MCP Gateway
MCP Gateway is a meta-MCP router exposing a compact tool surface that lets an AI discover, inspect, invoke, and govern tools across many MCP/REST backends on demand — though this instance currently has 0 backends and 0 tools connected.
Discover backends and tools:
gateway_list_servers(list connected MCP servers with status, tool counts, circuit-breaker state) andgateway_list_tools(list names/descriptions from one server or all).Search with ranked results:
gateway_search_toolsperforms keyword search across all registered tools, returning full schemas, relevance scores, and multi-word/synonym expansion.Invoke any backend tool:
gateway_invokeroutes a call to a named server+tool with arguments, applying the gateway's auth, rate-limit, caching, and failsafe middleware.Monitor usage and cost:
gateway_get_stats(invocations, cache hits, token savings, top tools) andgateway_cost_report(session/API-key spend, per-backend and per-tool breakdowns, rolling 24h/7d/30d windows).Operate webhooks:
gateway_webhook_statuslists registered webhook endpoints with delivery statistics.Run multi-step workflows:
gateway_run_playbookexecutes a named playbook that collapses several tool calls into one.Control backend availability:
gateway_kill_server(operator kill switch; tools stay visible but disabled) andgateway_revive_server(re-enable and reset the error budget).Manage capability health:
gateway_list_disabled_capabilitiesshows capabilities auto-disabled for high error rates and their cooldown state.Apply routing profiles:
gateway_set_profileswitches the session's active profile, whilegateway_get_profileandgateway_list_profilesshow the active one/all available ones.Reload configuration live:
gateway_reload_configre-reads config.yaml from disk and reports changes (host/port changes require a restart).
Provides optional Prometheus metrics support for monitoring the gateway's performance, health status, and backend operations.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP Gatewaylist all the connected servers and their tools"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Gateway
One gateway between your AI and every tool it needs, without flooding the context window.
MCP Gateway is a single Rust binary that sits between an AI client and all of its tools. Connect MCP servers and REST APIs behind it, and the agent sees a compact meta-surface of 14 to 17 tools instead of every backend definition. It discovers and calls backend tools on demand. A small live-agent benchmark found no completed-task token saving from that extra hop, so the value is catalog capacity plus policy and routing—not a blanket token claim. See Benchmarks.

Personal and noncommercial use is free, including running the full gateway. Running it commercially needs a commercial license.
The problem this removes
Every MCP tool an AI client connects costs roughly 150 tokens of context overhead, loaded into every request whether the tool gets used or not. Connect 20 servers with 100 tools between them and you spend about 15,000 tokens before the conversation starts. Context limits then force a second cost: you have to decide up front which tools to connect and leave the rest out, so the agent makes worse decisions because it cannot reach data you chose not to load.
MCP Gateway moves the full catalog out of the exposed tool list. The agent loads a small fixed set of meta-tools, searches with gateway_search_tools, and invokes a backend tool with gateway_invoke. This creates room for larger catalogs, but the extra search hop can cost more tokens and time on a completed task.
flowchart LR
AI["AI client<br/>(Claude, Cursor, ...)"]
subgraph GW["MCP Gateway (single binary)"]
META["Compact meta-surface<br/>14-17 tools"]
DISC{"Discover on demand<br/>gateway_search_tools<br/>gateway_invoke"}
end
T1["MCP backend<br/>Tavily (stdio)"]
T2["MCP backend<br/>Context7 (http)"]
C1["REST capability<br/>GitHub"]
C2["REST capability<br/>Stripe"]
Cn["110+ capabilities"]
AI -->|"14-17 tool defs"| META
META --> DISC
DISC --> T1
DISC --> T2
DISC --> C1
DISC --> C2
DISC --> CnRelated MCP server: MCP Gateway
Quick Start
Four commands:
brew trust --tap MikkoParkkola/tap # Homebrew 6.0+
brew install MikkoParkkola/tap/mcp-gateway # 1. install
mcp-gateway setup wizard --configure-client # 2. import existing servers + wire up clients
mcp-gateway serve # 3. run
mcp-gateway doctor # 4. verify everything is healthyThat is it. Your AI clients now talk to the gateway, and the gateway routes to every backend you already had configured, at a flat ~15 tools instead of ~150. Start with gateway_search_tools from your AI client to find any backend tool, then invoke it with gateway_invoke.
Nothing to import yet?
mcp-gateway init --with-exampleswrites a workinggateway.yamlwith public capabilities so you can confirm the gateway is alive before adding your own servers.
Or tell your AI assistant (recommended):
Read https://github.com/MikkoParkkola/mcp-gateway and install mcp-gateway to consolidate all my MCP servers behind one gateway
Your agent will install the binary, run the setup wizard, import your existing MCP servers, and wire itself up. This works in Claude Code, Cursor, Windsurf, Codex, and any AI with terminal access.
Install
Method | Command |
Homebrew (macOS/Linux, recommended) |
|
Cargo |
|
cargo-binstall |
|
Direct binary download (Windows x64) | Download |
Docker |
|
On Linux, the image runs as UID/GID 1001. Make an owner-only deployment copy
instead of changing ownership on your working config: install -m 600 gateway.yaml gateway.container.yaml && sudo chown 1001:1001 gateway.container.yaml. Do not make a credential-bearing config
world-readable. Docker Desktop handles bind-mount identity differently on
macOS and Windows.
# macOS Apple Silicon
curl -L https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-darwin-arm64 -o mcp-gateway && chmod +x mcp-gateway
# macOS Intel
curl -L https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-darwin-x86_64 -o mcp-gateway && chmod +x mcp-gateway
# Linux x86_64
curl -L https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-linux-x86_64 -o mcp-gateway && chmod +x mcp-gateway# Windows x64 (PowerShell)
Invoke-WebRequest -Uri https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-windows-x86_64.exe -OutFile mcp-gateway.exeSet up, three ways
Option A: auto-import everything (recommended)
mcp-gateway setup wizard --configure-clientScans Claude Desktop, Claude Code, Cursor, Zed, Continue.dev, Codex, and running MCP processes; lets you pick which servers to import into gateway.yaml; previews the gateway entry; writes it into each detected client config; verifies the write; and prints backup and rollback paths when an existing client config changes. Add --yes to skip the prompts and import everything.
Option B: add servers from the built-in registry
48 popular MCP servers are pre-registered with the right command, args, and env-var template. mcp-gateway add is compatible with claude mcp add and codex mcp add:
mcp-gateway add tavily # known server, fills env vars
mcp-gateway add my-server -- npx -y @some/mcp-server --flag # arbitrary stdio command
mcp-gateway add --url https://mcp.sentry.dev/mcp sentry # HTTP server
mcp-gateway add -e API_KEY=xxx my-server -- npx my-mcp-servermcp-gateway list shows what is configured. mcp-gateway remove <name> removes one.
Option C: hand-write gateway.yaml
For the full schema, see the annotated examples/gateway-full.yaml, which covers env_files, server, auth, meta_mcp, streaming, failsafe, cache, capabilities, and backends. The remaining top-level sections (playbooks, security, webhooks, routing_profiles, code_mode, mtls, key_server, agent_auth, runtime, marketplace, control_plane, cost_governance) have no prose reference yet; the Config struct in src/config/mod.rs is the authoritative list. Minimal example:
server:
port: 39400
meta_mcp:
enabled: true
backends:
tavily:
command: "npx -y @anthropic/mcp-server-tavily"
description: "Web search"
env:
TAVILY_API_KEY: "${TAVILY_API_KEY}"
sentry:
http_url: "https://mcp.sentry.dev/mcp"
description: "Sentry issues"Run and verify
mcp-gateway serve # start the gateway
mcp-gateway doctor # diagnose config, port, env vars, backend health
mcp-gateway doctor --fix # auto-fix issues where possibleThe web dashboard is at http://localhost:39400/ui once serve is running. The
operator dashboard at /dashboard needs the admin credential, and a browser
cannot send one on a navigation — so serve prints a single-use link to open it
with, on a loopback bind. A network-bound gateway prints none and is managed
through /ui with the token instead. See
Opening the dashboard.
Connect AI clients (if you skipped Option A)
setup export writes the gateway entry into client config files for you. It auto-detects the right path per client:
mcp-gateway setup export --target all --dry-run # preview without writing
mcp-gateway setup export --target all # write, back up, verify
mcp-gateway setup export --target claude-code # one client
mcp-gateway setup export --target all --watch # regenerate on gateway.yaml changes
mcp-gateway setup export --rollback <backup-file> # restore one client configExisting client files are backed up before mutation. The command prints the exact rollback command beside each updated client.
Client | Config path |
|
|
| platform-specific |
|
|
|
|
|
|
|
|
|
|
Modes: --mode proxy (HTTP), --mode stdio (subprocess), --mode auto (probe the health endpoint, then fall back).
{
"mcpServers": {
"gateway": {
"type": "http",
"url": "http://localhost:39400/mcp"
}
}
}Why use MCP Gateway?
Larger catalog, smaller exposed surface. The agent loads a fixed meta-surface instead of every backend definition. In the checked-in live run, both paths completed every task, but the meta path used 1.2–16.1% more input tokens and added one turn. See Benchmarks.
Unlimited tools, discovered on demand. No more choosing which servers fit the budget. The agent searches (
gateway_search_tools) and invokes (gateway_invoke) tools as it needs them.Add any REST API in minutes. Drop in a YAML file or import an OpenAPI spec with
mcp-gateway cap import. 110+ capabilities ship built in.Per-user identity to backends. Multitenant backends can receive the verified end-user identity with no gateway-stored long-lived credential. See Multitenant identity.
Secure by construction. A tool-poisoning validator scans every backend tool description before it reaches the agent. SHA-256 capability pinning is optional: unpinned files load, pinned files fail closed on mismatch. OWASP Agentic AI Top 10 coverage is self-assessed in-tree, not a certification. The crate sets
#![deny(unsafe_code)], so any unsafe block needs an explicit#[allow]opt-in, with optional mTLS, message signing, and agent identity.Swap your MCP stack without losing your session. Hot-reload backends and config in about 8ms while the AI stays connected. No restart, no lost context.
Production resilience. Circuit breakers, retries with backoff, rate limiting, and health checks keep one flaky server from taking down the whole toolchain.
Dual protocol. MCP plus an A2A (agent-to-agent) transport adapter, so the same gateway routes tool calls and cross-provider agent messages.
What MCP Gateway is, and what it is not
MCP Gateway is a tool and capability router. It routes MCP tool, resource, and prompt traffic to backend MCP servers and to capability-backed REST APIs, and it can proxy MCP server-to-client requests like sampling/createMessage, elicitation/create, and roots/list back to the connected client over the existing session.
It is not a chat-completions or embeddings proxy. When a backend asks for sampling/createMessage, the connected client performs the model call, not the gateway. The OpenAI-compatible prompt-cache helpers exist for one narrow reason: so gateway_invoke can preserve prompt_cache_key behavior for backends that call LLM APIs internally. That boundary is deliberate. The value here is routing hundreds of tools through a small surface, not sitting in the model path.
Compared with the default approach of loading every tool definition into every request, the gateway trades a one-time discovery hop for a flat, small context cost. Compared with generic transport bridges that expose one server at a time, it aggregates many backends behind one namespaced surface with integrity checks, ranking, and per-user identity.
Multitenant identity
A multitenant backend (email, memory, calendar) that runs its own OIDC normally sees only "the gateway," so it cannot enforce per-user access or produce a per-user audit trail. mcp-gateway propagates the verified end-user identity to the backend through one of three configured strategies. It can mint a short-lived gateway-signed assertion, forward the caller's own token, or run an RFC 8693 token exchange for OAuth-native backends. It keeps no long-lived credential for anyone. A backend marked required fails closed rather than serve a shared key when no verified identity is present, and per-user results stay isolated in the cache. See ADR-007, ADR-008, and docs/UPGRADING-3.0.md. For the full propagation sequence, each strategy's wiring, the safety invariants, and the 2.x upgrade path, see What is new in v3.1.0: end-user identity to backends.
Independent reviews
Five MCP hot-reload tools compared: Ruach Tov Collective's BPD-based comparison of mcp-gateway against four restart-focused alternatives, with a feature matrix and architectural analysis.
mcp-gateway deep dive: a walkthrough of the capability system, SHA-256 integrity pinning, and the v2.5 to v2.9 development arc.
Quantitative claims in this README are sourced from docs/BENCHMARKS.md and the machine-readable benchmarks/public_claims.json, with a CI check that fails on drift. The public Trust Fabric plan is tracked in docs/roadmap/mik-6550-trust-fabric-roadmap.md.
Why the token math matters
Every MCP tool you connect costs about 150 tokens of context overhead. Connect 20 servers with 100 tools and you have burned roughly 15,000 tokens before the first message, on definitions the AI probably will not use this turn. Worse, context limits force you to choose which tools to connect at all, so the agent makes weaker decisions because the right data is out of reach.
Without gateway | With gateway | |
Tools in context | Every definition, every request | 17 meta-tools in the README benchmark (~1,700 tokens) |
Schema footprint | ~15,000 modeled tokens (100 tools) | ~1,700 modeled tokens before discovery; not completed-task cost |
Measured task cost | Direct path was lower at every tested size | Meta path used 1.2–16.1% more input tokens and one extra turn |
Practical tool limit | 20 to 50 tools under context pressure | Unlimited, discovered on demand |
Connect a new REST API | Build an MCP server (days) | Drop a YAML file or import an OpenAPI spec (minutes) |
Changing MCP config | Restart the AI session, lose context | Restart gateway (~8ms), session stays alive |
When one tool breaks | Cascading failures | Circuit breakers isolate it |
The gateway exposes 14 tools minimum, 17 in the README benchmark scenario. The base discovery quartet stays fixed; the rest are operator helpers for stats, cost, playbooks, profile control, disabled-capability visibility, and reload. Webhook status is listed only where it can answer: a deployment with a webhook registry attached, which the stdio transport never has. It costs context exactly where it is useful.
Code Mode: two tools instead of the meta-tool set
Setting code_mode.enabled: true makes tools/list return exactly two tools, gateway_search and gateway_execute, instead of the meta-tool set. Everything else is reached through those two. Tools named in meta_mcp.surfaced_tools are not appended in this mode, so the count stays at two however many backends are connected. Code Mode is off by default. gateway_search returns L0 by default (tool name, one-line purpose, score). Pass detail=l1 or detail=l2 for more, or explain=true for ranking diagnostics. include_schema=true is deprecated and maps to L2.
code_mode:
enabled: trueSecurity
Connecting N MCP servers to an agent means accepting N attack surfaces. Tool poisoning, rug pulls, and exfiltration through hidden instructions in tool descriptions are demonstrated attacks, not hypotheticals. Invariant Labs' writeup (MCP Security Notification: Tool Poisoning Attacks) and Simon Willison's summary (MCP has prompt injection security problems) lay out the threat model.
mcp-gateway puts every backend tool description behind one audit surface and defends it structurally:
Tool-poisoning validator (AX-010). Every backend tool description is scanned before it reaches the agent's context window. HIGH patterns fail closed:
<IMPORTANT>blocks,~/.ssh/~/.aws/id_rsa/.env//etc/passwd,sidenoteexfiltration language,curl .* https?://, andbase64in an exfil context. MEDIUM patterns warn: 40+ consecutive spaces, zero-width or bidi-override Unicode, and oversized descriptions. Implementation:src/validator/rules/tool_poisoning.rs(19 tests).Optional SHA-256 capability hash-pinning.
mcp-gateway cap pin <file>writes asha256:line over the file's canonical hash (grep -v '^sha256:' capability.yaml | sha256sumreproduces it from any shell). Unpinned files still load. A pinned file that no longer matches fails closed on load and on every watcher event.Rug-pull detection. When a pinned capability's on-disk content changes after approval, the watcher unloads it and logs
RUG-PULL DETECTED. The capability stays quarantined until an operator re-pins it. Implementation:src/capability/hash.rsanddetect_rug_pullsinsrc/capability/backend.rs.Centralized audit surface. Capability YAMLs are plain text: diffable, greppable, and reviewable in a PR. The agent only ever sees the compact meta-surface, so there is no N-server tool-list pollution and no N-server attack surface.
Full walkthrough, PoC snippets, and roadmap: docs/blog/security-aware-mcp-gateway.md.
OWASP Agentic AI Top 10 (self-assessed). Controls are mapped across all 10 ASI risks at the gateway boundary in-tree. That is not a certification. Hardening follow-ups are tracked separately for SBOMs, release signing, live remote attestation discovery, multi-gateway signing, SQL-sink defaults, and collusion detection. See docs/OWASP_AGENTIC_AI_COMPLIANCE.md.
MITRE Fight Fraud Framework (F3). A tactic-by-tactic mapping of the same gateway-boundary controls to F3 v1.1, including the two F3-native tactics (FA0001 Positioning, FA0002 Monetization). Most cash-out and card-scheme techniques are explicit gaps. See docs/compliance/MITRE-F3-MAPPING.md.
Recent additions
OpenAPI importer.
mcp-gateway cap import <spec-url-or-file>turns an OpenAPI 3 spec into one validated capability YAML per operation. The full Swagger Petstore spec becomes 19 validated capability YAMLs end to end:mcp-gateway cap import https://petstore3.swagger.io/api/v3/openapi.json --output capabilities/ --prefix petstore22 tests across
src/capability/openapi.rsandtests/openapi_import_tests.rs.
Architecture
flowchart TB
subgraph GW["MCP Gateway (:39400)"]
META["Meta-MCP surface: 14-17 tools<br/>gateway_list_servers · gateway_list_tools<br/>gateway_search_tools · gateway_invoke"]
FS["Failsafes: circuit breaker · retry · rate limit"]
META --> FS
end
FS --> B1["Tavily<br/>(stdio)"]
FS --> B2["Context7<br/>(http)"]
FS --> B3["Pieces<br/>(sse)"]
FS --> B4["REST capabilities<br/>(110+)"]Single-binary gateway. An AI client talks to the compact meta-surface, and the gateway dynamically discovers and routes to backend tools. Key modules: gateway/ (core router, OAuth, streaming, UI), provider/ (MCP/composite/capability), capability/ (discovery, validation), transport/ (HTTP, stdio), security/ (firewall, mTLS, message signing, agent identity, memory scanner), identity_propagation/, key_server/, cost_accounting/, scheduler/, skills/, tool_profiles/, config_reload/, and a2a/ (A2A transport adapter).
Features
Web dashboard
Embedded web UI at /ui: live status, searchable tools, server health, a read-only control-plane view, and a config viewer. Operator dashboard at /dashboard, which needs the admin credential — on a loopback bind serve prints a single-use link to open it with, since a browser cannot attach an Authorization header to a navigation. Cost tracking at /ui#costs. All served from the same binary and port, with no frontend build step.
Security and governance
Feature | Description | Docs |
Authentication | Bearer tokens, API keys, explicit admin keys, per-client rate limits, and opt-in per-client circuit breakers. With auth disabled every caller over HTTP is anonymous and holds no admin; a stdio caller is admin, because the client spawned the process | |
Cross-site protection |
| |
End-user identity propagation | Three configured strategies ( | |
Per-user OAuth isolation | Fail-closed default (v3.0): a backend that requires a per-user OAuth identity refuses a call that lacks one instead of serving a shared stored token. Opt into the previous shared-credential behavior with | docs/adr/ADR-008-multi-user-oauth-isolation.md, docs/UPGRADING-3.0.md |
Cleartext credential refusal | A backend whose configuration is credential-bearing — an | |
Per-client tool scopes | Allowlist or denylist tools per API key with glob patterns | |
Security firewall | Credential redaction, prompt-injection detection, and shell/SQL/path-traversal scanning | |
Cost governance | Per-tool, per-key, daily budgets with alert thresholds (log/notify/block) | |
Session sandboxing | Per-session call limits, duration caps, backend restrictions | |
mTLS | Certificate-based auth for tool execution | |
MITRE F3 mapping | Tactic-by-tactic map of gateway-boundary controls to Fight Fraud Framework v1.1. Monetization and card-scheme techniques are listed as gaps |
Integration and discovery
The gateway ships with 110+ built-in capabilities: weather, Wikipedia, GitHub, stock quotes, package tracking, and more. Capability YAMLs hot-reload automatically after file changes, no restart needed.
Feature | Description |
Capability system | REST API to MCP tool via YAML. Hot-reloaded. 110+ built-in. OpenAPI import supported. |
Transform chains | Namespace, filter, rename, and response transforms. Example. |
Webhooks | GitHub/Linear/Stripe push events as MCP notifications. Docs. |
Auto-discovery | Discover MCP servers from existing client configs and running processes. |
Surfaced tools | Pin high-value tools directly in |
Semantic search | TF-IDF ranked search across all tool names and descriptions. |
Tool profiles | Usage analytics per tool: latency, errors, trends. Persisted to disk. |
Config export | Export sanitized config as YAML or JSON via |
Protocol and transport
MCP versions: the
initializehandshake negotiates up to 2025-11-25. The newer 2026-07-28 revision is reached only on the statelessPOST /mcppath, via theMCP-Protocol-Versionheader; it is served by default and is switched off withserver.modern_protocol: falseTransports: stdio, Streamable HTTP, SSE, WebSocket
Hot reload: capability YAMLs and backends are watched and reloaded live.
server.public_urlandcontrol_plane.role_mappingare re-read per request; everything else needs a restartReload outcomes:
gateway_reload_configand/ui/api/reloadreportrestart_required, and keep reporting it until a restart, for every field a reload cannot apply — which is every field outside that short live list,authincluded. A reload that would leave the tool endpoint reachable without a credential is refused rather than appliedConfig discovery: auto-finds
gateway.yamlin cwd,~/.config/mcp-gateway/, and/etc/mcp-gateway/"Did you mean?": Levenshtein-based typo correction on tool names
Tool annotations: MCP 2025-11-25
title,readOnlyHint,destructiveHint,idempotentHint,openWorldHint; gateway meta-tools are fully annotated, while backend tools use the hybrid pass-through/fill policy in ADR-003Dynamic descriptions: live tool and server counts in meta-tool descriptions
Tunnel mode: expose via Tailscale or pipenet without opening ports
Shell completions:
mcp-gateway completions bash|zsh|fishSpec preview (opt-in): filtered
tools/list(SEP-1821),tools/resolve(SEP-1862), dynamic promotion
Supported backends
Any MCP-compliant server works. All three transport types are supported:
Transport | Examples |
stdio |
|
HTTP | Any Streamable HTTP server |
SSE | Pieces, LangChain, GitMCP (free remote docs and code search for any GitHub repo) |
Remote MCP servers plug in by URL, with no extra code. See examples/gateway-full.yaml for a commented GitMCP backend entry and docs/REMOTE_BACKENDS.md for a step-by-step walkthrough.
Public MCP Gateway Comparison
This table compares public, user-facing behavior, not internal roadmap scoring. MCP Gateway entries are grounded in this repo's public docs: quickstart, deployment, OWASP controls, TrustCard/CBOM, CatalogTrustLab, adaptive ranking, identity grants, ADR-007 identity propagation, ADR-008 multi-user OAuth isolation, and the Trust Fabric roadmap. Competitor entries are grounded in public project docs: Docker MCP Catalog and Toolkit, MCPJungle README, mcpo README, and Supergateway README.
Axis | MCP Gateway | |||
Primary job | MCP and REST capability router with a compact meta-surface | Docker-managed catalog, profiles, containerized MCP servers, and gateway | Self-hosted gateway that runs many MCP servers behind one endpoint | Protocol bridges: MCP to OpenAPI for mcpo; stdio to SSE/WS for Supergateway |
Install | Standalone Rust binary via cargo, Homebrew, VS Code, Cursor, and local build | Docker Desktop / Docker CLI plugin flow | Self-hosted gateway install and server registration | Python/uvx/Docker for mcpo; npm/CLI bridge for Supergateway |
Configuration | Wizard, local starter profile, service templates, client export, doctor JSON, backup and rollback | Docker profiles and catalog selection | Centralized server and client configuration | Per-bridge command/config for each exposed server or transport |
Security | OWASP Agentic AI matrix, MITRE F3 gateway-boundary mapping (gaps stated), firewall, response inspection, hash-pinned capabilities, mTLS/signing options | Verified container images with versioning, provenance, and security updates in Docker catalog | Centralized access control and observability | Transport/API exposure layer; security depends on bridge auth and deployment boundary |
Identity and grants | Local identity-grant contract and CLI; multi-user OAuth isolation is credential-agnostic by default (ADR-008), and a backend configured | Docker/team controls depend on Docker organization setup | Authenticated clients and server access control | Not a grant engine; delegates identity policy to the surrounding deployment |
Runtime isolation | RuntimeProvider policy planning plus Docker/Podman/Kubernetes deployment paths | Container-first isolation is the core runtime model | Runs and manages MCP servers behind the gateway | Bridges existing server processes/transports rather than isolating arbitrary tools |
Trust metadata | TrustCard/CBOM generation, validation, TrustLab evidence, provenance stubs | Catalog packages carry image provenance and security update flow | Gateway inventory and observability focus | Protocol metadata bridge; trust metadata is not the primary product surface |
Discovery | Meta-MCP listing/search, ShadowRadar unmanaged-server inventory, capability registry | Docker MCP Catalog of packaged servers | Centralized discovery across configured servers | Exposes one bridged server surface at a time unless composed externally |
Policy and governance | Policy, grants, audit events, read-only control-plane tab/API, enterprise evidence boundary | Docker org/catalog/profile policy model | Centralized access control for teams | No broad governance plane; use with another policy layer when needed |
Imports and bridges | Native MCP backends plus REST capability YAML and protocol-import planning | Docker-packaged MCP server catalog | MCP server aggregation | Strong bridge story for OpenAPI, SSE, WebSocket, and stdio compatibility |
Ranking and routing | Safety-aware ranking, explanations, cost/latency/trust/health signals | Catalog/profile selection, not an MCP tool ranker | Gateway-level routing to configured servers | Transport routing, not semantic tool ranking |
Deployment | Local, team gateway, Docker Compose, systemd, launchd, a security-hardened Helm chart (non-root, seccomp, read-only rootfs), and experimental (v1alpha1) Kubernetes CRDs | Docker Desktop, Docker CLI, Docker Hub/catalog workflow | Local or shared self-hosted gateway | Local or remote bridge process beside the target MCP server |
Licensing | PolyForm Noncommercial 1.0.0 throughout; commercial use requires a license | Docker product and repository licensing apply | See project repository license | See each bridge repository license |
vs Anthropic MCP tunnels
On 2026-05-19 Anthropic shipped Claude Managed Agents with self-hosted sandboxes (public beta) and MCP tunnels (research preview). An MCP tunnel lets a Claude agent reach a single MCP server inside a private network through one outbound connection from a lightweight gateway, with no inbound firewall rules, no public endpoint, and end-to-end encryption.
mcp-gateway and Anthropic's MCP tunnel sit at different layers and compose. The tunnel is reachability plumbing for one private MCP server. mcp-gateway is the aggregation, routing, capability-namespacing, and observability layer across many MCP and REST backends. Deploy both and mcp-gateway becomes the private MCP server that the tunnel exposes: one tunnel, one outbound connection, every backend behind it.
Concern | Anthropic MCP tunnel | mcp-gateway | Boundary |
Backend topology | Single MCP server per tunnel, exposed through one outbound connection (overview) | N-backend aggregation: 110+ REST capabilities plus multiple MCP backends behind a compact 14-17 tool meta-surface ( | Different primitive: 1-server reachability vs many-backend aggregation |
Tool routing | Opaque pass-through; the agent sees whatever tool list the tunneled server publishes | Capability namespacing plus dynamic | Different layer: transport reachability vs tool-surface curation and integrity |
Observability | Per-tunnel session telemetry from Anthropic's side | Unified | Scope distinction: per-tunnel session vs cross-backend trace correlation |
They solve adjacent problems. A team that wants Claude Managed Agents to reach a private-network deployment of mcp-gateway uses the tunnel for reachability and mcp-gateway for fan-out, capability hygiene, OWASP Agentic AI controls, and unified cost and trace telemetry.
API
Endpoint | Method | Description |
| GET | Health check with backend status; authenticated admin callers also see per-backend runtime profile lifecycle state |
| POST | Meta-MCP mode (dynamic discovery) |
| POST | Direct backend access |
| GET | Web dashboard |
| GET | Read-only local control-plane projection for inventory, runtime health, decisions, RBAC, and license boundaries |
| GET | Operator dashboard. Admin only; opened with the single-use link |
| GET | Prometheus metrics (with |
Performance
Metric | Value | Notes |
Startup time | ~8ms | Measured with |
Binary size | ~12-13 MB | Release build with LTO, stripped |
Hot-path microbenchmarks | Included | Criterion suite covers registry, parsing, cache-key, firewall, and semantic-search hot paths |
End-to-end latency | Backend-dependent | Measure with your real MCP servers and REST APIs rather than relying on a synthetic single number |
SKILL.md / agentskills.io compatibility
MCP Gateway can ingest Agent Skills and Claude Code SKILL.md files and expose them as discoverable skills alongside capability YAML. This lets the gateway consume any SKILL.md, whether authored locally, shipped from agentskills.io, or pulled from a GitHub release, and surface it through the same meta-tool surface used for capabilities.
# Import a local skill directory (auto-discovers SKILL.md + resources/)
mcp-gateway skills import ~/.claude/skills/gws-gmail-send
# Import a single SKILL.md file
mcp-gateway skills import ./path/to/SKILL.md
# Import from an agentskills.io URL
mcp-gateway skills import https://agentskills.io/skills/my-skill/SKILL.md
# List imported skills
mcp-gateway skills list
# Search by name, description, trigger, or keyword
mcp-gateway skills search "gmail"
# Show the full body (including any embedded code blocks)
mcp-gateway skills show gws-gmail-send
# Remove a skill
mcp-gateway skills remove gws-gmail-sendWhat gets parsed
YAML frontmatter (
name,description,version,effort,allowed-tools,triggers,keywords)Markdown body, with fenced
bash/python/jsoncode blocks extracted as structuredSkillCodeBlockentriesProgressive-disclosure resources:
SKILL.advanced.md,reference.md,README.md, and anyresources/*.mdfiles in the skill directory
Security model (read-only)
Imported skills are stored as data, not executed. Embedded bash or python blocks are parsed and surfaced to users and agents via skills show, but MCP Gateway will never run them automatically. A future release may add opt-in execution gated on per-skill user consent. To run a skill's commands today, copy them from skills show and run them in your own shell.
Registry location: ~/.mcp-gateway/skills.json (override with MCP_GATEWAY_SKILLS_REGISTRY or --registry).
Reference: Anthropic SKILL.md spec and agentskills.io.
Documentation
Document | Contents |
Zero to running in 2 minutes | |
Commented | |
OAuth 2.0 setup with Slack and Figma examples | |
Per-issuer OAuth storage, strict | |
Per-user OAuth isolation and identity-propagation upgrade path | |
Docker, systemd, TLS/mTLS, scaling | |
Generate capabilities from OpenAPI specs | |
Event integration setup | |
Share and install capabilities | |
Performance measurements | |
Release history | |
Risk coverage matrix | |
Fight Fraud Framework tactic map (PARTIAL/GAP, not a coverage claim) | |
Passive local discovery and static network-rule export | |
Willow/Webrix feature bar and mcp-gateway's current gaps | |
Where mcp-gateway and Anthropic's MCP tunnel compose |
Troubleshooting
Backend will not connect? Test the command directly (npx -y @anthropic/mcp-server-tavily), then check gateway logs with --log-level debug.
Circuit breaker open? Ask your MCP client for gateway_list_servers: it
reports circuit_breaker per backend and works on the shipped config. The HTTP
equivalent, curl -H "Authorization: Bearer $ADMIN_KEY" localhost:39400/health | jq '.backends', additionally needs auth.enabled: true and an admin
credential — authentication is off by default, and while it is off every caller
is anonymous, so the token is ignored and even a bearer-carrying request sees
just {count, all_healthy}. Adjust thresholds in failsafe.circuit_breaker
(default: opens after 5 consecutive failures, retries after 30s).
One tool went quiet, then came back on its own about five minutes later?
That is the per-capability error budget, not the circuit breaker — separate
mechanism, separate keys. A capability whose failure rate crosses
error_budget.capability.threshold is disabled on its own, leaving the rest of
its backend serving, and re-enables itself on the next call once
error_budget.capability.cooldown (default 5 minutes) has elapsed.
gateway_list_disabled_capabilities names the ones currently suspended.
A whole backend went offline and stayed offline? The backend-level error
budget auto-killed it: its failure rate crossed error_budget.threshold over
the sliding window. Unlike a capability, a killed backend does not come
back by itself — revive it with gateway_revive_server, and raise the
threshold or the window if the kill was premature. gateway_list_servers
reports a killed backend as "status": "disabled", which is how you tell an
auto-kill apart from an open breaker.
Every key of both budgets is documented inline in examples/gateway-full.yaml
under error_budget:. Rate-limited responses (429, RESOURCE_EXHAUSTED) are
excluded from both budgets: a throttled backend is a working backend, so
throttling alone can neither kill a backend nor disable a capability.
Tools not appearing? Verify the backend is running (gateway_list_servers). Tool lists are cached for 5 minutes.
Versioning and stability
This project follows Semantic Versioning over its product surface: the CLI, and the configuration file format. Changes to either are versioned accordingly — a config key that stops being accepted, or a command that changes behaviour, is a breaking change.
The Rust library API is not part of that surface. Types are pub for
modularity and testing, not as a supported embedding API, and they may change
in any release. The crate ships a binary; at the time of writing crates.io
reports zero reverse dependencies. If you embed the library, pin an exact
version (=4.0.0) rather than a caret range.
This is stated explicitly because "removing a pub field" and "breaking a
supported API" are only the same thing when the API is supported. Here it is
not, and that needs to be published rather than assumed.
Contributing
Fork and branch (
git checkout -b feature/your-feature)Test (
cargo test) and lint (cargo fmt && cargo clippy -- -D warnings)Open a PR against
mainwith a clear description and a CHANGELOG entry
See CONTRIBUTING.md for full details. Look for good first issue or help wanted to get started.
Ecosystem
mcp-gateway is part of a suite of MCP tools:
Tool | Description |
Universal MCP gateway: a compact 14-17 tool surface replaces 100+ registrations | |
AI travel agent, 36 MCP tools for flights, hotels, ground transport | |
Web content extraction: fetch any URL with cookies and anti-bot bypass | |
macOS GUI automation, 34 MCP tools via the Accessibility API |
License
mcp-gateway is licensed under the PolyForm Noncommercial License 1.0.0
(LICENSE-NONCOMMERCIAL). Every first-party file carries
a copyright line and an explicit
// SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0 header. There is no
second license and no allowlist.
What this means:
Personal and noncommercial use is free, including running the whole gateway.
Running the gateway commercially requires a commercial license. This covers the whole project — dispatch, transport, backend management, identity, security, governance — including the generic building blocks that earlier 3.x releases shipped under MIT headers. See COMMERCIAL.md.
Rights granted in earlier releases are not revoked. Versions 3.0.0–3.2.1 were published with MIT package metadata, and v3.3.0 onward in the 3.x line shipped a small MIT core under per-file headers. Those copies stay MIT for their recipients; from v4.0.0 there is no MIT core. See NOTICE.md.
Full model: LICENSES.md.
Credits
Created by Mikko Parkkola. Implements Model Context Protocol versions 2025-11-25 and 2026-07-28; the newer revision is served by default and can be switched off.
Available Tools
15 toolsgateway_cost_reportCost ReportA
Return current session and API-key spend. Includes total cost, call count, and breakdown by backend and tool. Per-key totals are shown for 24 h / 7 d / 30 d rolling windows.
| Name | Required | Description | Default |
|---|---|---|---|
| include_all_keys | No | Return all API key accumulators (admin view). Default false. | |
| include_all_sessions | No | Return all active sessions (admin view). Default false. | |
| session_id | No | Specific session ID to report on. Defaults to current session. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses behavioral traits such as the types of data returned (cost, call count, breakdowns) and time windows, but lacks details on permissions, rate limits, or error handling. It adequately describes the operation but could be more comprehensive for a tool with potential admin functions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by specific details in a compact format. Every sentence adds essential information without redundancy, making it highly efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (cost reporting with admin options) and lack of annotations or output schema, the description is mostly complete. It covers what data is returned and parameter context, but could benefit from mentioning output format or error cases to be fully comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents parameters. The description adds value by explaining the context of the parameters (e.g., 'admin view' for include_all_keys and include_all_sessions, and default behavior for session_id), enhancing understanding beyond the schema's technical details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('Return', 'Includes') and resources ('current session and API-key spend', 'total cost, call count, breakdown by backend and tool', 'Per-key totals'). It distinguishes itself from siblings by focusing on cost reporting, unlike tools like gateway_get_stats (general stats) or gateway_list_tools (tool listing).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for monitoring spend and provides context on what data is included (e.g., 24h/7d/30d windows), but it does not explicitly state when to use this tool versus alternatives like gateway_get_stats or provide exclusions. Usage is inferred from the content rather than directly guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_get_profileGet Routing ProfileB
Show the active routing profile for this session and what it allows or denies.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool 'shows' information, implying a read-only operation, but doesn't clarify if it requires authentication, has rate limits, or what happens if no profile is active. For a tool with zero annotation coverage, this is a significant gap in transparency, as it lacks details on permissions, errors, or response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('show the active routing profile') and adds useful context ('for this session and what it allows or denies'). There is no wasted verbiage, and every word contributes to understanding the tool's function, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (0 parameters, no output schema, no annotations), the description is minimally adequate. It explains what the tool does but lacks details on behavioral aspects like error handling or return values. Without an output schema, the description should ideally hint at the response format, but it doesn't, leaving some gaps in completeness for a tool that interacts with session settings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and the input schema has 100% description coverage (though empty). The description adds no parameter information, which is appropriate here. In such cases, the baseline score is 4, as there are no parameters to document, and the description doesn't need to compensate for any schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to 'show the active routing profile for this session and what it allows or denies.' It specifies the verb ('show') and resource ('active routing profile'), and distinguishes it from siblings like 'gateway_list_profiles' (which likely lists all profiles) and 'gateway_set_profile' (which modifies profiles). However, it doesn't explicitly contrast with these siblings, keeping it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by mentioning 'for this session,' suggesting it's used to check current session settings. However, it provides no explicit guidance on when to use this tool versus alternatives like 'gateway_list_profiles' or 'gateway_set_profile,' nor does it mention prerequisites or exclusions. This leaves usage somewhat inferred rather than clearly defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_get_statsGet Gateway StatisticsC
Get usage statistics including invocations, cache hits, token savings, and top tools
| Name | Required | Description | Default |
|---|---|---|---|
| price_per_million | No | Token price per million for cost calculations (default 15.0 for Opus 4.6) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. While it indicates this is a read operation ('Get'), it doesn't mention authentication requirements, rate limits, whether this is real-time or historical data, or what format the statistics are returned in. For a statistics tool with zero annotation coverage, this leaves significant behavioral questions unanswered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that clearly states the tool's purpose. Every word earns its place by specifying what statistics are included, making it appropriately concise and front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a statistics tool with no annotations and no output schema, the description is insufficiently complete. It doesn't explain what format the statistics are returned in, whether they're aggregated or detailed, what time periods they cover, or how to interpret the results. The description should provide more context about the statistical output given the lack of structured documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions 'token savings' which relates to the 'price_per_million' parameter in the schema, but doesn't add meaningful semantic context beyond what the schema already provides (100% coverage). The schema already documents this parameter with a clear description and default value, so the description adds minimal additional value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and resource ('Gateway Statistics'), and specifies the types of statistics included (invocations, cache hits, token savings, top tools). However, it doesn't explicitly differentiate from sibling tools like 'gateway_cost_report' or 'gateway_get_profile' which might also provide statistical data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With multiple sibling tools that might provide related statistics (gateway_cost_report, gateway_get_profile), there's no indication of when this specific statistics tool is appropriate versus those other options.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_invokeInvoke ToolA
Invoke any tool on any backend server. Routes through the gateway's auth, rate-limit, caching, and failsafe middleware. Use gateway_search_tools first to discover the right tool and server.
| Name | Required | Description | Default |
|---|---|---|---|
| arguments | No | Tool arguments | |
| server | Yes | Backend server name | |
| tool | Yes | Tool name to invoke |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds valuable behavioral context beyond annotations by specifying that it 'Routes through the gateway's auth, rate-limit, caching, and failsafe middleware.' While annotations provide readOnlyHint=false and openWorldHint=true, the description elaborates on the gateway's processing pipeline, which helps the agent understand the execution environment and potential side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two sentences that each earn their place: the first states the core functionality and behavioral traits, the second provides crucial usage guidance. No wasted words, front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (invoking arbitrary tools with middleware routing) and lack of output schema, the description does well by explaining the gateway middleware and discovery prerequisite. However, it doesn't detail response formats, error handling, or specific auth/rate-limit implications, leaving some gaps for a tool with openWorldHint=true and no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the schema already documents all three parameters (arguments, server, tool) adequately. The description doesn't add specific meaning about parameter usage beyond implying that 'server' and 'tool' should be discovered via gateway_search_tools, which is minimal additional value. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Invoke any tool on any backend server') and distinguishes it from siblings by mentioning routing through gateway middleware and the need to use gateway_search_tools first. It explicitly names the resource (tools on backend servers) and the verb (invoke) with clear scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool ('Use gateway_search_tools first to discover the right tool and server') and implies when not to use it (when you already know the specific tool from other sibling tools). It names an alternative (gateway_search_tools) for discovery, making usage context very clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_kill_serverKill ServerA
Immediately disable routing to a backend server (operator kill switch). The server's tools remain visible in search/list but are marked as disabled.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | Name of the backend server to disable |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: the immediate effect ('Immediately disable'), the partial nature of the disablement ('tools remain visible... but are marked as disabled'), and the operational context ('operator kill switch'). It doesn't mention authentication requirements, rate limits, or error conditions, but provides substantial behavioral context for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that are perfectly front-loaded and efficient. The first sentence states the core action and context, the second clarifies the partial nature of the disablement. Every word earns its place with zero redundancy or wasted verbiage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation with no annotations and no output schema, the description provides good coverage of what the tool does and its behavioral effects. It explains the partial disablement (tools remain visible but marked disabled) which is crucial context. It doesn't describe the return value or error conditions, but given the tool's relative simplicity and clear purpose, the description is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description doesn't add any parameter-specific information beyond what's already in the schema (which has 100% coverage). The schema already documents that 'server' is a required string parameter representing the backend server name. No additional semantics about parameter format, constraints, or examples are provided in the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Immediately disable routing') and target resource ('backend server'), distinguishing it from sibling tools like gateway_revive_server (which presumably re-enables servers) and gateway_list_servers (which only lists them). The 'operator kill switch' phrase reinforces the emergency nature of the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context about when to use this tool ('Immediately disable routing'), but doesn't explicitly state when NOT to use it or name specific alternatives. However, the existence of gateway_revive_server as a sibling implies this is for disabling rather than permanent removal, and the 'operator kill switch' wording suggests emergency scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_list_disabled_capabilitiesList Disabled CapabilitiesA
List capabilities that have been automatically disabled due to a high error rate. Each entry shows the backend, capability name, and how long it has been suspended. Disabled capabilities auto-recover after the configured cooldown period (default 5 min). Use gateway_revive_server to manually re-enable an entire backend immediately.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so effectively by disclosing key behavioral traits: it explains the cause of disabling ('high error rate'), the auto-recovery mechanism ('auto-recover after the configured cooldown period'), and the default cooldown time ('default 5 min'), though it could mention output format or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by additional context in a second sentence, and ends with a usage guideline—all sentences are essential with zero waste, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (listing disabled capabilities with recovery details) and no annotations or output schema, the description is mostly complete: it covers purpose, behavior, and usage. However, it lacks details on the output structure (e.g., format of entries) or potential errors, leaving a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since there are 0 parameters and schema description coverage is 100%, the baseline is 4. The description adds no parameter information, which is appropriate here, but does not detract from the schema's completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('List capabilities that have been automatically disabled due to a high error rate') and resource ('capabilities'), distinguishing it from siblings like gateway_list_servers or gateway_list_tools by focusing on disabled capabilities rather than general listings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool ('List capabilities that have been automatically disabled') and provides a clear alternative for manual re-enablement ('Use gateway_revive_server to manually re-enable an entire backend immediately'), guiding the agent on tool selection based on the desired outcome.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_list_profilesList Tool ProfilesA
List all available routing profiles with their descriptions. Use gateway_set_profile to switch to a profile that narrows the visible toolset to the current task (e.g. "coding", "research").
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes the tool's function (listing profiles) and hints at context (profiles narrow the visible toolset), but lacks details on output format, pagination, or error handling. For a read-only listing tool with zero annotation coverage, this is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero waste: the first states the purpose, and the second provides usage guidelines with a clear alternative. It is front-loaded and efficiently structured, earning its place without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no output schema, no annotations), the description is mostly complete—it explains what the tool does and when to use it. However, it lacks details on behavioral aspects like output format, which slightly reduces completeness for a tool with no structured data to rely on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description does not discuss parameters, which is appropriate, but it adds value by explaining the tool's purpose and usage context, justifying a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('all available routing profiles with their descriptions'), making the purpose specific and unambiguous. It distinguishes this tool from its sibling gateway_set_profile by indicating that one lists profiles while the other switches to them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides when to use this tool ('List all available routing profiles') and when to use an alternative ('Use gateway_set_profile to switch to a profile'), including a named sibling tool and example use cases like 'coding' or 'research'. This gives clear guidance on tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_list_serversList ServersARead-onlyIdempotent
List all 0 connected MCP backend servers with their status, tool count, and circuit-breaker state.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is a read-only, non-destructive, idempotent operation with a closed-world scope. The description adds valuable context by specifying what information is returned (status, tool count, circuit-breaker state), which helps the agent understand the output format beyond the safety profile covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('List all connected MCP backend servers') and immediately specifies the returned attributes. There is zero wasted verbiage, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (0 parameters, no output schema) and rich annotations covering safety and behavior, the description is nearly complete. It adds output details (status, tool count, circuit-breaker state) that compensate for the lack of output schema. A minor gap is the absence of explicit usage guidance versus siblings, but overall it provides sufficient context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description appropriately focuses on the tool's purpose and output details, earning a baseline score of 4 for zero-parameter tools that avoid unnecessary parameter discussion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('List all'), resource ('connected MCP backend servers'), and scope ('with their status, tool count, and circuit-breaker state'), which distinguishes it from siblings like gateway_get_stats or gateway_list_tools that focus on different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving server status information, but does not explicitly state when to use this tool versus alternatives like gateway_get_stats (which might provide aggregated metrics) or gateway_list_tools (which lists tools rather than servers). It provides clear context but lacks explicit exclusions or named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_list_toolsList ToolsARead-onlyIdempotent
List tools from a specific backend, or omit server to list all 0 tools across 0 backends. Returns names and descriptions — use gateway_search_tools for ranked results with full schemas.
| Name | Required | Description | Default |
|---|---|---|---|
| server | No | Name of backend server. Omit to list ALL tools across all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, non-destructive, and idempotent behavior, so the description doesn't need to repeat these. It adds useful context about the return format ('names and descriptions') and the scope of listing, but doesn't disclose additional behavioral traits like rate limits or pagination. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero waste: the first sentence states the purpose and parameter usage, and the second provides a clear alternative. It's front-loaded and efficiently structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one optional parameter), rich annotations covering safety and behavior, and no output schema, the description is mostly complete. It clarifies the return format and sibling differentiation, but could mention if the list is paginated or sorted. Still, it's adequate for the context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents the single parameter. The description adds no extra parameter details beyond what's in the schema, but it reinforces the semantics by explaining the effect of omitting the server parameter. Baseline 3 is appropriate as the schema handles the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('tools'), specifies the scope ('from a specific backend' or 'all tools across all backends'), and distinguishes it from sibling gateway_search_tools by noting the latter provides 'ranked results with full schemas'. This is specific and avoids tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool (list tools with names and descriptions) versus an alternative (gateway_search_tools for ranked results with full schemas). The guidance on omitting the server parameter to list all tools provides clear context for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_reload_configReload ConfigA
Trigger an immediate reload of config.yaml from disk without restarting the gateway. Returns a summary of what changed (backends added/removed/modified, profile updates). Server host/port changes require a restart and are reported but not applied.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so well. It discloses key behavioral traits: it triggers an immediate action, returns a summary of changes, and notes limitations (server host/port changes are reported but not applied). This covers mutation effects and output behavior adequately.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action, followed by return details and limitations. Every sentence adds value without redundancy, making it efficient and well-structured for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a mutation with no annotations and no output schema), the description is mostly complete. It explains what the tool does, what it returns, and key constraints. However, it could briefly mention error cases or prerequisites, but the coverage is strong for the context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so the baseline is 4. The description does not need to add parameter details, and it appropriately focuses on the tool's behavior and output instead.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('trigger an immediate reload of config.yaml from disk') and resource ('gateway'), distinguishing it from siblings like gateway_kill_server or gateway_revive_server. It goes beyond the title by specifying the config file and the no-restart requirement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context on when to use this tool (to reload config without restarting) and implicitly when not to use it (for server host/port changes, which require a restart). However, it does not explicitly name alternatives like gateway_kill_server for full restarts or compare to other config-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_revive_serverRevive ServerA
Re-enable routing to a previously disabled backend server. Also resets the error budget so the server gets a clean slate.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | Name of the backend server to re-enable |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the core action (re-enabling routing) and an important side effect (resetting error budget), but doesn't mention potential consequences, permissions required, rate limits, or what happens if the server isn't actually disabled. It provides basic behavioral context but lacks completeness for a mutation operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two sentences that each add distinct value: the first states the primary action, the second reveals important behavioral context. There's zero wasted language, and the information is front-loaded with the core purpose immediately clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description provides adequate basic information about what the tool does but lacks details about what happens after invocation (success/failure indicators, return values, side effects beyond error budget reset). Given the complexity of server management operations, more context about dependencies, permissions, or system state requirements would be helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the schema already documents the single parameter thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema, but since there's only one parameter and the schema coverage is complete, this represents minimal information loss. The baseline for high schema coverage would be 3, but the single parameter case with complete documentation justifies a slightly higher score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('re-enable routing') on a specific resource ('previously disabled backend server'), and distinguishes it from siblings by mentioning the unique 'reset error budget' functionality. It uses precise verbs and identifies the target resource without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context ('previously disabled backend server') but doesn't explicitly state when to use this tool versus alternatives like 'gateway_kill_server' or 'gateway_reload_config'. No guidance is provided about prerequisites, dependencies, or exclusions for using this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_run_playbookRun PlaybookC
Execute a multi-step playbook (collapses multiple tool calls into one invocation)
| Name | Required | Description | Default |
|---|---|---|---|
| arguments | No | Playbook input arguments | |
| name | Yes | Playbook name to execute |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only states it executes and collapses multiple tool calls. It lacks details on permissions needed, side effects (e.g., if it's destructive), error handling, or performance implications like rate limits, leaving significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly conveys the core functionality without any wasted words, making it easy to understand at a glance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of executing multi-step playbooks, no annotations, and no output schema, the description is insufficient. It doesn't explain what a playbook is, expected outcomes, error cases, or integration with other tools, leaving critical context missing for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents parameters adequately. The description adds no additional meaning beyond the schema, such as examples of playbook names or argument structures, but doesn't contradict it, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('execute') and resource ('multi-step playbook'), and distinguishes it from siblings by specifying it collapses multiple tool calls into one invocation. However, it doesn't explicitly differentiate from 'gateway_invoke' which might also execute something, leaving some ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'gateway_invoke' or other siblings. The description implies it's for multi-step operations but doesn't specify prerequisites, exclusions, or typical scenarios for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_search_toolsSearch ToolsARead-onlyIdempotent
Search 0 tools across 0 servers by keyword. Returns ranked matches with full schemas, saving ~95% context tokens vs loading all tool definitions. Supports multi-word queries and synonym expansion.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results (default 10) | |
| query | Yes | Search keyword |
Output Schema
| Name | Required | Description |
|---|---|---|
| matches | Yes | Ranked list of matching tools |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds valuable context beyond annotations: it specifies that results are ranked, include full schemas, save ~95% context tokens, and support multi-word queries and synonym expansion. Annotations cover read-only, non-destructive, and idempotent traits, but the description enriches this with performance and functionality details without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and key benefits in two concise sentences. Every sentence earns its place by adding specific value: the first states the action and efficiency gain, the second details query support. No wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (search functionality with ranking and schema retrieval), rich annotations (read-only, idempotent, etc.), and the presence of an output schema, the description is complete enough. It covers purpose, usage, behavioral traits, and efficiency benefits, leaving output details to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents the 'limit' and 'query' parameters. The description adds no additional parameter semantics beyond what the schema provides, such as details on query syntax or result ranking, but it does imply the 'query' parameter supports multi-word and synonyms, which slightly enhances understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific verb ('Search') and resource ('tools'), and distinguishes from siblings like 'gateway_list_tools' by emphasizing keyword-based search with ranking and schema retrieval. It explicitly mentions the efficiency benefit of saving context tokens versus loading all definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool: for searching tools by keyword with ranked results and full schemas, and when not to use it (implied by contrasting with 'gateway_list_tools' for listing all tools without search). It also mentions the benefit of saving context tokens, guiding usage based on efficiency needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_set_profileSet Routing ProfileA
Switch the active routing profile for this session. A routing profile restricts which tools and backends are available.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | Yes | Name of the routing profile to activate (e.g. "research", "coding") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions that routing profiles restrict tool/backend availability, which is helpful, but lacks details on permissions needed, whether changes are session-specific or persistent, error conditions, or side effects. For a mutation tool with zero annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero waste: the first states the action and resource, and the second explains the purpose of routing profiles. It is front-loaded and efficiently structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (mutates session state), lack of annotations, and no output schema, the description is incomplete. It covers the basic purpose but misses behavioral details like effects, permissions, or response format. However, it does provide enough to understand the core function.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the 'profile' parameter with examples. The description does not add any parameter-specific details beyond what the schema provides, such as valid profile names or constraints, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Switch') and resource ('active routing profile for this session'), and distinguishes from siblings by focusing on profile activation rather than listing, getting, or other operations. It explains what a routing profile does, adding useful context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing to change tool/backend availability, but does not explicitly state when to use this vs. alternatives like 'gateway_get_profile' or 'gateway_list_profiles'. No exclusions or prerequisites are mentioned, leaving some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_webhook_statusWebhook StatusA
List registered webhook endpoints and their delivery statistics (received, delivered, failures, last event)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It implies a read-only operation by using 'List', but lacks details on permissions, rate limits, pagination, or response format, leaving significant gaps for a tool that likely returns structured data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the purpose ('List registered webhook endpoints') and adds necessary detail ('delivery statistics') without any wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a read operation with no parameters) and lack of annotations or output schema, the description is minimally adequate. It states what the tool does but omits behavioral details like response structure or constraints, making it incomplete for full agent understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so the schema fully documents the absence of inputs. The description adds no parameter information, which is acceptable here, but a baseline of 4 is appropriate as it doesn't need to compensate for any gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('List registered webhook endpoints') and the resources involved ('delivery statistics'), distinguishing it from siblings like gateway_get_stats or gateway_list_servers by focusing on webhook-specific data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like gateway_get_stats or gateway_list_servers, nor does it mention prerequisites or context for retrieving webhook status versus other gateway information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
15 tool updates
v0.1.0- First observed
gateway_cost_report - First observed
gateway_get_profile - First observed
gateway_get_stats - First observed
gateway_invoke - First observed
gateway_kill_server - First observed
gateway_list_disabled_capabilities - First observed
gateway_list_profiles - First observed
gateway_list_servers - First observed
gateway_list_tools - First observed
gateway_reload_config - First observed
gateway_revive_server - First observed
gateway_run_playbook - First observed
gateway_search_tools - First observed
gateway_set_profile - First observed
gateway_webhook_status
TDQS
Scored across 15 tools
Each tool has a clearly distinct purpose with no ambiguity. For example, gateway_list_tools lists tools, gateway_search_tools searches them, gateway_invoke invokes them, and gateway_get_stats provides usage statistics. Tools like gateway_kill_server and gateway_revive_server are complementary but distinct in their actions (disable vs. re-enable).
All tools follow a consistent 'gateway_verb_noun' pattern, such as gateway_list_servers, gateway_set_profile, and gateway_reload_config. This uniformity makes the tool set predictable and easy to navigate, with no deviations in naming conventions.
With 15 tools, the count is well-scoped for a gateway server that manages backend servers, routing, and monitoring. Each tool serves a specific function in this domain, such as listing, searching, invoking, and controlling servers, without being excessive or insufficient.
The tool set provides complete coverage for gateway operations, including server management (list, kill, revive), tool discovery (list, search), invocation, routing control (profiles), monitoring (stats, cost reports), and configuration (reload). There are no obvious gaps, enabling agents to handle all typical gateway workflows.
Maintenance
Related MCP Connectors
The OpenRouter for tools. One MCP connection gives any AI agent 254 hosted tools, pay per call.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
- gatewayOAuthai.sealgate
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA meta-server that aggregates multiple MCP servers into a single interface, reducing token usage by 98%+ through progressive tool discovery and direct code execution that processes data between tools without consuming context window space.16 npm10Apache 2.0
- AlicenseNot gradedqualityCmaintenanceA universal gateway that aggregates multiple MCP servers into a single interface while providing advanced token optimization, result filtering, and automated summarization. It enables efficient management of large tool catalogs and reduces context usage by up to 95% for major AI clients.13 npm15MIT
- AlicenseNot gradedqualityCmaintenanceA unified gateway and web dashboard that aggregates multiple MCP servers into a single Streamable HTTP endpoint. It supports stdio, SSE, and HTTP protocols, featuring optimized tool exposure modes to reduce token consumption for AI clients.5MIT
- AlicenseAqualityAmaintenanceA single MCP server gateway that reduces context bloat by providing progressive tool discovery and invocation, dynamically provisioning downstream servers on demand.2620MIT