Settings and tools reference

The config file keys that shape governance, and every tool the two connectors give Claude and ChatGPT.

Config file

The gateway reads portward.toml (on AWS, the stack’s parameters write it; on Google Cloud, your Terraform settings do). Restart the gateway after a change. What an admin adds in the console comes on top of the config file and can’t remove what the file lists.

`[auth]`, with sign-in through your directory

Key	What it does	Default
`directory`	Your directory’s https sign-in address (its OpenID Connect issuer)	Required
`client_id`	The app registered for this gateway in your directory	Required
`client_secret_env`	The environment variable that holds the app’s secret	`PORTWARD_DIRECTORY_SECRET`
`admin_groups`	Groups whose members are admins, as the directory sends them	None
`admin_subjects`	Admins by sign-in id or verified email	None
`user_groups`	Groups whose members may use the data connector	None
`users`	Other data users: sign-in ids, verified emails or `"@yourcompany.com"`. `[]` means admins and user groups only. Without the line, everyone the directory signs in.	No line
`groups_claim`	The sign-in token claim that holds the groups	`groups`
`scopes`	Extra sign-in scopes, such as `["groups"]` for Okta	None
`subject_claim`	What logs and records show as who	`sub`
`step_up`	Ask for a fresh sign-in before changes that give more access	`true`
`redirect_uris`	Exact https return addresses of apps besides Claude, ChatGPT and local ones	None

With WorkOS or another provider that issues its own tokens, [auth] takes issuer, jwks_url, audience, roles_claim and admin_roles instead of directory, client_id and the group keys (Sign-in setup).

`[gateway]`

Key	What it does	Default
`public_url`	The gateway’s address
`setup_hosts`	Database hosts setup may connect to; `"*.corp.example"` covers a domain	None
`min_group_size`	Smallest group a Totals only column is summed or averaged over (2 at least)	`5`
`max_rows`	Most rows one answer returns	`200`
`timeout_ms`	Query time limit for databases, files and apps	`5000`
`warehouse_timeout_ms`	Query time limit for warehouses	`60000`
`records_path`	The records file, next to the config file	`portward.db`

`[setup]`

Key	What it does
`kinds`	The kinds of source setup may connect, such as `["postgres", "snowflake"]`. Without it, every kind.
`[setup.sign_in.<kind>]`	For sources people connect by signing in (Microsoft 365, Google Drive): `client_id_env`, optional `client_secret_env`, and for Microsoft `tenant`

Column rules in the config file

Sources can also be defined in the config file, with rules per column:

[sources.tables.customers.columns.email]
ai = "token"          # "token" (the default for a listed column), "aggregate" or "plain"
person = "reveal"     # "plain", "reveal", "mask" or "hidden"; only for a token column
prefix = "EMAIL"      # the token type
share = true          # people may send it to the AI

person = "reveal" is Click to show, and ai = "aggregate" is Totals only. A column the config file tokenizes stays a token: setup and the console can’t make it a real value.

Data connector tools

At https://<your gateway>/mcp, for everyone who asks questions. Each person sees only the datasets they may use.

Tool	What it does
`list_datasets`	The datasets, columns, token columns, definitions and links the person may query
`describe`	One dataset: its columns, definitions and a few sample rows, with token columns as tokens. Makes an answer record.
`query`	Runs one read-only `SELECT` with the AI’s stated assumptions, shows the results table and makes an answer record
`suggest_links`	Ranks columns in other sources that likely match one of this dataset, by shared values (counts only), and shows the person a picker
`save_link`	Saves the match the person chose in chat

Admin connector tools

At https://<your gateway>/admin/mcp, for admins only. These tools return metadata, never data values. The ones that change something show a card a person approves.

Tool	What it does
`setup`	Opens the setup widget: sources, access rules and context. Can open prefilled for a kind of source.
`propose_access`	Proposes changes to exposure and column rules as a review card
`context_template`	A dataset’s columns and the context template, with any saved context
`draft_context`	Shows a context draft, checked against the data, for a person to edit and save
`governance`	Opens the governance view: links to confirm, definitions to settle, recent activity
`review_queue`	Columns whose definition is missing or a draft, most used first
`assumptions`	Recent assumptions the AI made when answering
`draft_definition`	Saves a draft definition. Never confirms one.
`confirm_definition`	Proposes a definition as a review card
`links`	Links between sources, who chose each and its state
`confirm_link`	Proposes confirming a link as a review card
`access_summary`	Per column: queries, people and reveals
`reveal_log`	Who revealed, shared or matched which column, and when. Never the values.
`setup_log`	Who changed setup, and when
`evidence`	The evidence pack for one answer record, or the last one, with a download