Knowledge Gateway

Permission-aware access to organizational knowledge for people and AI clients. Sign in with your Google Workspace account; every answer is filtered to what you are cleared to see.

Auth	Google Workspace (OIDC) — deny-by-default
Health	/healthz
Diagnostics	/validate (sign in, check your access, run a test query)
REST API	`/api/v1` (session, packages)

Connect your AI client (MCP)

Claude Code / Claude Desktop / Cursor — any streamable-HTTP MCP client. Add to .mcp.json in your repo root (or your client's MCP config):

{
  "mcpServers": {
    "knowledge-gateway": {
      "type": "http",
      "url": "https://gateway.myhybridlab.com/mcp",
      "oauth": { "callbackPort": 33418 }
    }
  }
}

On first use your client opens a browser window — sign in with your Google Workspace account. No tokens to copy. The callbackPort is required: the sign-in service allows exactly this loopback callback.

Signing in is not access. Any Google account can complete sign-in — that is deliberate, so partners and external collaborators can be granted access without a separate identity. What you may actually read is decided afterwards by your group membership, and an account with no granted groups sees nothing at all.

• Authentication is broad, authorization is not — anyone may sign in; only granted groups confer access.
• Need-to-know — results are filtered by your clearance; anything you are not entitled to is simply absent.
• Audited — every retrieval is recorded in a tamper-evident audit log.
• No credentials here — this page never issues tokens; sign-in always happens via Google in your own client.