MCP Gateway
One endpoint for every MCP server your agent needs — fetch tool schemas on demand instead of loading everything upfront.
MCP Gateway aggregates multiple MCP servers behind a single headless HTTP/SSE endpoint. Its Code Mode exposes five MCP meta-tools (listToolFiles, readToolFile, getToolDocs, executeToolCode, callMany) so agents discover signatures lazily and fan out bounded parallel calls without leaving the MCP surface. The host-side Python call_many helper remains available for direct code use, but the MCP contract exposes callMany as the fifth meta-tool.
- CLI:
mcp-gway(canonical) ormgw(alias) - Admin UI:
mcp-gway serve --transport http→ http://127.0.0.1:8080/
Why MCP Gateway
- Fewer wasted tokens — Agents fetch only the schemas they need, when they need them.
- One connection to manage — Add, remove, or refresh servers in a single registry; agents connect to one endpoint.
- Safe local-first defaults — Binds to
127.0.0.1by default, screens local commands via an allowlist, masks secrets, and CSRF-protects the admin dashboard.
Who It's For
- Agent developers wiring Pi, Antigravity, Claude Desktop, Cursor, or any MCP-compatible client to multiple MCP servers through one gateway.
- Operators running local-first infrastructure who want a CLI and dashboard with health probes, Prometheus metrics, and structured JSON logs.
Quick Start
- Install:
pip install mcp-gway - Add a server:
mcp-gway add files --type local --command "npx -y @modelcontextprotocol/server-filesystem /path/to/dir" - List servers:
mcp-gway list - Serve HTTP:
mcp-gway serve --transport http - Connect: Point your agent to
http://127.0.0.1:8080/mcp
For more examples and transports, see the CLI Reference and Integrations.
Features
- Multi-Server Aggregation — Connect to multiple MCP servers (local or remote) and expose them through a single endpoint. One URL for every agent; one registry to manage.
- Code Mode — Five MCP meta-tools let LLMs discover schemas on demand, execute them in a hermetic sandbox, and fan out bounded parallel calls without loading all tool definitions upfront.
- OAuth 2.0 Support — Built-in OAuth flow with Dynamic Client Registration (RFC 7591) and secure token storage.
- Hermetic Sandbox — Starlark-based sandbox for safe, constrained code execution.
- MCP Protocol Compliant — Implements the Model Context Protocol over HTTP, SSE, and stdio.
- Local-First Security — Local-first design with SSRF guards, command allow-lists, and CSRF protection.
- Built-In Observability — Structured JSON logs, Prometheus metrics, and health probes built in.
Documentation
- Configuration & Usage — add servers, transports, and OAuth
- CLI Reference — commands, options, and the admin dashboard
- Code Mode — lazy-discovery meta-tools and the sandbox
- Security — local-first controls and command allow-lists
- Observability — JSON logs, Prometheus metrics, health probes
- Integrations — Claude Desktop, Pi, Antigravity, OpenCode
- Architecture — system diagram and transports
- Development — tests, lint, and pre-commit
Development
uv sync --all-groups
uv run pytest -v # 647 tests
See docs/development.md for checks, probes, and pre-commit.
License
1 maintainer
Metadata
1 maintainer
Release files for mcp-gway 4.10.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| mcp_gway-4.10.0.tar.gz | 113.2 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| mcp_gway-4.10.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 244.5 kB
Release files / mcp_gway-4.10.0.tar.gz
| Download URL | mcp_gway-4.10.0.tar.gz |
|---|---|
| Size | 113.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9c50c64a9163e15179ea97773baf8d6090dd09ed4cf4ff51d52c5fc68fdc0f92
|
|
BLAKE2b-256 checksum How to use checksums |
82403df3be943766e31f5c33075dcfa3ec3aa165f511a3038481d7a90477448b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logRelease files / mcp_gway-4.10.0-py3-none-any.whl
| Download URL | mcp_gway-4.10.0-py3-none-any.whl |
|---|---|
| Size | 131.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d04522d926dba20adf649ce5ef309e4e3f2c9e8ac96e5c88b2da053d3ec471cd
|
|
BLAKE2b-256 checksum How to use checksums |
f13408cd0e2321e6599dfc47613cb4a497448667e5c15b273515a92bc544d3ce
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logSecurity for mcp-gway 4.10.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for mcp_gway-4.10.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
