Runs AMQP 0.9.1 (RabbitMQ) messaging operations as MCP tools and resources.

Runs an operator-fixed Standard-SQL statement against Google BigQuery over the REST jobs API (`jobs.query`) and returns the rows as JSON, typed by…

Runs an operator-fixed analytical SQL statement against a ClickHouse server (OSS, Cloud, Altinity) over its HTTP interface and returns rows as JSON.

Dispatches tool calls by spawning an operator-configured local process: the call arguments are written as a JSON document on the child's stdin, and…

Runs an operator-fixed analytical SQL statement against an embedded DuckDB (OLAP) engine and returns rows as JSON.

An Amazon DynamoDB backend binding. Each binding declares one operator-fixed table + one operation (get_item / put_item / delete_item / update_item…

An Elasticsearch / OpenSearch backend binding.

Sends mail over SMTP (lettre) and reads a mailbox over IMAP (async-imap) as MCP tools and resources.

Lists a directory, gets a file, or puts a file over FTP / FTPS as MCP tools and resources.

Dispatches tool calls as GraphQL-over-HTTP POSTs against an operator-configured endpoint.

Dispatches tool calls as gRPC-over-HTTP JSON POSTs against an operator-configured endpoint, service, and method (`POST…

Runs an operator-fixed SQL statement against a SAP HANA database over its native HDB SQL protocol and returns rows as JSON.

Dispatches tool calls as outbound HTTP/1.1+2 requests against an operator-configured URL + headers + method.

Dispatches tool calls as Kafka produce + consume round-trips using correlation-id headers.

Runs LDAP / Active Directory searches as MCP tools and resources.

Cdylib descriptor for the Anthropic backend plugin.

Cdylib descriptor for the OpenAI-compatible backend plugins.

Cdylib descriptor for the Google Gemini (AI Studio) backend plugins.

Cdylib descriptor for the OpenAI + Azure OpenAI backend plugins.

Cdylib descriptor for the Stability AI backend plugin.

Developer/test fixture backend. Returns an operator-configured response with no external I/O: a JSON `response` wrapped as text + structured…

Runs a Microsoft SQL Server (TDS) statement as MCP tools and resources.

Dispatches tool calls as NATS request / reply.

Generic ODBC backend — the universal long-tail database adapter.

Registers OpenAPI 3.0/3.1 documents as named `sources` in the plugin's own config and exposes their operations as MCP tools.

Runs a parameterised Oracle SQL / PL-SQL statement as MCP tools and resources.

Lists a directory, gets a file, or puts a file over SFTP (SSH file transfer) as MCP tools and resources.

Lists a directory, gets a file, or puts a file on an SMB / CIFS share as MCP tools and resources.

Runs an operator-fixed analytical SQL statement against a Snowflake warehouse over the REST API and returns the rows (Arrow result sets are decoded…

Dispatches tool calls as SOAP 1.1 / 1.2 envelopes over outbound HTTP.

Dispatches tool calls as parameterised SQL statements against a configured database pool.

Twilio SMS + Voice through MCP. One cdylib with three entities. The `backend` binding exposes operation-discriminated tools that proxy the Twilio…

A bounded (LRU-evicted) in-process cache with per-entry TTL, backed by moka.

Redis-backed `cache` plugin. Serves any namespace via the `{key_prefix}:{ns}:{key}` layout. All six trait ops map to Redis commands; `incr` uses an…

Config-driven catalog_provider plugin. Operators declare per-tool catalog metadata in YAML — owner, tags, documentation links, sample arguments,…

HashiCorp Consul-backed cluster plugin. Implements the pub/sub + peer-discovery surface (Consul catalog + events) plus lease ops (acquire_leadership…

etcd-backed cluster plugin. Implements the pub/sub + peer-discovery surface — sufficient for MCPG's cluster needs (cluster-coordinated credential…

Multi-node `cluster` coordinator backed by NATS JetStream.

Redis-backed cluster plugin. SETNX + Lua for fence-token leases (matches the lease semantics in `mcpg-state-redis::RedisLock`), PUBLISH/PSUBSCRIBE…

A credential_issuer that issues short-lived AWS credentials per request via STS AssumeRole.

A credential_issuer that issues Azure AD (Entra) bearer tokens for a downstream resource per caller request.

A credential_issuer that mints short-lived GCP credentials per caller request via the IAM Credentials REST API.

Config-driven credential_issuer that mints a freshly-signed JWT per request to assert the caller's identity to a downstream service.

Outbound OAuth 2.0 token issuer (RFC 6749 §4.4 client_credentials grant).

Outbound OAuth 2.0 token-exchange issuer (RFC 8693).

Config-driven credential_issuer plugin. Operators declare per-target credentials in YAML; the plugin returns them per-request keyed on the…

`credential_issuer` plugin. Issues per-request database credentials via Vault's database secrets engine. Maps caller `PluginIdentity` to a Vault…

Resolves cryptographic AI-agent identity from AAuth-signed requests (draft-hardt-oauth-aauth-protocol / draft-hardt-httpbis-signature-key).

Resolves caller identity from a static, operator-supplied API-key registry.

Resolves caller identity from `Authorization: Basic <b64(username:password)>` headers against an operator-supplied user registry.

Resolves caller identity from non-OIDC bearer JWTs against one or more configured issuers using STATIC keys (HS256 shared secret, or RS/ES/EdDSA…

Resolves caller identity from `Authorization: Negotiate <b64 GSSAPI token>` (HTTP Negotiate / SPNEGO, RFC 4559) by verifying the token against the…

Resolves caller identity from `Authorization: Basic <b64(username:password)>` by binding to an LDAP / Active Directory directory *as the caller* —…

Resolves caller identity from mTLS client certificates that an upstream TLS terminator (Envoy / Istio sidecar, nginx, cloud LB) forwards to the…

Resolves caller identity from OIDC / OAuth bearer tokens against one or more configured issuers.

Resolves caller identity from PASETO v4 tokens verified against operator- supplied STATIC keys: v4.public (Ed25519 signature) or v4.local (XChaCha20…

Resolves caller identity from a SAML 2.0 assertion carried in a configured header (default `X-SAML-Assertion`, base64).

Resolves caller identity from SPIFFE Verifiable Identity Documents (SVIDs).

Emits outbound webhook notifications for tool-call lifecycle events (start / complete / deny).

An audit_sink that persists every audit event as an immutable S3 object under Object Lock — write-once-read-many compliance storage for SOC2 / HIPAA…

Append-only, per-request audit trail. Records a structured entry for every tool call — identity, tool, arguments (optionally redacted), decision,…

Structured tracing output for every tool call.

TelemetrySink plugin: forwards gateway-emitted span lifecycle events (traces only) to an OpenTelemetry Collector (or any OTLP-compatible backend…

Pure metrics sink: accumulates `MetricPoint` events emitted by the gateway's metrics pipeline (Phase 6c-20 onward) into an in-memory registry keyed…

A metrics_sink that formats each metric data point as a statsd / DogStatsD line and pushes it to a UDP collector (statsd, DogStatsD, Telegraf) or to…

A log_sink that formats each gateway/plugin log record as an RFC 5424 (default) or RFC 3164 syslog line and emits it to a UDP or TCP collector, or…

Agentic Commerce Protocol support for session-bound commerce flows.

Implements the Machine Payment Protocol challenge / verify flow as a ToolGate plugin.

Universal Commerce Protocol implementation.

x402-compatible crypto micropayment gate. Issues HTTP 402 with on-chain payment instructions and verifies inbound proofs before allowing the tool…

Per-tool circuit breaker that tracks failures and short-circuits requests to unhealthy backends with fast 503 responses.

Token-bucket rate limiter with configurable keys (identity, IP, tool) and per-key refill policy.

Short-lived TTL cache for tool responses. Keyed on tool name plus a hash of the request arguments; first hit populates, subsequent hits return the…

Resolves `vault://<backend_path>#<field>` URIs against a HashiCorp Vault server.

A ToolGate that scans tool arguments (pre-dispatch) and results (post-dispatch) for secrets + PII via built-in regex detectors (AWS keys, JWTs,…

A ToolGate that encrypts named argument fields pre-dispatch and decrypts named result fields post-dispatch with XChaCha20-Poly1305.

Invokes configured external HTTP guardrail endpoints pre- and post-dispatch to approve / deny tool calls.

Admission gate that denies requests whose client IP is outside a configured CIDR allowlist.

Embedded Casbin authorization engine. Operators supply a model file (`.conf` — request shape, policy shape, matcher) + a policy file (`.csv`); the…

Embedded AWS Cedar authorization engine. Operators supply a directory of `.cedar` policy files; the plugin builds a Cedar PolicySet at boot and…

Open Policy Agent `policy_engine` plugin. Supports two modes (`mode: remote | embedded`): remote dispatches evaluations to a standalone OPA server…

A pre-dispatch ToolGate that allows tool calls only inside operator-configured weekly time windows, evaluated in a chosen IANA timezone.

A pre-dispatch ToolGate that validates tool-call arguments against an operator-supplied inline JSON Schema and rejects malformed calls with a…

Multi-vtable cdylib: a `tool_gate` that returns `PendingApproval` for matching tools, an `approval_notifier` that posts an interactive Slack message…

Converts between delimited text (CSV/TSV/…) and JSON.

Validates a JSON value against an operator-supplied inline JSON Schema.

Applies an operator-supplied JSONata expression to a JSON value.

WASI Component Model transform plugin that masks sensitive fields in tool arguments and results.

Reshapes a JSON value by rendering an operator-supplied MiniJinja (Jinja2- style) template with the value as the template context.

Converts between XML and JSON. `xml_to_json` parses an XML string into a JSON tree (attributes as `@name`, mixed text as `#text`, repeated child…

Applies an operator-supplied XSLT stylesheet to input XML.

A watch_strategy that emits a periodic resource-change tick on an operator schedule, so the gateway re-reads / re-notifies a watched resource on a…

A watch_strategy that emits a resource-change tick when a watched path (file or directory) changes — create / modify / remove by default — so the…