{"id":51702366,"url":"https://github.com/reaatech/mcp-gateway","last_synced_at":"2026-07-16T12:30:58.686Z","repository":{"id":352523800,"uuid":"1215400318","full_name":"reaatech/mcp-gateway","owner":"reaatech","description":"Production MCP gateway — OAuth/OIDC + API key auth, per-tenant rate limiting, schema enforcement, tool allowlists, request/response logging, audit trail, fan-out to multiple upstream MCP servers, response caching. The Kong/Envoy for MCP.","archived":false,"fork":false,"pushed_at":"2026-06-22T15:00:10.000Z","size":422,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-22T17:03:07.081Z","etag":null,"topics":["agentic-ai","api-gateway","audit-log","auth","caching","fan-out","mcp","mcp-gateway","mcp-server","multi-tenant","oauth","oidc","proxy","rate-limiting","reverse-proxy","schema-validation","security","typescript"],"latest_commit_sha":null,"homepage":"https://reaatech.com/products/mcp-infrastructure/mcp-gateway","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/reaatech.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"docs/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-04-19T21:30:31.000Z","updated_at":"2026-06-22T15:00:26.000Z","dependencies_parsed_at":"2026-06-22T17:00:42.238Z","dependency_job_id":null,"html_url":"https://github.com/reaatech/mcp-gateway","commit_stats":null,"previous_names":["reaatech/mcp-gateway"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/reaatech/mcp-gateway","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reaatech%2Fmcp-gateway","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reaatech%2Fmcp-gateway/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reaatech%2Fmcp-gateway/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reaatech%2Fmcp-gateway/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/reaatech","download_url":"https://codeload.github.com/reaatech/mcp-gateway/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reaatech%2Fmcp-gateway/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35544514,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agentic-ai","api-gateway","audit-log","auth","caching","fan-out","mcp","mcp-gateway","mcp-server","multi-tenant","oauth","oidc","proxy","rate-limiting","reverse-proxy","schema-validation","security","typescript"],"created_at":"2026-07-16T12:30:58.164Z","updated_at":"2026-07-16T12:30:58.677Z","avatar_url":"https://github.com/reaatech.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mcp-gateway\n\n[![CI](https://github.com/reaatech/mcp-gateway/actions/workflows/ci.yml/badge.svg)](https://github.com/reaatech/mcp-gateway/actions/workflows/ci.yml)\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)\n[![TypeScript](https://img.shields.io/badge/TypeScript-5.8-blue)](https://www.typescriptlang.org/)\n\n\u003e Production-grade MCP Gateway — the \"Kong/Envoy for MCP.\" Authenticate, rate-limit, validate, cache, and fan-out requests to upstream MCP servers.\n\nThis monorepo provides a composable gateway framework with 10 independently versioned packages for building production MCP infrastructure at scale.\n\n## Features\n\n- **Authentication** — API keys, JWT (JWKS), OAuth2 introspection (RFC 7662), and OIDC ID token validation\n- **Rate limiting** — Per-tenant token bucket with Redis or in-memory backends, daily quota tracking\n- **Schema validation** — JSON-RPC 2.0 and MCP method payload validation with custom per-tool schemas\n- **Tool allowlists** — Per-tenant tool access control with wildcard pattern matching and rollback support\n- **Fan-out routing** — Multi-upstream broadcasting with three aggregation strategies, circuit breaker, and retry logic\n- **Response caching** — Redis or in-memory LRU cache with per-tool TTL strategies and `Cache-Control` bypass\n- **Audit trail** — Structured JSONL audit logging with tamper-evident chaining and query API\n- **Observability** — OpenTelemetry auto-initialization, pre-built metrics, distributed tracing, and health checks\n- **Framework-agnostic** — Auth, rate-limit, allowlist, audit, and cache each expose a framework-neutral core plus thin **Express and Fastify** adapters, so the full pipeline runs on either stack with the same tenant context\n\n## Installation\n\n### Using the packages\n\nPackages are published under the `@reaatech` scope and can be installed individually:\n\n```bash\n# Core types, config, and logging (required by all other packages)\npnpm add @reaatech/mcp-gateway-core\n\n# Authentication strategies\npnpm add @reaatech/mcp-gateway-auth\n\n# Rate limiting\npnpm add @reaatech/mcp-gateway-rate-limit\n\n# Response caching\npnpm add @reaatech/mcp-gateway-cache\n\n# Tool allowlists\npnpm add @reaatech/mcp-gateway-allowlist\n\n# Schema validation\npnpm add @reaatech/mcp-gateway-validation\n\n# Fan-out routing and MCP client\npnpm add @reaatech/mcp-gateway-fanout\n\n# Audit trail logging\npnpm add @reaatech/mcp-gateway-audit\n\n# OpenTelemetry observability\npnpm add @reaatech/mcp-gateway-observability\n\n# Full gateway server with CLI\npnpm add @reaatech/mcp-gateway-gateway\n```\n\n### Contributing\n\n```bash\ngit clone https://github.com/reaatech/mcp-gateway.git\ncd mcp-gateway\n\npnpm install\npnpm build\npnpm test\npnpm lint\npnpm typecheck\n```\n\n## Quick Start\n\nRun the gateway server:\n\n```bash\nnpx mcp-gateway start --port 8080 --config gateway.yaml\n```\n\nOr programmatically:\n\n```typescript\nimport { createApp } from \"@reaatech/mcp-gateway-gateway\";\n\nconst gateway = createApp();\ngateway.app.listen(8080, () =\u003e console.log(\"Gateway listening on :8080\"));\n```\n\n## Framework support (Express + Fastify)\n\nThe auth, rate-limit, allowlist, audit, and cache packages are framework-agnostic.\nEach ships the existing **Express** middleware on its main entry plus a **Fastify**\nplugin under the `./fastify` subpath. `fastify` is an optional peer dependency, so\nExpress-only consumers never pull it in.\n\n```typescript\nimport Fastify from \"fastify\";\nimport { fastifyAuth } from \"@reaatech/mcp-gateway-auth/fastify\";\nimport { fastifyRateLimit } from \"@reaatech/mcp-gateway-rate-limit/fastify\";\nimport { fastifyAllowlist } from \"@reaatech/mcp-gateway-allowlist/fastify\";\nimport { fastifyAudit } from \"@reaatech/mcp-gateway-audit/fastify\";\nimport { fastifyCache } from \"@reaatech/mcp-gateway-cache/fastify\";\n\nconst app = Fastify();\n\n// Register in the same order as the Express pipeline so the tenant resolved by\n// auth flows through every later stage:\nawait app.register(fastifyAuth);                    // decorates request.tenantId\nawait app.register(fastifyRateLimit, { limiter });\nawait app.register(fastifyAllowlist);\nawait app.register(fastifyAudit, { logger });\nawait app.register(fastifyCache, { redis, config }); // Redis-backed\n\napp.post(\"/mcp\", async (request) =\u003e handleMcp(request));\n```\n\n**Recommended order:** `auth → rate-limit → allowlist → audit → cache`. Downstream\nplugins read the tenant from the auth decoration (`request.tenantId` /\n`request.authContext`), never from a spoofable header — exactly as the Express\npath reads `req.authContext`. See each package's README and\n[`ARCHITECTURE.md`](./ARCHITECTURE.md) for details.\n\n## Packages\n\n| Package | Description |\n|---------|-------------|\n| [`@reaatech/mcp-gateway-core`](./packages/core) | Types, schemas, config loading, logging, and utilities |\n| [`@reaatech/mcp-gateway-auth`](./packages/auth) | API key, JWT, OAuth2, and OIDC authentication |\n| [`@reaatech/mcp-gateway-rate-limit`](./packages/rate-limit) | Per-tenant rate limiting with token bucket algorithm |\n| [`@reaatech/mcp-gateway-cache`](./packages/cache) | Redis/in-memory response caching with per-tool TTL strategies |\n| [`@reaatech/mcp-gateway-allowlist`](./packages/allowlist) | Per-tenant tool access control with wildcard patterns |\n| [`@reaatech/mcp-gateway-validation`](./packages/validation) | JSON Schema validation for MCP protocol messages |\n| [`@reaatech/mcp-gateway-fanout`](./packages/fanout) | Multi-upstream fan-out routing and MCP client connections |\n| [`@reaatech/mcp-gateway-audit`](./packages/audit) | Compliance audit trail with tamper-evident chaining |\n| [`@reaatech/mcp-gateway-observability`](./packages/observability) | OpenTelemetry tracing, metrics, and health checks |\n| [`@reaatech/mcp-gateway-gateway`](./packages/gateway) | Full Express 5 gateway server with CLI |\n\n## Documentation\n\n- [`ARCHITECTURE.md`](./ARCHITECTURE.md) — System design, package relationships, and data flows\n- [`AGENTS.md`](./AGENTS.md) — Coding conventions and development guidelines\n- [`GITHUB_TO_NPM.md`](./GITHUB_TO_NPM.md) — Publishing runbook for npm and GitHub Packages\n- [`CONTRIBUTING.md`](./CONTRIBUTING.md) — Contribution workflow and release process\n- [`docs/`](./docs/) — Deep dives on configuration, security, and deployment\n\n## License\n\n[MIT](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freaatech%2Fmcp-gateway","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Freaatech%2Fmcp-gateway","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freaatech%2Fmcp-gateway/lists"}