Enterprise Mcp Gateway

io.github.BenjaminJPublished by GitHub account BenjaminJv1.0.0Updated Oct 24, 2026

Production-grade MCP Gateway in Go with RBAC, in-flight PII redaction, and audit logging.

VerifiedSTDIODesktop onlyCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A self-hosted Go MCP gateway that exposes enterprise backends as tools, with role-based tool access, PII redaction and JSON audit logging.

What you can do
Register MCP tools automatically from OpenAPI 3.0 or Swagger specs and route calls to backend services such as CRM endpoints, Java/Go microservices and databases, including example tools like listing customers, fetching customer details and creating support tickets (per the README). Filter which tools each caller can see and call according to token-to-role rules. Redact credit cards, SSNs, emails, phone numbers, AWS keys, JWTs, GitHub tokens and custom patterns from tool responses before they reach the model. Emit structured JSON audit records with caller identity, tool name, hashed parameters, latency and redaction counts. Serve over stdio for desktop clients or over HTTP SSE for shared or,
When to use it
Use it when an organization wants a single governed entry point between AI assistants and internal APIs, and needs per-role tool permissions, PII masking and an audit trail. It suits teams already documenting backends with OpenAPI specs who want tools generated without writing glue code.
Requirements
Runs as a local process built from source with Go 1.24 or later, or as a Docker image; no package is published. Needs a YAML config file listing tokens, roles, sanitizer rules, audit settings and OpenAPI connector specs, plus reachable backend services. The token is passed on the command line and backend credentials are set in the connector headers in the config.
Before you install
The README passes the role token as a command-line argument, which can be visible in process listings and client config files; treat those tokens as secrets. Backend credentials such as the Authorization header value sit in the config file. The gateway can create records such as support tickets, so role rules should be reviewed before granting write access. Audit logs record caller identity and tool usage, and redaction depends on the configured rules being complete.

Installation

In SourceWeft

  1. Open Enterprise Mcp Gateway in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Enterprise MCP Gateway

[CI Status] [Last Commit] [Go Version] [MCP Version] [Glama Score] [Security] [License]

Production-grade, high-performance Model Context Protocol (MCP) Gateway in Go.
A secure, audited, and PII-sanitized bridge connecting AI agents (Claude Desktop, Cursor, Antigravity, LangGraph) to enterprise backends (OpenAPI, Java/Spring Boot, Go microservices, relational databases).

[enterprise-mcp-gateway Glama Card]

[Enterprise MCP Gateway Live Demo]
Live Demo: AI Agent querying CRM with in-flight PII & card redaction (left) while the Gateway streams structured JSON audit logs in real-time (right).

🚀 Key Features

  • ⚡ Blazing Fast & Lightweight: Single static Go binary (<25MB resident memory footprint, sub-millisecond routing overhead, zero external runtime dependencies).
  • 🛡️ High-Performance PII & Secret Redaction: Real-time stream and JSON-key masking (Credit Cards with Luhn checksum validation, SSNs, emails, phone numbers, AWS keys, JWTs, GitHub PATs, and custom regex rules) before tool responses reach LLMs.
  • 🔐 Role-Based Tool Governance (RBAC): Token-to-role resolution that limits tool visibility in tools/list and enforces execution permissions during tools/call.
  • 🔌 Dynamic OpenAPI / Swagger Connector: Instantly registers validated MCP tools directly from OpenAPI 3.0/Swagger YAML or JSON specs without writing backend glue code.
  • 📜 Structured JSON Audit Logging: Emits tamper-resistant, structured JSON logs containing caller identity, tool invoked, SHA-256 hashed parameters, execution latency, and PII redaction metrics.
  • 🔄 Dual Transport Support: Fully compliant JSON-RPC 2.0 engine supporting both standard stdio (for Claude Desktop / Cursor) and HTTP Server-Sent Events (SSE) for distributed microservices.

🏗️ Architecture

┌────────────────────────────────────────────────────────┐│           AI Client (Claude / Cursor / Agent)          │└──────────────────────────┬─────────────────────────────┘                           │ JSON-RPC 2.0 (stdio or SSE)                           ▼┌────────────────────────────────────────────────────────┐│           Enterprise MCP Gateway (Single Go Binary)    ││                                                        ││  1. Transport Layer (pkg/mcp/transport)                ││     - Stdio & HTTP-SSE Transceivers                    ││  2. Security & Auth Guard (pkg/governance/rbac)        ││     - Token authentication & least-privilege filtering ││  3. Router & Tool Registry (pkg/mcp/protocol)          ││     - JSON-RPC 2.0 & MCP handshake engine              ││  4. Backend Dispatcher (pkg/connector/openapi)         ││     - Dynamic OpenAPI 3.0 path/query/body mapper       ││  5. Sanitization Engine (pkg/sanitizer/pii)            ││     - Zero-alloc PII, secret, & JSON key redactor      ││  6. Structured Audit Logger (pkg/audit)                ││     - Cryptographic JSON event trail for SIEM          │└──────────────────────────┬─────────────────────────────┘                           │ Authorized & Sanitized Calls                           ▼┌────────────────────────────────────────────────────────┐│      Internal Enterprise Services (Java / Go / DBs)    │└────────────────────────────────────────────────────────┘

📦 Quick Start

1. Build from Source

Ensure you have Go 1.24+ installed:

bash
# Clone the repositorygit clone https://github.com/BenjaminJ/enterprise-mcp-gateway.gitcd enterprise-mcp-gateway
# Build gateway and mock backend servergo build -o bin/mcp-gateway ./cmd/gatewaygo build -o bin/mockserver ./cmd/mockserver

2. Run the Mock Enterprise Backend (Terminal 1)

bash
./bin/mockserver --port 8081

3. Run the Gateway with Sample Config (Terminal 2)

Option A: Stdio Mode (Default)
bash
./bin/mcp-gateway --config ./examples/config.yaml --token "agent-support-key"
Option B: HTTP Server-Sent Events (SSE) Mode
bash
./bin/mcp-gateway --config ./examples/config.yaml --transport sse --port 8080

4. Stream Live Audit Logs in Real-Time (Terminal 3)

Follow and format structured audit records as tools execute:

PowerShell (Windows):

powershell
Get-Content -Path .\audit.log -Wait -Tail 10 | ForEach-Object {    if ($_ -match '^\s*\{') {        $e = $_ | ConvertFrom-Json        $time = ([DateTime]$e.timestamp).ToLocalTime().ToString("HH:mm:ss")        $statusColor = if ($e.status -eq "SUCCESS") { "Green" } else { "Red" }        $redactColor = if ($e.pii_redacted_count -gt 0) { "Yellow" } else { "DarkGray" }        Write-Host "[$time] " -NoNewline -ForegroundColor DarkGray        Write-Host "[$($e.status)] " -NoNewline -ForegroundColor $statusColor        Write-Host "$($e.tool) " -NoNewline -ForegroundColor Cyan        Write-Host "(Role: $($e.role), Latency: $($e.duration_ms)ms, Redacted: $($e.pii_redacted_count))" -ForegroundColor $redactColor    }}

Bash / Linux / macOS (jq):

bash
tail -f audit.log | jq -c '{time: .timestamp, status: .status, tool: .tool, role: .role, latency_ms: .duration_ms, redacted: .pii_redacted_count}'

🔍 Verification with Anthropic Official MCP Inspector

You can test and inspect the gateway using Anthropic's official @modelcontextprotocol/inspector:

Test via Stdio:

bash
npx @modelcontextprotocol/inspector ./bin/mcp-gateway --config ./examples/config.yaml --token agent-support-key

Test via SSE:

  1. Start the gateway in SSE mode:
    bash
    ./bin/mcp-gateway --config ./examples/config.yaml --transport sse --port 8080
  2. Open the inspector pointing to the SSE endpoint:
    bash
    npx @modelcontextprotocol/inspector http://localhost:8080/sse

💻 Claude Desktop Integration

To connect Claude Desktop to your enterprise systems through enterprise-mcp-gateway:

  1. Open your Claude Desktop configuration file:

    • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
    • Linux: ~/.config/Claude/claude_desktop_config.json
    • Windows: %APPDATA%\Claude\claude_desktop_config.json

  2. Add enterprise-mcp-gateway to the mcpServers object:

json
{  "mcpServers": {    "enterprise-gateway": {      "command": "/absolute/path/to/enterprise-mcp-gateway/bin/mcp-gateway",      "args": [        "--config",        "/absolute/path/to/enterprise-mcp-gateway/examples/config.yaml",        "--token",        "agent-support-key"      ]    }  }}
  1. Restart Claude Desktop. The enterprise tools (listCustomers, getCustomerDetails, createSupportTicket, etc.) will appear with a hammer icon in the prompt interface.

⚙️ Configuration Guide (config.yaml)

yaml
server:  name: "enterprise-mcp-gateway"  version: "1.0.0"  transport: "stdio"       # "stdio" or "sse"  host: "0.0.0.0"  port: 8080
governance:  enabled: true  default_role: "support_agent"  tokens:    "agent-ro-secret": "readonly_agent"    "agent-support-secret": "support_agent"    "admin-master-secret": "admin"  roles:    readonly_agent:      allowed_tools:        - "list*"        - "get*"    support_agent:      allowed_tools:        - "list*"        - "get*"        - "createSupportTicket"    admin:      allowed_tools:        - "*"
sanitizer:  enabled: true  mask_card_numbers: true  # Luhn-verified Credit Card masking  mask_ssn: true           # US SSN masking  mask_secrets: true       # Private keys, AWS keys, JWTs, PATs  sensitive_keys:    - "password"    - "secret"    - "token"    - "apiKey"    - "ssn"    - "creditCard"  custom_regex:    - name: "Internal Employee ID"      pattern: "\\bEMP-[0-9]{6}\\b"      replacement: "[REDACTED-EMP-ID]"
audit:  enabled: true  log_path: "stdout"       # "stdout" or path to file e.g. "/var/log/mcp-audit.log"  hash_inputs: true        # SHA-256 hashes tool arguments for compliance
connectors:  - name: "enterprise-crm"    type: "openapi"    spec_file: "./examples/crm-openapi.yaml"    base_url: "http://localhost:8081"    headers:      Authorization: "Bearer backend-secret-token"      X-Gateway-Source: "enterprise-mcp-gateway"    timeout_seconds: 15

🧪 Testing

Run all unit and end-to-end integration tests:

bash
# Run all unit and integration testsgo test -v ./...
# Run tests with the Go race detector enabledgo test -race ./...

🐳 Docker Deployment

bash
# Build lightweight Docker imagedocker build -t enterprise-mcp-gateway:latest .
# Run container in SSE modedocker run -d -p 8080:8080 -p 8081:8081 enterprise-mcp-gateway:latest --transport sse --port 8080

📄 License

MIT License.

Source: README.md at commit 76bbf14

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts