# Enterprise MCP Gateway and AI Tool Registry

Secure tool-discovery and execution gateway for AI-agent integrations. The project combines a runnable FastAPI gateway with an optional standards-based MCP server entrypoint built with the official Python MCP SDK.

## Highlights
- JWT authentication with demo admin, developer, and viewer roles
- RBAC enforcement for tool execution and administrative operations
- Persistent tool registry and audit logs with SQLAlchemy
- Built-in calculator, summarizer, keyword extractor, and gateway-health tools
- Allowlisted HTTP tool registration for controlled external API integration
- Redis-backed rate limiting with an in-memory fallback
- Optional OpenTelemetry export to Jaeger
- Prometheus-style gateway metrics at `/metrics`
- REST endpoints for browser testing and an optional FastMCP Streamable HTTP server
- Automated tests and GitHub Actions CI

## Architecture
```text
AI Client / Developer
        |
        v
 FastAPI Gateway -----> JWT Auth + RBAC
        |
        +-----> Tool Registry -----> Built-in Tools
        |                     `----> Allowlisted HTTP Tools
        |
        +-----> Rate Limiter ------> Redis or in-memory fallback
        |
        +-----> Audit Store -------> SQLite quick start / PostgreSQL Docker mode
        |
        `-----> OpenTelemetry -----> Jaeger (optional)
```

## Quick Start
```bash
python -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements-dev.txt
cp .env.example .env
python -m uvicorn app.main:app --host 0.0.0.0 --port 8000
```
Open `http://localhost:8000/docs`.

## Demo Accounts
| Username | Password | Role |
|---|---|---|
| `admin` | `admin123` | admin |
| `developer` | `developer123` | developer |
| `viewer` | `viewer123` | viewer |

These are intentionally demo-only credentials. Replace the identity layer before deployment.

## Run Tests
```bash
python -m pytest -q
```

## Optional Standards-Based MCP Server
```bash
python -m pip install -r requirements-mcp.txt
python mcp_server.py
```
Connect an MCP client or MCP Inspector to `http://localhost:8000/mcp`.

## Docker Compose
```bash
docker compose up --build
```
- API docs: `http://localhost:8000/docs`
- Jaeger UI: `http://localhost:16686`

## Documentation
See [`docs/`](./docs) for setup, architecture, API reference, MCP notes, and security considerations.

## Security Note
The REST gateway demonstrates authentication, authorization, rate limiting, auditing, and allowlisted outbound calls. The optional local MCP server is a separate SDK demonstration. A remote MCP deployment should use OAuth 2.1 resource-server protection and production identity infrastructure.