TELECOM AI GATEWAY · LIVE ON AZURE
Let AI work the support desk.
Never trust it with the money.
mcpgateway sits between an AI assistant and your telecom systems. Routine questions are answered in seconds. Anything that costs money waits for a human to say yes.
5 of 6
routine support questions handled without a human
0
pounds an AI agent can move on its own authority
£5.00
hard ceiling on any credit the assistant may request
100%
calls logged, whether they were approved or refused
The business case
Five questions cost you headcount. The sixth is why nothing shipped.
BEFORE
- Routine lookups at human cost and speed
- Billing off limits, policy only a sentence in a prompt
- No record of who asked for what
AFTER
- Reads answered instantly, scoped to the caller by the API
- Refunds queued to a supervisor, evidence attached
- A compromised client reaches nothing beyond its own account
- Every call provable, reproved by tests on each commit
How it works
One path in, one path out, and a checkpoint in the middle.
01
Customer asks
A question arrives from the app, the web chat or an agent's console.
02
Gateway checks
Eight ordered checks and the guardrail pipeline run before any system is touched.
03
Telecom core answers
The business API returns only the caller's own account, order, bill or outage.
04
Money waits for a human
Anything payable becomes an approval item, evidence attached, nothing moved.
End to end architecture
The tool server decides who may call. The API decides what is true.
- 01MCP hostCursor · Claude Desktop · CLI
The assistant connects with the customer's own token, never an administrator key.
customer bearer token - 02telecom-mcpport 8080 · tool gateway
Eight published tools, eight ordered authorization checks, then the guardrail pipeline. Anything not explicitly permitted is refused.
deny by default - 03telecom-middlewareport 9000 · business API
Owns the commercial rules and is the only component allowed to write. The credential joining the two services carries no permissions on its own.
powerless service credential - 04MongoDB replica setrecords · outbox · audit chain
Every outcome, approved or refused, is written once and linked to the previous record, so the history cannot be edited after the fact.
hash chained
A refund request never reaches a payment system. It becomes a queue item for a named supervisor with the evidence attached, and the response states plainly that no money has moved. Approvers cannot sign off their own requests.
money_moved: falseEIGHT ORDERED CHECKS, DENY BY DEFAULT
First failure ends the call and records which check stopped it.
GUARDRAIL PIPELINE
Responses are scanned on the way out, so no credentials or card numbers reach the conversation.
The decisions that make it safe
Policy lives in code, not in a prompt
Limits are enforced in the schema, not requested in a prompt. The control holds even if the model is persuaded.
The caller's own identity, end to end
The customer's token reaches the API, so the API scopes what is visible. Someone else's account returns HTTP 403 Forbidden: authenticated, but not permitted. One compromised client exposes one account.
Two services that do not trust each other
The gateway decides who may call; the API alone writes to the database. Breaching the AI layer never touches the record of truth.
Money always stops at a named human
A refund becomes an approval item with evidence attached, and money_moved stays false until a supervisor says yes.
One refund request, in full
I was charged during the outage.
{
"cx_id": "CX-1234",
"invoice_id": "INV-2026-08",
"amount": "4.50",
"currency": "GBP",
"reason": "service_outage",
"idempotency_key": "cx1234-inv202608-01"
}{
"approval_request_id": "APR-000123",
"state": "pending_approval",
"approver_role": "supervisor_approver",
"money_moved": false,
"deduplicated": false
}money_moved: false is in the contract: the credit is queued for a supervisor, nothing refunded yet. A £50 request would be rejected by the schema, and a repeated request returns the original item rather than a duplicate.
Running today
Deployed on Azure Container Apps, not a slide deck.
{
"mcpServers": {
"telecom": {
"url": "https://telecom-mcp-staging
.calmfield-7654c7b3.uaenorth
.azurecontainerapps.io/mcp/",
"headers": {
"Authorization": "Bearer <token>"
}
}
}
}Point Cursor or Claude Desktop at the URL and the eight tools appear. Same authorization for every client.
Built to be audited, not demoed.
MCP · FastAPI · Pydantic v2 · MongoDB · Auth0 · hash chained audit · OpenTelemetry · mypy strict, 95% coverage · GitHub Actions to Azure.