Enterprise Mcp Gateway

Enterprise MCP Gateway

[CI Status] [Last Commit] [Go Version] [MCP Version] [Glama Score] [Security] [License]

Production-grade, high-performance Model Context Protocol (MCP) Gateway in Go.
A secure, audited, and PII-sanitized bridge connecting AI agents (Claude Desktop, Cursor, Antigravity, LangGraph) to enterprise backends (OpenAPI, Java/Spring Boot, Go microservices, relational databases).

[enterprise-mcp-gateway Glama Card]

[Enterprise MCP Gateway Live Demo]
Live Demo: AI Agent querying CRM with in-flight PII & card redaction (left) while the Gateway streams structured JSON audit logs in real-time (right).

🚀 Key Features

• ⚡ Blazing Fast & Lightweight: Single static Go binary (<25MB resident memory footprint, sub-millisecond routing overhead, zero external runtime dependencies).
• 🛡️ High-Performance PII & Secret Redaction: Real-time stream and JSON-key masking (Credit Cards with Luhn checksum validation, SSNs, emails, phone numbers, AWS keys, JWTs, GitHub PATs, and custom regex rules) before tool responses reach LLMs.
• 🔐 Role-Based Tool Governance (RBAC): Token-to-role resolution that limits tool visibility in tools/list and enforces execution permissions during tools/call.
• 🔌 Dynamic OpenAPI / Swagger Connector: Instantly registers validated MCP tools directly from OpenAPI 3.0/Swagger YAML or JSON specs without writing backend glue code.
• 📜 Structured JSON Audit Logging: Emits tamper-resistant, structured JSON logs containing caller identity, tool invoked, SHA-256 hashed parameters, execution latency, and PII redaction metrics.
• 🔄 Dual Transport Support: Fully compliant JSON-RPC 2.0 engine supporting both standard stdio (for Claude Desktop / Cursor) and HTTP Server-Sent Events (SSE) for distributed microservices.

🏗️ Architecture

┌────────────────────────────────────────────────────────┐│           AI Client (Claude / Cursor / Agent)          │└──────────────────────────┬─────────────────────────────┘                           │ JSON-RPC 2.0 (stdio or SSE)                           ▼┌────────────────────────────────────────────────────────┐│           Enterprise MCP Gateway (Single Go Binary)    ││                                                        ││  1. Transport Layer (pkg/mcp/transport)                ││     - Stdio & HTTP-SSE Transceivers                    ││  2. Security & Auth Guard (pkg/governance/rbac)        ││     - Token authentication & least-privilege filtering ││  3. Router & Tool Registry (pkg/mcp/protocol)          ││     - JSON-RPC 2.0 & MCP handshake engine              ││  4. Backend Dispatcher (pkg/connector/openapi)         ││     - Dynamic OpenAPI 3.0 path/query/body mapper       ││  5. Sanitization Engine (pkg/sanitizer/pii)            ││     - Zero-alloc PII, secret, & JSON key redactor      ││  6. Structured Audit Logger (pkg/audit)                ││     - Cryptographic JSON event trail for SIEM          │└──────────────────────────┬─────────────────────────────┘                           │ Authorized & Sanitized Calls                           ▼┌────────────────────────────────────────────────────────┐│      Internal Enterprise Services (Java / Go / DBs)    │└────────────────────────────────────────────────────────┘

📦 Quick Start

1. Build from Source

Ensure you have Go 1.24+ installed:

# Clone the repositorygit clone https://github.com/BenjaminJ/enterprise-mcp-gateway.gitcd enterprise-mcp-gateway
# Build gateway and mock backend servergo build -o bin/mcp-gateway ./cmd/gatewaygo build -o bin/mockserver ./cmd/mockserver

2. Run the Mock Enterprise Backend (Terminal 1)

./bin/mockserver --port 8081

3. Run the Gateway with Sample Config (Terminal 2)

Option A: Stdio Mode (Default)

./bin/mcp-gateway --config ./examples/config.yaml --token "agent-support-key"

Option B: HTTP Server-Sent Events (SSE) Mode

./bin/mcp-gateway --config ./examples/config.yaml --transport sse --port 8080

4. Stream Live Audit Logs in Real-Time (Terminal 3)

Follow and format structured audit records as tools execute:

PowerShell (Windows):

Get-Content -Path .\audit.log -Wait -Tail 10 | ForEach-Object {    if ($_ -match '^\s*\{') {        $e = $_ | ConvertFrom-Json        $time = ([DateTime]$e.timestamp).ToLocalTime().ToString("HH:mm:ss")        $statusColor = if ($e.status -eq "SUCCESS") { "Green" } else { "Red" }        $redactColor = if ($e.pii_redacted_count -gt 0) { "Yellow" } else { "DarkGray" }        Write-Host "[$time] " -NoNewline -ForegroundColor DarkGray        Write-Host "[$($e.status)] " -NoNewline -ForegroundColor $statusColor        Write-Host "$($e.tool) " -NoNewline -ForegroundColor Cyan        Write-Host "(Role: $($e.role), Latency: $($e.duration_ms)ms, Redacted: $($e.pii_redacted_count))" -ForegroundColor $redactColor    }}

Bash / Linux / macOS (jq):

tail -f audit.log | jq -c '{time: .timestamp, status: .status, tool: .tool, role: .role, latency_ms: .duration_ms, redacted: .pii_redacted_count}'

🔍 Verification with Anthropic Official MCP Inspector

You can test and inspect the gateway using Anthropic's official @modelcontextprotocol/inspector:

Test via Stdio:

npx @modelcontextprotocol/inspector ./bin/mcp-gateway --config ./examples/config.yaml --token agent-support-key

Test via SSE:

1. Start the gateway in SSE mode:
   bash

   ./bin/mcp-gateway --config ./examples/config.yaml --transport sse --port 8080

2. Open the inspector pointing to the SSE endpoint:
   bash

   npx @modelcontextprotocol/inspector http://localhost:8080/sse

💻 Claude Desktop Integration

To connect Claude Desktop to your enterprise systems through enterprise-mcp-gateway:

1. Open your Claude Desktop configuration file:

   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
   • Linux: ~/.config/Claude/claude_desktop_config.json
   • Windows: %APPDATA%\Claude\claude_desktop_config.json

2. Add enterprise-mcp-gateway to the mcpServers object:

{  "mcpServers": {    "enterprise-gateway": {      "command": "/absolute/path/to/enterprise-mcp-gateway/bin/mcp-gateway",      "args": [        "--config",        "/absolute/path/to/enterprise-mcp-gateway/examples/config.yaml",        "--token",        "agent-support-key"      ]    }  }}

3. Restart Claude Desktop. The enterprise tools (listCustomers, getCustomerDetails, createSupportTicket, etc.) will appear with a hammer icon in the prompt interface.

⚙️ Configuration Guide (config.yaml)

server:  name: "enterprise-mcp-gateway"  version: "1.0.0"  transport: "stdio"       # "stdio" or "sse"  host: "0.0.0.0"  port: 8080
governance:  enabled: true  default_role: "support_agent"  tokens:    "agent-ro-secret": "readonly_agent"    "agent-support-secret": "support_agent"    "admin-master-secret": "admin"  roles:    readonly_agent:      allowed_tools:        - "list*"        - "get*"    support_agent:      allowed_tools:        - "list*"        - "get*"        - "createSupportTicket"    admin:      allowed_tools:        - "*"
sanitizer:  enabled: true  mask_card_numbers: true  # Luhn-verified Credit Card masking  mask_ssn: true           # US SSN masking  mask_secrets: true       # Private keys, AWS keys, JWTs, PATs  sensitive_keys:    - "password"    - "secret"    - "token"    - "apiKey"    - "ssn"    - "creditCard"  custom_regex:    - name: "Internal Employee ID"      pattern: "\\bEMP-[0-9]{6}\\b"      replacement: "[REDACTED-EMP-ID]"
audit:  enabled: true  log_path: "stdout"       # "stdout" or path to file e.g. "/var/log/mcp-audit.log"  hash_inputs: true        # SHA-256 hashes tool arguments for compliance
connectors:  - name: "enterprise-crm"    type: "openapi"    spec_file: "./examples/crm-openapi.yaml"    base_url: "http://localhost:8081"    headers:      Authorization: "Bearer backend-secret-token"      X-Gateway-Source: "enterprise-mcp-gateway"    timeout_seconds: 15

🧪 Testing

Run all unit and end-to-end integration tests:

# Run all unit and integration testsgo test -v ./...
# Run tests with the Go race detector enabledgo test -race ./...

🐳 Docker Deployment

# Build lightweight Docker imagedocker build -t enterprise-mcp-gateway:latest .
# Run container in SSE modedocker run -d -p 8080:8080 -p 8081:8081 enterprise-mcp-gateway:latest --transport sse --port 8080

📄 License

MIT License.