https://github.com/reaatech/mcp-gateway
Production MCP gateway — OAuth/OIDC + API key auth, per-tenant rate limiting, schema enforcement, tool allowlists, request/response logging, audit trail, fan-out to multiple upstream MCP servers, response caching. The Kong/Envoy for MCP.
https://github.com/reaatech/mcp-gateway
agentic-ai api-gateway audit-log auth caching fan-out mcp mcp-gateway mcp-server multi-tenant oauth oidc proxy rate-limiting reverse-proxy schema-validation security typescript
Last synced: 7 days ago
JSON representation
Production MCP gateway — OAuth/OIDC + API key auth, per-tenant rate limiting, schema enforcement, tool allowlists, request/response logging, audit trail, fan-out to multiple upstream MCP servers, response caching. The Kong/Envoy for MCP.
- Host: GitHub
- URL: https://github.com/reaatech/mcp-gateway
- Owner: reaatech
- License: mit
- Created: 2026-04-19T21:30:31.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-06-22T15:00:10.000Z (about 1 month ago)
- Last Synced: 2026-06-22T17:03:07.081Z (about 1 month ago)
- Topics: agentic-ai, api-gateway, audit-log, auth, caching, fan-out, mcp, mcp-gateway, mcp-server, multi-tenant, oauth, oidc, proxy, rate-limiting, reverse-proxy, schema-validation, security, typescript
- Language: TypeScript
- Homepage: https://reaatech.com/products/mcp-infrastructure/mcp-gateway
- Size: 412 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
- Security: docs/SECURITY.md
- Agents: AGENTS.md
Awesome Lists containing this project
README
# mcp-gateway
[](https://github.com/reaatech/mcp-gateway/actions/workflows/ci.yml)
[](LICENSE)
[](https://www.typescriptlang.org/)
> Production-grade MCP Gateway — the "Kong/Envoy for MCP." Authenticate, rate-limit, validate, cache, and fan-out requests to upstream MCP servers.
This monorepo provides a composable gateway framework with 10 independently versioned packages for building production MCP infrastructure at scale.
## Features
- **Authentication** — API keys, JWT (JWKS), OAuth2 introspection (RFC 7662), and OIDC ID token validation
- **Rate limiting** — Per-tenant token bucket with Redis or in-memory backends, daily quota tracking
- **Schema validation** — JSON-RPC 2.0 and MCP method payload validation with custom per-tool schemas
- **Tool allowlists** — Per-tenant tool access control with wildcard pattern matching and rollback support
- **Fan-out routing** — Multi-upstream broadcasting with three aggregation strategies, circuit breaker, and retry logic
- **Response caching** — Redis or in-memory LRU cache with per-tool TTL strategies and `Cache-Control` bypass
- **Audit trail** — Structured JSONL audit logging with tamper-evident chaining and query API
- **Observability** — OpenTelemetry auto-initialization, pre-built metrics, distributed tracing, and health checks
- **Framework-agnostic** — Auth, rate-limit, allowlist, audit, and cache each expose a framework-neutral core plus thin **Express and Fastify** adapters, so the full pipeline runs on either stack with the same tenant context
## Installation
### Using the packages
Packages are published under the `@reaatech` scope and can be installed individually:
```bash
# Core types, config, and logging (required by all other packages)
pnpm add @reaatech/mcp-gateway-core
# Authentication strategies
pnpm add @reaatech/mcp-gateway-auth
# Rate limiting
pnpm add @reaatech/mcp-gateway-rate-limit
# Response caching
pnpm add @reaatech/mcp-gateway-cache
# Tool allowlists
pnpm add @reaatech/mcp-gateway-allowlist
# Schema validation
pnpm add @reaatech/mcp-gateway-validation
# Fan-out routing and MCP client
pnpm add @reaatech/mcp-gateway-fanout
# Audit trail logging
pnpm add @reaatech/mcp-gateway-audit
# OpenTelemetry observability
pnpm add @reaatech/mcp-gateway-observability
# Full gateway server with CLI
pnpm add @reaatech/mcp-gateway-gateway
```
### Contributing
```bash
git clone https://github.com/reaatech/mcp-gateway.git
cd mcp-gateway
pnpm install
pnpm build
pnpm test
pnpm lint
pnpm typecheck
```
## Quick Start
Run the gateway server:
```bash
npx mcp-gateway start --port 8080 --config gateway.yaml
```
Or programmatically:
```typescript
import { createApp } from "@reaatech/mcp-gateway-gateway";
const gateway = createApp();
gateway.app.listen(8080, () => console.log("Gateway listening on :8080"));
```
## Framework support (Express + Fastify)
The auth, rate-limit, allowlist, audit, and cache packages are framework-agnostic.
Each ships the existing **Express** middleware on its main entry plus a **Fastify**
plugin under the `./fastify` subpath. `fastify` is an optional peer dependency, so
Express-only consumers never pull it in.
```typescript
import Fastify from "fastify";
import { fastifyAuth } from "@reaatech/mcp-gateway-auth/fastify";
import { fastifyRateLimit } from "@reaatech/mcp-gateway-rate-limit/fastify";
import { fastifyAllowlist } from "@reaatech/mcp-gateway-allowlist/fastify";
import { fastifyAudit } from "@reaatech/mcp-gateway-audit/fastify";
import { fastifyCache } from "@reaatech/mcp-gateway-cache/fastify";
const app = Fastify();
// Register in the same order as the Express pipeline so the tenant resolved by
// auth flows through every later stage:
await app.register(fastifyAuth); // decorates request.tenantId
await app.register(fastifyRateLimit, { limiter });
await app.register(fastifyAllowlist);
await app.register(fastifyAudit, { logger });
await app.register(fastifyCache, { redis, config }); // Redis-backed
app.post("/mcp", async (request) => handleMcp(request));
```
**Recommended order:** `auth → rate-limit → allowlist → audit → cache`. Downstream
plugins read the tenant from the auth decoration (`request.tenantId` /
`request.authContext`), never from a spoofable header — exactly as the Express
path reads `req.authContext`. See each package's README and
[`ARCHITECTURE.md`](./ARCHITECTURE.md) for details.
## Packages
| Package | Description |
|---------|-------------|
| [`@reaatech/mcp-gateway-core`](./packages/core) | Types, schemas, config loading, logging, and utilities |
| [`@reaatech/mcp-gateway-auth`](./packages/auth) | API key, JWT, OAuth2, and OIDC authentication |
| [`@reaatech/mcp-gateway-rate-limit`](./packages/rate-limit) | Per-tenant rate limiting with token bucket algorithm |
| [`@reaatech/mcp-gateway-cache`](./packages/cache) | Redis/in-memory response caching with per-tool TTL strategies |
| [`@reaatech/mcp-gateway-allowlist`](./packages/allowlist) | Per-tenant tool access control with wildcard patterns |
| [`@reaatech/mcp-gateway-validation`](./packages/validation) | JSON Schema validation for MCP protocol messages |
| [`@reaatech/mcp-gateway-fanout`](./packages/fanout) | Multi-upstream fan-out routing and MCP client connections |
| [`@reaatech/mcp-gateway-audit`](./packages/audit) | Compliance audit trail with tamper-evident chaining |
| [`@reaatech/mcp-gateway-observability`](./packages/observability) | OpenTelemetry tracing, metrics, and health checks |
| [`@reaatech/mcp-gateway-gateway`](./packages/gateway) | Full Express 5 gateway server with CLI |
## Documentation
- [`ARCHITECTURE.md`](./ARCHITECTURE.md) — System design, package relationships, and data flows
- [`AGENTS.md`](./AGENTS.md) — Coding conventions and development guidelines
- [`GITHUB_TO_NPM.md`](./GITHUB_TO_NPM.md) — Publishing runbook for npm and GitHub Packages
- [`CONTRIBUTING.md`](./CONTRIBUTING.md) — Contribution workflow and release process
- [`docs/`](./docs/) — Deep dives on configuration, security, and deployment
## License
[MIT](LICENSE)