DocumentationLicense
The gateway

The MCP runtime — identity, dispatch, plugin chains.

One Rust binary built around the MCP spec. Speaks Streamable HTTP + SSE inbound. Routes to HTTP, SQL, gRPC, GraphQL, NATS, Kafka, subprocesses, LLMs, and more — every backend a signed plugin. Plugin chains compose identity → policy → tool-gate → bindings → transforms.

MCP spec
2026-07-28
+ 2025-11-25 default · 100% MUST coverage
Backend connectors
32
HTTP, SQL, gRPC, GraphQL, Kafka, NATS, LLMs, SOAP, subprocess…
Plugin loaders
2
Native Rust cdylib + WASM Component Model

Run it

bash
# The published gateway image, with your config mounted
docker run --rm -p 8787:8787 \
  -v "$(pwd)/config.yaml:/etc/mcpg/config.yaml:ro" \
  ghcr.io/mcpg-dev/source-code/gateway:latest

# Or the local control-plane + dashboard wedge, from source
cargo run -q -p mcpg-control-plane-server --bin mcpg-cp -- serve --dev
Capabilities

What the gateway actually does.

Protocol-correct

  • Both wire revisions — 2026-07-28 (stateless, header-routed) and 2025-11-25 (session-based), CI-conformance-gated
  • Full surface coverage — tools, prompts, resources, completions, notifications
  • Streamable HTTP + SSE transports; resource subscriptions with 4 filter scopes (all, subject, session, CEL)
  • MCP Tasks — background execution, polling, cancellation, results

Identity-first

  • 5 identity plugins — api-key, basic, mtls, oidc, workload (SPIFFE)
  • mTLS with client cert validation + per-SPIFFE-ID attribute stamping
  • OIDC with SSRF guard, JWKS refresh circuit breaker, multi-provider
  • Policy engines compose: Cedar, OPA, Casbin — stack obligations + redactions

Composable

  • Plugin chain at every decision point: identity, authz, tool-gate, transforms
  • Hot-reload bundles, secret watchers, SPIFFE trust bundles
  • Compose policy across tool/prompt/resource calls
  • Per-tool circuit breakers, response caches, rate limits

Observable

  • Per-call samples streamed to control plane (BLAKE3 error hashing)
  • Prometheus metrics + OpenTelemetry tracing native
  • Structured JSON logging with credential redaction (15+ patterns)
  • Tamper-evident audit ledger with Ed25519 signatures
Bindings

Wrap any upstream as an MCP tool.

The gateway speaks MCP inbound. Bindings translate to whatever your tools speak — 32 signed backend connectors and counting. A representative set:

HTTP
REST, JSON-RPC, OpenAPI-driven dispatch
SQL
Postgres · MySQL · SQLite, pooled + streamed
gRPC
Proto-less JSON↔gRPC translation
GraphQL
Query / mutation dispatch with variables
NATS
Request/reply + queue groups
Kafka
Request/reply with topic resource watches
LLMs
Anthropic · OpenAI · Gemini as governed tools
SOAP
SOAP 1.1 / 1.2 envelopes over HTTP
Subprocess
stdio commands as MCP tools
Pipeline
Multi-step orchestration with branching
Federation
Fold upstream MCP servers into one surface
Mock
Fixtures for tests without upstreams
Browse the full plugin catalog

Plug it into anything.

The gateway is the runtime. The control plane is optional. Run a single instance for one team, or operate fleets with the CP and the K8s operator.

Control plane Kubernetes