37 plugins. 13 categories.
The MCPG gateway is a thin shell — power lives in plugins. Native Rust for performance-critical paths, WASM Component Model for sandboxed transforms, all Ed25519-signed and distributed via OCI. Compose any combination.
Identity
5 pluginsStatic-registry API-key resolution with constant-time digest match — zero external backend.
HTTP Basic auth with argon2 + bcrypt password hashing and htpasswd migration.
mTLS identity via header injection from upstream TLS termination.
OIDC/OAuth with SSRF guard, JWKS refresh circuit breaker, multi-provider support.
SPIFFE X.509 + JWT-SVID with SPIRE Workload API streaming and hot-reload.
Policy
3 pluginsAWS Cedar engine, in-process sub-millisecond eval, hot-reload + @advice / @redact annotations.
OPA in remote (REST) or embedded WASM mode via opa build.
Casbin RBAC/ABAC with explain-deny support and incremental edits.
Security
3 pluginsHTTP webhook callouts with CEL triggers — content scanning, PDP, approval workflows.
CIDR-based client IP filtering with glob pattern matching.
Human approval gate via Slack interactive messages before sensitive tool calls.
Reliability
3 pluginsPer-tool failure tracking with open/half-open/closed states.
Per-identity / per-tool / per-session throttling with glob matching.
Per-tool TTL cache with identity scoping and eviction.
Observability
2 pluginsStructured audit events, pluggable sinks, automatic credential redaction.
Tool-call request/response logging with sampling and redaction.
Transforms
1 pluginWASM Component Model transform — masks PII fields (SSN, card, password) pre + post dispatch.
Integrations
1 pluginFire-and-forget HTTP POST for tool-call lifecycle events.
Bindings
3 pluginsPostgreSQL / MySQL / SQLite via sqlx — parameterized queries, RLS, transactions, driver-level cancel.
Kafka request/reply dispatch + topic resource watches with OIDC auth.
NATS request/reply + Core subject watches with queue-group load balancing.
Payments
4 pluginsMachine Payment Protocol — HMAC-bound challenges and USDC charge model.
Coinbase x402 crypto micropayments (HTTP 402 Payment Required).
Universal Commerce Protocol with merchant discovery.
Agentic Commerce Protocol with merchant API callouts.
Credential
2 pluginsConfig-driven static credentials (API keys, tokens, passwords).
HashiCorp Vault dynamic DB credentials with lease-tracked auto-rotation.
Backends
7 pluginsDistributed session/task/pipeline storage + delivery bus via Redis hash + pub/sub.
Distributed storage via NATS JetStream KV + Core pub/sub.
Redis-backed cache (responses, JWKS, rate-limit counters) with atomic Lua scripts.
Vault KV v2 secret resolution (vault://) with lease auto-renewal and native watch.
Cluster coordination via Consul: peer discovery, events, sessions, KV CAS, long-poll watches.
Cluster coordination via etcd v3 gRPC: KV, native Watch, leases, auto-compaction.
Cluster coordination via NATS JetStream: KV leases, fencing, heartbeat presence, CAS leadership.
Catalog
1 pluginBuilt-in MCP catalog provider with operator-defined schema.
Testing
2 pluginsReference native Rust plugin — minimal canonical example.
WASM tool-gate harness for plugin authors.
Build your own.
The plugin protocol is documented, versioned, and stable. Native Rust uses the mcpg-plugin-sdk crate; WASM uses the Component Model with WIT bindings. Sign your artifact with mcpg-plugins sign and publish to any OCI registry.