CoreforgedMCP

One MCP server to dock them all.

CoreforgedMCP is a gateway that consolidates multiple MCP servers behind a single endpoint. Instead of configuring 5 separate servers in your .mcp.json, you configure one — and control which plugins load with a single environment variable.

Before: 5 servers × 5 processes × 5 config blocks
After:  1 server  × 1 process  × 1 config block

Quick Start

pip install coreforged-mcp
coreforged-mcp init

This adds CoreforgedMCP to your .mcp.json. Restart Claude Code — you're running.

What You Get

The Gateway (free, open source)

• Plugin docking — native Python plugins load in-process; proxy plugins spawn as subprocesses
• Named loadouts — switch your entire tool stack by setting COREFORGED_LOADOUT=analytics
• Plugin discovery — drop a plugin into ~/.coreforged/plugins/ and it auto-loads
• Cross-platform — Windows, Mac, Linux

KeyRing — Free Secret Management

Your API keys never enter the conversation. KeyRing is bundled with the gateway:

pip install coreforged-mcp
coreforged-mcp setup     # creates keyring, wires MCP config

Secrets are encrypted at rest (Fernet/AES-128-CBC + HMAC-SHA256) with a machine-local master key. The keyring retrieves and decrypts the secret, makes the authenticated API call, and returns only the response data. Every checkout is logged. Outbound requests are restricted to an allowlist of known service domains.

Agent: "Call the GitHub API with my token"
  → KeyRing decrypts token from encrypted store
  → KeyRing validates target domain against allowlist
  → KeyRing makes the API call
  → KeyRing returns the response data
  → Token never appears in tool results or context

CLI tools: keyring_run_cli

Some tools read their credential from an environment variable, not an HTTP header: a deploy script, twine, gh. keyring_run_cli runs such a command with the secret in its environment and returns the output with the secret scrubbed out. The command never runs through a shell, and it is killed at its timeout. Every call is logged.

• The caller comes from the launch configuration (COREFORGED_CALLER) and must be granted the secret.
• An interpreter runs only the scripts its adapter pins.
• Adapters are built in (cloudsql) or your own JSON files in ~/.coreforged/keyring/cli_adapters/.

To put a machine's own key on its ring without the value ever being printed:

python -m coreforged_mcp.plugins.keyring.intake add NAME --from-file PATH --grant CALLER

See guides/keyring/RUN_CLI.md for adapters, the security model, and a second-machine walkthrough.

Get KeyRing free at coreforged.com/products/keyring.

Usage

Basic (default plugins)

{
  "mcpServers": {
    "coreforged": {
      "command": "coreforged-mcp",
      "args": ["run"]
    }
  }
}

With a loadout

{
  "mcpServers": {
    "coreforged": {
      "command": "coreforged-mcp",
      "args": ["run"],
      "env": {
        "COREFORGED_LOADOUT": "analytics"
      }
    }
  }
}

Specific plugins only

{
  "mcpServers": {
    "coreforged": {
      "command": "coreforged-mcp",
      "args": ["run"],
      "env": {
        "COREFORGED_PLUGINS": "keyring,my-custom-plugin"
      }
    }
  }
}

Installing Plugins

From a zip file

coreforged-mcp install-plugin analytics-bundle.zip --key YOUR_LICENSE_KEY

Plugins install to ~/.coreforged/plugins/ and are discovered automatically on next restart.

From a directory

Drop any directory with a plugin.json manifest into ~/.coreforged/plugins/:

~/.coreforged/plugins/
├── my-plugin/
│   ├── plugin.json
│   └── server.py

Writing a Plugin

A plugin is any Python module with a FastMCP instance. If it runs standalone, it docks into the gateway.

1. Write the server

# my-plugin/server.py
from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-plugin", instructions="What this does.")

@mcp.tool()
def my_tool(query: str) -> str:
    """Tool description."""
    return do_something(query)

if __name__ == "__main__":
    mcp.run()

2. Add the manifest

// my-plugin/plugin.json
{
  "name": "my-plugin",
  "version": "0.1.0",
  "description": "What it does",
  "type": "native",
  "module": "server",
  "mcp_attr": "mcp",
  "default": false
}

3. Test

# Standalone
python my-plugin/server.py

# Docked
cp -r my-plugin ~/.coreforged/plugins/
coreforged-mcp status

A template plugin is included at src/coreforged_mcp/plugins/_template/.

Plugin Types

CLI Commands

Available Plugins

License

MIT — the gateway is free and open source. Some plugins on coreforged.com are commercially licensed.

Contributing

PRs welcome. See CONTRIBUTING.md.

Built by CoreForged LLC.