MCP Gateway — v1.0

Every AI tool call,
governed.

MCP Gateway intercepts and enforces policy on every request your AI assistant makes — before secrets leave your environment, before unauthorized tools run, before you find out the hard way what was in that npm package.

Provision a workspace See how it works

Free plan · No credit card · Workspace ready in 60 seconds

The problem

MCP servers run with full access
to your environment.

Every AI coding assistant that supports MCP can call any installed server — with your credentials, your filesystem access, your API keys.

No visibility

You don't know what ran

There's no default log of which tools were called, what arguments they received, or what data they returned. If something goes wrong, the audit trail doesn't exist.

No control

Any tool, any time

An installed MCP server can expose any tool it wants. There's no mechanism to restrict which tools your AI is allowed to call — or which servers it can connect to.

No supply chain

npm install is not a vetting process

MCP servers are npm packages, Docker images, Python scripts. You're trusting the entire dependency tree. No SBOM. No CVE check. No signature verification.

What the gateway does

Protection at the protocol level.

The gateway sits between your AI client and every MCP server it talks to. Local stdio servers and remote HTTP servers — same policy model, same enforcement.

Local protection

Intercept stdio traffic on the workstation

For MCP servers installed locally — npm packages, Python scripts, binaries — the gateway launches them as child processes and proxies all JSON-RPC traffic. Policy is enforced from cached, cryptographically signed artifacts, so enforcement works offline without a network call on every request.

mode: local · policy: cached + signed ed25519 · offline-capable

HTTP gateway

Govern remote MCP servers at the network level

Deploy as a network service for HTTP MCP servers. Each authenticated tenant session runs in isolation. Security headers hardened, request timeouts enforced, body size limited, panics caught before they reach users. Health endpoints included for Kubernetes readiness probes.

mode: http · per-session isolation · 10 MiB limit · security headers

SBOM + CVE

Scan every server before it's approved

Submit a server by npm package name, Docker image, or pip module. The inspector installs it, runs Trivy, and produces a CycloneDX SBOM. CVEs matched against OSV, GitHub Advisory, and NVD. Results cached and shared across tenants.

trivy · cyclonedx · os + npm + pip + cargo

Secrets detection

Catch exfiltration in the payload

The scanner runs on every tools/call request and every result before they're forwarded. 40+ patterns: AWS, Azure, GCP keys, private keys, API tokens, JWTs. Set per-server: warn, redact the matched value, or deny the entire call.

scanner.finding · [REDACTED:aws-key] · warn | redact | deny

Tool audit

A record of everything that ran

Every tools/call generates a signed audit event: tool name, subject, outcome, timestamp. Denied calls are recorded with the reason. Route to your SIEM over a persistent connection, or retain locally with replay on reconnect.

tool.call.request · tool.call.denied · tool.call.result

Version monitoring

Hold new versions until you've reviewed them

The gateway detects when a new version of an approved server appears on the workstation. A configurable hold period keeps clients on the current approved version while you review the SBOM and CVE report for the new one.

server.version.change · hold: 7d · policy.approved

How it works

From zero to enforced in three steps.

The steps are genuinely ordered — each one builds on the last.

Submit servers for inspection

Point the CLI or UI at an npm package, Docker image, or pip module. The inspector installs it in isolation, generates the SBOM, and runs the CVE scan. You see the results before approving anything.

$ mcpgw server submit \ --type npm \ --name "@modelcontextprotocol/server-github" \ --version 2.0.9 ✓ scan complete · 0 CRITICAL · 2 HIGH

Define policies

Specify which tools each user or group can call, which versions are allowed, and what the scanner should do if it finds a secret. Policies are signed with ed25519 and distributed as offline-capable artifacts.

$ mcpgw policy create \ --server github \ --subject dev-team \ --allow create_issue,list_commits \ --scanner-action redact ✓ policy signed · version 847

Route traffic through the gateway

Point your MCP client at the gateway instead of the server directly. Local stdio mode wraps child processes. HTTP mode runs as a network proxy. Your AI assistant sees only the tools you approved.

$ mcpgw status ✓ policy loaded · servers 12 · tools 47 ✓ subject dev@acme.co · mode local

Pricing

Start free. Pay when you scale.

Every paid plan is provisioned on the spot. No waiting on a sales call to get started.

Free

$0

forever

For individuals and small teams evaluating governed MCP access.

  • 3 users
  • 4 approved MCP servers
  • Local stdio gateway
  • Secrets detection (warn + redact)
  • Tool audit trail, 30-day retention
  • Community support

Pro

$149

per month

For teams that need the HTTP gateway, full scanning, and audit export.

  • 25 users
  • Unlimited approved servers
  • Local + HTTP gateway
  • SBOM scanning + CVE reports
  • Secrets detection (deny mode)
  • SIEM export
  • 1-year audit retention
  • Version hold policies
  • Email support

Enterprise

Custom

contact us

For organizations that need air-gap deployment, custom rules, and a dedicated SLA.

  • Unlimited users
  • Air-gap / on-premises deployment
  • Custom scanner rules and patterns
  • PII detection
  • SAML / OIDC SSO
  • Custom audit retention
  • Dedicated support + SLA
Contact sales