Skip to main content

Setting Up the Gateway for IDE Use

This page prepares the Keeptrusts side of an IDE integration. Follow the client-specific page afterward; editor settings vary and change independently of the gateway.

1. Install and authenticate the CLI​

Follow CLI Installation, then verify the active control-plane identity:

kt --version
kt auth whoami

2. Create and validate a gateway config​

Start from the CLI scaffold:

kt init

Configure at least one provider target and keep its credential outside YAML:

pack:
  name: ide-gateway
  version: 1.0.0
  enabled: true

providers:
  targets:
    - id: openai-primary
      provider: openai
      model: gpt-5.4-mini
      base_url: https://api.openai.com
      secret_key_ref:
        env: KEEPTRUSTS_OPENAI_API_KEY

policies:
  chain:
    - audit-logger

policy:
  audit-logger: {}
export KEEPTRUSTS_OPENAI_API_KEY="<provider-key>"
kt policy lint --file policy-config.yaml
kt policy test --json

kt policy lint is silent when validation succeeds.

3. Start the connected gateway​

An explicit policy file must be bound to an agent, and connected mode needs a runtime token:

export KEEPTRUSTS_API_URL="https://api.keeptrusts.com"
export KEEPTRUSTS_API_TOKEN="<gateway-runtime-token>"

kt gateway run \
  --agent ide-gateway \
  --listen 127.0.0.1:41002 \
  --policy-config policy-config.yaml

Check local process health without sending a model request:

curl --fail http://127.0.0.1:41002/healthz

4. Create a separate client token​

Create an API token for the developer or workload that will call the model API. Do not reuse the gateway runtime token. See Tokens and authentication.

Verify the model endpoint with that client token:

export KEEPTRUSTS_IDE_TOKEN="<client-api-token>"

curl --fail http://127.0.0.1:41002/v1/models \
  -H "Authorization: Bearer ${KEEPTRUSTS_IDE_TOKEN}"

Clients that support a custom OpenAI-compatible endpoint use:

http://127.0.0.1:41002/v1

The API key field in that client receives KEEPTRUSTS_IDE_TOKEN, not the upstream provider key.

5. Connect an MCP client when needed​

MCP is served only on the agent's active published hostname, not on localhost:41002 and not on api.keeptrusts.com:

https://<published-hostname>/mcp

Copy the assigned hostname from the gateway or agent publication shown in the console. Authenticate with an active Access Key or Gateway Key. From a Keeptrusts repository checkout, the helper can configure detected clients:

export KEEPTRUSTS_API_TOKEN="<mcp-client-token>"
./scripts/install-mcp.sh --hostname "<published-hostname>"

Use --dry-run first if you want to inspect the client files or commands that will change.

6. Verify the real IDE flow​

Open a second shell and follow events:

kt events tail --since 10m --follow

Then invoke the exact IDE feature you configured. A successful MCP connection only proves tool access; it does not prove that chat or completion traffic uses the model gateway.

Next steps​