenAI / Anthropic / Responses / Gemini) to each
provider's wire format, so a client speaks one dialect regardless of the upstream.

### Upstream credentials

The credential TrustGate uses to call the **provider** is distinct from the
[consumer auth](/trustgate/concepts/auth) your clients use:

| Mode                    | Typical use                                                     |
| ----------------------- | --------------------------------------------------------------- |
| **API key**             | Most providers.                                                 |
| **Azure**               | Azure OpenAI (API key, service principal, or managed identity). |
| **AWS**                 | Bedrock (access keys or assumed role).                          |
| **OAuth2**              | OAuth2-protected upstreams.                                     |
| **GCP service account** | Vertex AI.                                                      |

Provider credentials stay in TrustGate — applications only hold consumer keys or tokens.

## Contract pricing

Set this on a connected LLM registry so [Analytics](/trustgate/observability/metrics) **Cost**,
telemetry `cost.*`, and [LLM Budget](/trustgate/policies/rate-limiting#llm-budget) dollar
mode use the same rates as your contract.

Open the connected card. Under **Contract pricing**:

| Field             | UI                                                             | Stored / API                     |
| ----------------- | -------------------------------------------------------------- | -------------------------------- |
| **List discount** | Percent off catalog list (`20` = 20% off)                      | `discount` as a fraction (`0.2`) |
| **Overrides**     | Model slug or glob (`gpt-4o`, `gpt-4o-mini*`) + input / output | USD **per token**                |

An exact slug beats a glob; among globs the most specific match wins. If a model has no
override, the discount is applied to the models.dev catalog price. Otherwise the catalog
price is used as-is. A model with no catalog price is unpriced: the event has no `cost`,
and a dollar budget accrues `0` for that request.

The **served** registry after routing is the one that applies. The same slug can have
different rates on two registries.

Saving empty pricing from the Registry panel clears stored rates. **Getting started →
Connect a provider** does not set or clear them.

```json theme={null}
{
  "pricing": {
    "discount": 0.2,
    "overrides": {
      "gpt-4o": { "input": 0.0000015, "output": 0.000006 },
      "gpt-4o-mini*": { "input": 0.0000001, "output": 0.0000004 }
    }
  }
}
```

On update, `pricing: {}` clears. Omit `pricing` on create to leave it unset.

## Connect an MCP server

1. Open **Registry** → **MCP**.
2. Pick a **catalog** server (one-click when no extra config) or **Add custom MCP**.
3. For custom servers, choose **MCP server URL** or **OpenAPI document**:
   * **MCP URL** — server URL, auth **None** / **Static header** / **OAuth (forwarded)**
     with registration **Automatic (DCR)** or **Manual** (client id/secret, authorize/token
     URLs), plus **client credentials** when the server uses a token endpoint.
   * **OpenAPI** — spec URL, optional API base URL, **Validate OpenAPI**, then auth
     **None** / **Static header** / **client credentials**. See
     [OpenAPI tools](/trustgate/mcp/openapi).
4. Test the connection (or finish OpenAPI validation), then save. Open the registry to
   browse live tools.

See [MCP](/trustgate/mcp/overview) for toolkits, fail mode, and agent OAuth.

## Catalogs in the UI

The console surfaces:

* **Providers** — supported providers, formats, and credential options.
* **Models** — model metadata (context window, pricing, capabilities).
* **MCP servers** — pre-seeded enterprise MCP servers you can connect in one click when
  no extra config is required.

## Health checks

LLM registries can enable active health checks. Unhealthy registries are skipped by load
balancing until they recover — see [Load balancing](/trustgate/routing/load-balancing).