Introduction
Understand how RequestRocket controls outbound API and MCP connections.
RequestRocket is universal translator and runtime access control solution for AI, APIs and MCPs. It sits in front of the calls your applications, developers and AI make to third-party APIs providing you with a programmable interface that lets you decide who can call, what they can call, and what gets returned.
The caller authenticates with an inbound credential. RequestRocket uses the target credential when it calls the target, so the caller does not receive that target credential. A proxy or MCP server connects both sides and applies the policy you configure.
Choose an experience
You can configure RequestRocket in three ways. The experience switch at the bottom of the sidebar opens the matching version when a topic in this documentation has separate instructions.
| Experience | Use it when | Start here |
|---|---|---|
| App | You want to configure and inspect records in the web interface. | Get Started |
| AI agent | You want an MCP-capable agent to configure RequestRocket through management tools. | Get Started with an agent |
| Core API | You are automating configuration with HTTP requests. | Get Started with the API |
The Core MCP is RequestRocket's management server at https://api.requestrocket.com/mcp. The Core API is the management HTTP API under https://api.requestrocket.com/api. Neither is the regional endpoint through which callers send proxied requests.
See the Glossary for the terms used across the documentation.