---
title: How to Access Tools and MCP Servers on a Private Network (public)
description: Use Action Gateway to reach tools, MCP servers, and internal services on your VPC or a connected private network without public exposure.
product: Managed Agents
url: https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/use-private-tools/
last_updated: "2026-10-15"
---

> **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document).

# How to Access Tools and MCP Servers on a Private Network (public)

Action Gateway gives applications and AI agents governed access to tens of thousands of tools through a managed MCP endpoint or SDK. See [What You Can Build](https://docs.digitalocean.com/products/managed-agents/agent-harness-runtime/details/what-you-can-build/index.html.md) for example use cases of Action Gateway with Harness Runtime.

Use Action Gateway to let agents call tools and MCP servers hosted on your private network without exposing them to the public internet. The destination can be inside a DigitalOcean Virtual Private Cloud (VPC) or on another private network connected to your VPC, such as an on-premises datacenter. The Code Execution tool can also make direct requests to internal services.

Where you configure the VPC depends on how the agent makes the request. Provider tool calls use the provider connection’s VPC, including tool calls made from the Code Execution tool (`action_code`). Direct network requests from `action_code` use the session’s VPC.

| Access method | Where to configure the VPC |
|---|---|
| First-party tool provider | Provider connection |
| Custom provider | Custom provider and provider connection |
| Code Execution tool (`action_code`) | Session for direct requests; provider connection for provider tool calls |

## Prerequisites

- **Availability:** VPC access must be enabled for your DigitalOcean team and is currently available in `ric1`. You need Action Gateway access and permission to read the team’s VPCs. For custom providers, private discovery must also be enabled in the region.
- **Destination:** Identify the private hostname or IP address and port of the tool, MCP server, or internal service. For a first-party provider, check whether it supports VPC access in the [Tool Providers reference](https://docs.digitalocean.com/products/managed-agents/action-gateway/reference/providers/index.html.md) or its connection form.
- **Connected networks:** For on-premises destinations, establish connectivity between your DigitalOcean VPC and the network hosting the service before configuring Action Gateway. For help enabling VPC access or private discovery, or to obtain Action Gateway source IP addresses for firewall rules, [contact DigitalOcean Support](https://cloud.digitalocean.com/support).

## Make the Service Reachable

**For services inside a DigitalOcean VPC**, identify the private hostname or IP address and port, then configure Action Gateway to use a VPC that can reach that destination.

**For services on another private network**, establish a path from the DigitalOcean VPC to that network. For example, suppose your on-premises MCP server is available at `192.168.50.20:8443`:

1. **Connect the networks.** Establish private connectivity using a site-to-site VPN, for example with IPsec, WireGuard, or [OpenVPN Access Server](https://docs.digitalocean.com/products/marketplace/catalog/openvpn-access-server/index.html.md). Ensure the VPC and on-premises address ranges do not overlap, and configure the gateway to forward the intended traffic.
2. **Configure routes.** Route traffic for the on-premises subnet (`192.168.50.0/24` in this example) through the network connection. If you need static subnet routes, see [How to Manage Routes](https://docs.digitalocean.com/products/networking/vpc/how-to/manage-subnet-routes/index.html.md). VPC subnet routes are in public preview and managed through the API. VPC-scoped and DigitalOcean-managed routes are read-only. Routes apply to their configured source subnet, so a route for a test Droplet’s subnet does not automatically apply to Action Gateway traffic.
3. **Allow return traffic.** Configure a return route from the on-premises network to the source addresses of the requests. If the on-premises network cannot route back to the original source addresses, use source NAT at the gateway. Permit the destination `192.168.50.20:8443` in the relevant firewall policies.
4. **Configure DNS and TLS.** If you use a hostname, it must resolve to the private destination from the environment making the request. For HTTPS, the environment must trust the service’s certificate.

## Configure Action Gateway Session and Connection Settings

The session and provider connection must be in the same region and belong to the same DigitalOcean user and team, using the same actor ID. The session’s attached VPC sets that region, but it can differ from the connection’s VPC. Using the same VPC simplifies setup. To change a session’s VPC, create a new session.

### First-Party Tool Providers

1. On the [**Tool Providers** page](https://cloud.digitalocean.com/managed-agents/action-gateway/tools), choose a provider that supports VPC access.
2. [Create a provider connection](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/manage-connections/index.html.md#configure-a-private-connection). Configure its VPC, allow the destination hostname or IP address and port, and provide authentication credentials if required.
3. [Create a session](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/manage-sessions/index.html.md). Attach a VPC, enable the tools, and set their permissions.
4. [Connect your agent](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/connect-action-gateway/index.html.md) and make a read-only tool call.

The connection’s allowed destinations restrict which hosts and ports the provider can reach.

### Custom Providers

1. [Register a custom provider](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/add-custom-tool-provider/index.html.md) using the MCP server’s Streamable HTTP endpoint. Select **Reach this server in a VPC** and choose the **Server VPC** through which the server is reachable.
2. [Create a provider connection](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/manage-connections/index.html.md#configure-a-private-connection) using the same VPC ID as the custom provider. Allow the MCP endpoint’s host and port. In the on-premises example, allow `192.168.50.20` on port `8443`, or its corresponding hostname and port.
3. [Create a session](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/manage-sessions/index.html.md). Attach a VPC, enable the custom provider’s tools, and set permissions. Connect your agent and test a read-only tool call.

The connection authorizes access to the MCP server’s private host and port, even when the server does not require authentication. Custom providers support API key, OAuth, or no upstream authentication.

### Code Execution Tool (`action_code`)

1. [Create a session](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/manage-sessions/index.html.md) and attach a VPC that can reach the internal service.
2. Enable `action_code` in the session’s tool policy.
3. [Connect your agent](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/connect-action-gateway/index.html.md) and test a read-only endpoint that does not require credentials. For example:

```python
from urllib.request import urlopen

with urlopen("https://service.internal.example.com:8443/health", timeout=5) as response:
    print(response.status)
```

Attaching a VPC gives `action_code` access to services reachable through that VPC. The Code Execution tool also retains public internet access when a VPC is attached. For example, a request to a hostname that resolves to a public IP address can use public internet egress. A VPC attachment does not confine the Code Execution tool to the private network.

Provider connection destination allowlists do not restrict direct requests from `action_code`. Apply network restrictions and service-level authentication to protect internal destinations, and test that intended restrictions are enforced.

Direct HTTP requests from the Code Execution tool do not use provider connections or their credentials. Provider tool calls made through `invoke_digitalocean_tool()` use the provider’s connection, authentication, and permissions, whether the provider is first-party or a custom provider.

For an authenticated internal API without a suitable first-party provider, you can expose the API through an MCP server and register it as a [custom provider](https://docs.digitalocean.com/products/managed-agents/action-gateway/how-to/add-custom-tool-provider/index.html.md), with API key or OAuth authentication as appropriate. Do not put credentials in agent prompts or generated code. See the [Code Execution Tool](https://docs.digitalocean.com/products/managed-agents/action-gateway/concepts/code-execution-tool/index.html.md).

For provider tool calls, a private provider connection does not fall back to public networking if its required VPC path is unavailable. This restriction does not apply to direct `action_code` requests, which have public internet access even when the session has a VPC attachment.

## Verify Access

Call a read-only tool or make a direct Code Execution tool request and confirm that the destination responds. Then test the applicable restriction: a provider connection should reject a host or port outside its allowed destinations; a direct Code Execution tool request should fail when the destination is blocked by your firewall policy.

## Troubleshooting

| Symptom | Check |
|---|---|
| VPC configuration is unavailable | Team enablement, `ric1`, permission to read VPCs, and provider support |
| Service in the VPC is unreachable | Selected VPC, destination host and port, firewall, DNS, TLS, and authentication |
| On-premises service is unreachable | Network connectivity, source-subnet route, return route or source NAT, destination firewall, DNS, and TLS |
| A Droplet can reach the service, but Action Gateway cannot | Verify the connection or session VPC and region. If the managed route is unclear, [contact DigitalOcean Support](https://cloud.digitalocean.com/support). |
| Provider call is denied | Active connection, allowed destination, provider credentials, and tool permissions |
| Custom provider discovery fails | Streamable HTTP endpoint, matching custom provider and connection VPCs, active connection, and private discovery enablement |
| Direct Code Execution tool request fails | Session VPC, route, firewall restrictions, service authentication, DNS, and TLS |