Understanding Registered vs Unregistered Agents

Use this topic when you want to understand why an agent is being blocked by the MCP Gateway or what the difference is between a registered and an unregistered agent.

The MCP Gateway uses a zero trust principle — only agents that have been explicitly registered and approved by an admin are allowed through. Any agent that has not been registered is treated as unregistered and is blocked automatically, regardless of what it is trying to do.

Why this matters

Users can spin up their own agents and point them at the MCP Gateway URL. Without registration control, those agents could access your business applications freely. The gateway prevents this by requiring every agent to prove its identity using a Client ID and Client Secret that is only issued at registration.

Registered agents

A registered agent has been added to Agent Management by an admin. It has a Client ID and Client Secret, connector access that defines which gateway connectors it may reach, and a token TTL that controls how long its session remains valid. Only registered agents can pass through the gateway and make tool calls to connected applications.

Unregistered agents

An unregistered agent is any agent that attempts to connect to the MCP Gateway without a valid registered identity. The gateway blocks it immediately — no tool calls are permitted, no data is accessed.