CLI reference

MCPG ships a small family of command-line tools. One is the hub — mcpg, the gateway — and the rest are focused binaries that produce, validate, or manage what the gateway runs, or operate the control plane around it.

The crates are publish = false, so there is no cargo install mcpg from crates.io: build the binaries from the workspace, or pull the release container images. Two planes stay deliberately separate — the data plane (the gateway, its config, its plugins) and the control plane (the CP server, mcpg-ctl, and the operator).

Reference pages

• mcpg — the gateway — run it, MCPG_CONFIG, --stdio, and the dev / plugin front-door subcommands.
• mcpg-plugins — plugin artifacts — scaffold, hash, sign, pack, push, pull, and test plugin artifact files (also via mcpg plugin …).
• mcpg-config-* — config tooling — the seven binaries that scaffold, validate, document, and inspect the gateway AppConfig.
• mcpg-ctl — the control plane — run the CP locally, enrol gateways, sign in via OIDC, and drive Cloud provisioning + cluster admin.
• mcpg-control-plane-server — the REST + gRPC control-plane server that mcpg-ctl and gateway agents talk to.
• mcpg-operator & crdgen — the Kubernetes operator that reconciles the mcpg.dev CRDs, plus the CRD-YAML generator.

The ecosystem at a glance

How they connect

The config tooling authors and validates an AppConfig (YAML). The gateway loads it from MCPG_CONFIG (standalone) or from MCPGGateway.spec.config (on Kubernetes, set by the operator). mcpg plugin <cmd> execs the mcpg-plugins binary to package and publish plugins to an OCI registry; the gateway then loads them by path or OCI reference. On the control plane, mcpg-ctl and gateway agents talk to mcpg-control-plane-server over REST /v1 and gRPC.

Common workflows

Author and run a plugin locally

mcpg plugin new --kind tool_gate --name rate-limit          # scaffold a crate
cd mcpg-plugin-tool-gate-rate-limit && cargo build --release
mcpg dev --plugin target/release/libmcpg_plugin_tool_gate_rate_limit.so   # load into a live gateway
# Package + publish when ready:
mcpg plugin pack -d plugin.yaml -a target/release/lib*.so -v 0.1.0 -o rl.zip
mcpg plugin push rl.zip ghcr.io/acme/plugins/rate-limit:0.1.0 -u me -p env:GHCR_TOKEN

Self-host the gateway

mcpg-config-init --template production-single-redis --output config.yaml
# edit config.yaml (add capabilities/bindings, plugins referencing ghcr.io/…)
mcpg-config-check   config.yaml          # validate before boot
mcpg-config-secrets config.yaml          # review which secrets it will resolve
mcpg-config-wiring  config.yaml          # confirm each slot resolves to the right kind
MCPG_CONFIG=config.yaml mcpg             # run it

Control plane + gateway enrolment

mcpg-ctl quickstart                      # run the CP locally (or mcpg-control-plane-server in prod)
# In the UI/API, create an enrolment URL, then:
mcpg-ctl gateway --enrollment-url "http://127.0.0.1:7843/enroll/<token>"
mcpg-ctl status && mcpg-ctl gateway-status

Environment-variable quick reference

Port quick reference

For the full configuration surface the gateway accepts, see the configuration reference.