Put a real, public MCP server (this site's own) behind your gateway, expose only its read tools, and connect your AI IDE to the governed endpoint.