mcp-gateway · packages

Enforces per-tenant tool access control for MCP gateways using wildcard pattern matching and versioned allowlists. It provides a utility function for access checks and an Express middleware that returns JSON-RPC error responses for unauthorized requests.

Captures and stores security-relevant audit events for the MCP Gateway using a set of logger classes and a query service. It provides structured JSON output, tamper-evident SHA-256 chaining, and support for console, file, or in-memory storage backends.

Provides Express middleware that validates API keys, JWTs, OAuth2 introspection, or OIDC tokens to secure MCP Gateway requests. It attaches a typed `AuthContext` to the request object and includes utility functions for scope checking and audit-friendly token fingerprinting.

Provides response caching for MCP gateways using either an in-memory LRU or Redis backend. It exports an Express middleware and a `CacheManager` class that supports per-tool TTL strategies and `Cache-Control` header handling.

Provides shared TypeScript interfaces, Zod validation schemas, and configuration management utilities for the MCP Gateway ecosystem. It includes SSRF-protected URL validation, YAML-based tenant registry loading, and a Pino-based structured logger.

Orchestrate requests across multiple MCP server upstreams using fan-out strategies like first-success, all-wait, or majority-vote. This library provides functions for weighted upstream selection, circuit breaking, and exponential backoff retries to manage resilient communication with remote MCP services.

Provides a full-featured Model Context Protocol (MCP) gateway server as an Express 5 application, complete with built-in authentication, rate limiting, schema validation, and OpenTelemetry observability. It includes a `createApp()` factory for programmatic configuration and a CLI binary for managing deployments, diagnostics, and health checks.

Provides OpenTelemetry instrumentation, pre-configured metrics, and health check utilities for the MCP Gateway. It exports functions for registering custom health probes and initializes standard OTel tracing and Pino-based structured logging.

Enforces per-tenant rate limits using a token bucket algorithm with support for in-memory or Redis-backed storage. It provides an Express middleware function and a set of utility classes for tracking request quotas and managing standard rate-limit HTTP headers.

Validates MCP protocol messages and custom tool arguments against JSON Schemas using AJV. It provides an Express middleware for JSON-RPC 2.0 request validation and a schema manager for registering and versioning tool-specific input and output schemas.