MCP.so
Sign In

MCP Gateway

@lasso-security

RepositoryHomepage

About MCP Gateway

A plugin-based gateway that orchestrates other MCPs and allows developers to build upon it enterprise-grade agents.

#python#agent#proxy#mcp#gateway#generative-ai#gen-ai#genai#genai-security#mcp-server#mcp-client#agent-security#mcp-security

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-gateway": {
      "command": "mcp-gateway",
      "args": [
        "--mcp-json-path",
        "~/.cursor/mcp.json",
        "--enable-guardrails",
        "basic",
        "--enable-guardrails",
        "presidio"
      ],
      "servers": {}
    }
  }
}

Tools

2

Provides information about all available proxied MCPs to help LLMs choose appropriate tools and resources

Executes capabilities from any proxied MCP after sanitizing the request and response

Overview

What is MCP Gateway?

MCP Gateway is an intermediary between large language models and other MCP servers. It centralizes and enhances AI infrastructure by reading server configurations from a mcp.json file, managing server lifecycles, intercepting requests and responses to sanitize sensitive information, and providing a unified interface to discover and interact with all proxied servers. It also includes a security scanner that analyzes server reputation and risks before loading.

How to use MCP Gateway?

Install with pip install mcp-gateway. Start the server by running mcp-gateway with the --mcp-json-path flag pointing to your configuration file and the --plugin flag for each plugin to enable (e.g., -p basic -p presidio). You can also run it inside Docker or as a Python module. Configuration is placed under the mcpServers key in your editor’s settings (Cursor, Claude Desktop, etc.) with the gateway itself configured as an MCP server.

Key features of MCP Gateway

  • Automatically masks common secrets (API keys, tokens, etc.)
  • PII masking via the Presidio plugin (credit cards, emails, etc.)
  • Lasso Security guardrails for prompt injection and data leakage
  • Tracing and monitoring of all tool calls with the Xetrack plugin
  • Unified interface to discover and invoke tools from all proxied MCPs
  • Security scanner that checks server reputation before loading

Use cases of MCP Gateway

  • Protect sensitive credentials and PII from exposure to LLMs.
  • Audit and debug MCP tool usage with request/response logs.
  • Centralize management of multiple MCP servers behind one endpoint.
  • Enforce custom AI safety policies with a cloud-based guardrail.

FAQ from MCP Gateway

What plugins are available out of the box?

The README describes three guardrail plugins: basic (secret masking), presidio (PII masking), and lasso (full security guardrails). There is also a tracing plugin called xetrack.

How do I install the Presidio plugin?

pip install mcp-gateway[presidio] installs the extra dependency required for PII masking.

Does MCP Gateway require an API key?

Only the lasso plugin requires a LASSO_API_KEY environment variable (obtained from Lasso Security). The other plugins work without an external API key.

How are MCP servers configured under the gateway?

You place other MCP server configurations inside a "servers" key within the gateway’s own entry in your mcpServers configuration. The gateway reads them from the mcp.json file specified with --mcp-json-path.

Where are logs and trace data stored?

For the xetrack plugin, logs are written to a file path set via XETRACK_LOGS_PATH, and structured data is stored in an SQLite database at the path set via XETRACK_DB_PATH.

Frequently asked questions

What plugins are available out of the box?

The README describes three guardrail plugins: `basic` (secret masking), `presidio` (PII masking), and `lasso` (full security guardrails). There is also a tracing plugin called `xetrack`.

How do I install the Presidio plugin?

`pip install mcp-gateway[presidio]` installs the extra dependency required for PII masking.

Does MCP Gateway require an API key?

Only the `lasso` plugin requires a `LASSO_API_KEY` environment variable (obtained from Lasso Security). The other plugins work without an external API key.

How are MCP servers configured under the gateway?

You place other MCP server configurations inside a `"servers"` key within the gateway’s own entry in your `mcpServers` configuration. The gateway reads them from the `mcp.json` file specified with `--mcp-json-path`.

Where are logs and trace data stored?

For the `xetrack` plugin, logs are written to a file path set via `XETRACK_LOGS_PATH`, and structured data is stored in an SQLite database at the path set via `XETRACK_DB_PATH`.

Comments

Basic information

Category

Developer Tools

License

MIT

Transports

stdio

Author

lasso-security

More Developer Tools MCP servers

CodeSentinel

icohangar-ops

Codebase health as MCP tools: dead code, circular dependencies, coupling, architectural drift.

Altronis

sypherin

MCP server + CLI for Altronis — Singapore AI consulting. Ask the Lyra consultant, generate a grant-matched AI transformation plan, pull curated SG AI events/news. Read-only, wraps altronis.sg.

Repo Test Architect

RepoAssay

Local-first, read-only MCP server for evidence-backed repository test architecture audits and test planning.

Apiosk

obcraft

AI-native payments for tools and APIs. Discover, pay for, execute, and publish monetized APIs directly from your agent, settled per call in USDC over x402, through the Model Context Protocol. payments · finance · x402 ·

CircleCI MCP Server

CircleCI

Manage CI/CD pipelines, debug failed builds, and optimize test suites directly from your AI agents - no terminal required. The CircleCI MCP Server is a remote server hosted by CircleCI that connects AI tools and agents