Skip to main content
Glama

MCP Gateway

CI Crates.io Downloads Rust License unsafe denied dependency status Capabilities MCP Protocol OWASP Agentic AI MITRE F3 Glama Quality Score Install in VS Code Install in Cursor

One gateway between your AI and every tool it needs, without flooding the context window.

MCP Gateway is a single Rust binary that sits between an AI client and all of its tools. Connect MCP servers and REST APIs behind it, and the agent sees a compact meta-surface of 14 to 17 tools instead of every backend definition. It discovers and calls backend tools on demand. A small live-agent benchmark found no completed-task token saving from that extra hop, so the value is catalog capacity plus policy and routing—not a blanket token claim. See Benchmarks.

demo

Personal and noncommercial use is free, including running the full gateway. Running it commercially needs a commercial license.

The problem this removes

Every MCP tool an AI client connects costs roughly 150 tokens of context overhead, loaded into every request whether the tool gets used or not. Connect 20 servers with 100 tools between them and you spend about 15,000 tokens before the conversation starts. Context limits then force a second cost: you have to decide up front which tools to connect and leave the rest out, so the agent makes worse decisions because it cannot reach data you chose not to load.

MCP Gateway moves the full catalog out of the exposed tool list. The agent loads a small fixed set of meta-tools, searches with gateway_search_tools, and invokes a backend tool with gateway_invoke. This creates room for larger catalogs, but the extra search hop can cost more tokens and time on a completed task.

flowchart LR
    AI["AI client<br/>(Claude, Cursor, ...)"]
    subgraph GW["MCP Gateway (single binary)"]
        META["Compact meta-surface<br/>14-17 tools"]
        DISC{"Discover on demand<br/>gateway_search_tools<br/>gateway_invoke"}
    end
    T1["MCP backend<br/>Tavily (stdio)"]
    T2["MCP backend<br/>Context7 (http)"]
    C1["REST capability<br/>GitHub"]
    C2["REST capability<br/>Stripe"]
    Cn["110+ capabilities"]

    AI -->|"14-17 tool defs"| META
    META --> DISC
    DISC --> T1
    DISC --> T2
    DISC --> C1
    DISC --> C2
    DISC --> Cn

Related MCP server: MCP Gateway

Quick Start

Four commands:

brew trust --tap MikkoParkkola/tap   # Homebrew 6.0+
brew install MikkoParkkola/tap/mcp-gateway   # 1. install
mcp-gateway setup wizard --configure-client  # 2. import existing servers + wire up clients
mcp-gateway serve                            # 3. run
mcp-gateway doctor                           # 4. verify everything is healthy

That is it. Your AI clients now talk to the gateway, and the gateway routes to every backend you already had configured, at a flat ~15 tools instead of ~150. Start with gateway_search_tools from your AI client to find any backend tool, then invoke it with gateway_invoke.

Nothing to import yet? mcp-gateway init --with-examples writes a working gateway.yaml with public capabilities so you can confirm the gateway is alive before adding your own servers.

Or tell your AI assistant (recommended):

Read https://github.com/MikkoParkkola/mcp-gateway and install mcp-gateway to consolidate all my MCP servers behind one gateway

Your agent will install the binary, run the setup wizard, import your existing MCP servers, and wire itself up. This works in Claude Code, Cursor, Windsurf, Codex, and any AI with terminal access.

Install

Method

Command

Homebrew (macOS/Linux, recommended)

brew install MikkoParkkola/tap/mcp-gateway

Cargo

cargo install mcp-gateway

cargo-binstall

cargo binstall mcp-gateway

Direct binary download (Windows x64)

Download mcp-gateway-windows-x86_64.exe from the latest release

Docker

docker run -v $(pwd)/gateway.container.yaml:/config.yaml:ro ghcr.io/mikkoparkkola/mcp-gateway:latest --config /config.yaml

On Linux, the image runs as UID/GID 1001. Make an owner-only deployment copy instead of changing ownership on your working config: install -m 600 gateway.yaml gateway.container.yaml && sudo chown 1001:1001 gateway.container.yaml. Do not make a credential-bearing config world-readable. Docker Desktop handles bind-mount identity differently on macOS and Windows.

# macOS Apple Silicon
curl -L https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-darwin-arm64 -o mcp-gateway && chmod +x mcp-gateway

# macOS Intel
curl -L https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-darwin-x86_64 -o mcp-gateway && chmod +x mcp-gateway

# Linux x86_64
curl -L https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-linux-x86_64 -o mcp-gateway && chmod +x mcp-gateway
# Windows x64 (PowerShell)
Invoke-WebRequest -Uri https://github.com/MikkoParkkola/mcp-gateway/releases/latest/download/mcp-gateway-windows-x86_64.exe -OutFile mcp-gateway.exe

Set up, three ways

mcp-gateway setup wizard --configure-client

Scans Claude Desktop, Claude Code, Cursor, Zed, Continue.dev, Codex, and running MCP processes; lets you pick which servers to import into gateway.yaml; previews the gateway entry; writes it into each detected client config; verifies the write; and prints backup and rollback paths when an existing client config changes. Add --yes to skip the prompts and import everything.

Option B: add servers from the built-in registry

48 popular MCP servers are pre-registered with the right command, args, and env-var template. mcp-gateway add is compatible with claude mcp add and codex mcp add:

mcp-gateway add tavily                                       # known server, fills env vars
mcp-gateway add my-server -- npx -y @some/mcp-server --flag  # arbitrary stdio command
mcp-gateway add --url https://mcp.sentry.dev/mcp sentry      # HTTP server
mcp-gateway add -e API_KEY=xxx my-server -- npx my-mcp-server

mcp-gateway list shows what is configured. mcp-gateway remove <name> removes one.

Option C: hand-write gateway.yaml

For the full schema, see the annotated examples/gateway-full.yaml, which covers env_files, server, auth, meta_mcp, streaming, failsafe, cache, capabilities, and backends. The remaining top-level sections (playbooks, security, webhooks, routing_profiles, code_mode, mtls, key_server, agent_auth, runtime, marketplace, control_plane, cost_governance) have no prose reference yet; the Config struct in src/config/mod.rs is the authoritative list. Minimal example:

server:
  port: 39400

meta_mcp:
  enabled: true

backends:
  tavily:
    command: "npx -y @anthropic/mcp-server-tavily"
    description: "Web search"
    env:
      TAVILY_API_KEY: "${TAVILY_API_KEY}"

  sentry:
    http_url: "https://mcp.sentry.dev/mcp"
    description: "Sentry issues"

Run and verify

mcp-gateway serve                  # start the gateway
mcp-gateway doctor                 # diagnose config, port, env vars, backend health
mcp-gateway doctor --fix           # auto-fix issues where possible

The web dashboard is at http://localhost:39400/ui once serve is running. The operator dashboard at /dashboard needs the admin credential, and a browser cannot send one on a navigation — so serve prints a single-use link to open it with, on a loopback bind. A network-bound gateway prints none and is managed through /ui with the token instead. See Opening the dashboard.

Connect AI clients (if you skipped Option A)

setup export writes the gateway entry into client config files for you. It auto-detects the right path per client:

mcp-gateway setup export --target all --dry-run       # preview without writing
mcp-gateway setup export --target all                 # write, back up, verify
mcp-gateway setup export --target claude-code         # one client
mcp-gateway setup export --target all --watch         # regenerate on gateway.yaml changes
mcp-gateway setup export --rollback <backup-file>     # restore one client config

Existing client files are backed up before mutation. The command prints the exact rollback command beside each updated client.

Client

Config path

claude-code

~/.claude.json

claude-desktop

platform-specific

cursor

.cursor/mcp.json (workspace)

vs-code-copilot

.vscode/mcp.json (workspace)

windsurf

~/.codeium/windsurf/mcp_config.json

cline

.cline/mcp_servers.json (workspace)

zed

~/.config/zed/settings.json

Modes: --mode proxy (HTTP), --mode stdio (subprocess), --mode auto (probe the health endpoint, then fall back).

{
  "mcpServers": {
    "gateway": {
      "type": "http",
      "url": "http://localhost:39400/mcp"
    }
  }
}

Why use MCP Gateway?

  • Larger catalog, smaller exposed surface. The agent loads a fixed meta-surface instead of every backend definition. In the checked-in live run, both paths completed every task, but the meta path used 1.2–16.1% more input tokens and added one turn. See Benchmarks.

  • Unlimited tools, discovered on demand. No more choosing which servers fit the budget. The agent searches (gateway_search_tools) and invokes (gateway_invoke) tools as it needs them.

  • Add any REST API in minutes. Drop in a YAML file or import an OpenAPI spec with mcp-gateway cap import. 110+ capabilities ship built in.

  • Per-user identity to backends. Multitenant backends can receive the verified end-user identity with no gateway-stored long-lived credential. See Multitenant identity.

  • Secure by construction. A tool-poisoning validator scans every backend tool description before it reaches the agent. SHA-256 capability pinning is optional: unpinned files load, pinned files fail closed on mismatch. OWASP Agentic AI Top 10 coverage is self-assessed in-tree, not a certification. The crate sets #![deny(unsafe_code)], so any unsafe block needs an explicit #[allow] opt-in, with optional mTLS, message signing, and agent identity.

  • Swap your MCP stack without losing your session. Hot-reload backends and config in about 8ms while the AI stays connected. No restart, no lost context.

  • Production resilience. Circuit breakers, retries with backoff, rate limiting, and health checks keep one flaky server from taking down the whole toolchain.

  • Dual protocol. MCP plus an A2A (agent-to-agent) transport adapter, so the same gateway routes tool calls and cross-provider agent messages.

What MCP Gateway is, and what it is not

MCP Gateway is a tool and capability router. It routes MCP tool, resource, and prompt traffic to backend MCP servers and to capability-backed REST APIs, and it can proxy MCP server-to-client requests like sampling/createMessage, elicitation/create, and roots/list back to the connected client over the existing session.

It is not a chat-completions or embeddings proxy. When a backend asks for sampling/createMessage, the connected client performs the model call, not the gateway. The OpenAI-compatible prompt-cache helpers exist for one narrow reason: so gateway_invoke can preserve prompt_cache_key behavior for backends that call LLM APIs internally. That boundary is deliberate. The value here is routing hundreds of tools through a small surface, not sitting in the model path.

Compared with the default approach of loading every tool definition into every request, the gateway trades a one-time discovery hop for a flat, small context cost. Compared with generic transport bridges that expose one server at a time, it aggregates many backends behind one namespaced surface with integrity checks, ranking, and per-user identity.

Multitenant identity

A multitenant backend (email, memory, calendar) that runs its own OIDC normally sees only "the gateway," so it cannot enforce per-user access or produce a per-user audit trail. mcp-gateway propagates the verified end-user identity to the backend through one of three configured strategies. It can mint a short-lived gateway-signed assertion, forward the caller's own token, or run an RFC 8693 token exchange for OAuth-native backends. It keeps no long-lived credential for anyone. A backend marked required fails closed rather than serve a shared key when no verified identity is present, and per-user results stay isolated in the cache. See ADR-007, ADR-008, and docs/UPGRADING-3.0.md. For the full propagation sequence, each strategy's wiring, the safety invariants, and the 2.x upgrade path, see What is new in v3.1.0: end-user identity to backends.

Independent reviews

  • Five MCP hot-reload tools compared: Ruach Tov Collective's BPD-based comparison of mcp-gateway against four restart-focused alternatives, with a feature matrix and architectural analysis.

  • mcp-gateway deep dive: a walkthrough of the capability system, SHA-256 integrity pinning, and the v2.5 to v2.9 development arc.

Quantitative claims in this README are sourced from docs/BENCHMARKS.md and the machine-readable benchmarks/public_claims.json, with a CI check that fails on drift. The public Trust Fabric plan is tracked in docs/roadmap/mik-6550-trust-fabric-roadmap.md.

Why the token math matters

Every MCP tool you connect costs about 150 tokens of context overhead. Connect 20 servers with 100 tools and you have burned roughly 15,000 tokens before the first message, on definitions the AI probably will not use this turn. Worse, context limits force you to choose which tools to connect at all, so the agent makes weaker decisions because the right data is out of reach.

Without gateway

With gateway

Tools in context

Every definition, every request

17 meta-tools in the README benchmark (~1,700 tokens)

Schema footprint

~15,000 modeled tokens (100 tools)

~1,700 modeled tokens before discovery; not completed-task cost

Measured task cost

Direct path was lower at every tested size

Meta path used 1.2–16.1% more input tokens and one extra turn

Practical tool limit

20 to 50 tools under context pressure

Unlimited, discovered on demand

Connect a new REST API

Build an MCP server (days)

Drop a YAML file or import an OpenAPI spec (minutes)

Changing MCP config

Restart the AI session, lose context

Restart gateway (~8ms), session stays alive

When one tool breaks

Cascading failures

Circuit breakers isolate it

The gateway exposes 14 tools minimum, 17 in the README benchmark scenario. The base discovery quartet stays fixed; the rest are operator helpers for stats, cost, playbooks, profile control, disabled-capability visibility, and reload. Webhook status is listed only where it can answer: a deployment with a webhook registry attached, which the stdio transport never has. It costs context exactly where it is useful.

Code Mode: two tools instead of the meta-tool set

Setting code_mode.enabled: true makes tools/list return exactly two tools, gateway_search and gateway_execute, instead of the meta-tool set. Everything else is reached through those two. Tools named in meta_mcp.surfaced_tools are not appended in this mode, so the count stays at two however many backends are connected. Code Mode is off by default. gateway_search returns L0 by default (tool name, one-line purpose, score). Pass detail=l1 or detail=l2 for more, or explain=true for ranking diagnostics. include_schema=true is deprecated and maps to L2.

code_mode:
  enabled: true

Security

Connecting N MCP servers to an agent means accepting N attack surfaces. Tool poisoning, rug pulls, and exfiltration through hidden instructions in tool descriptions are demonstrated attacks, not hypotheticals. Invariant Labs' writeup (MCP Security Notification: Tool Poisoning Attacks) and Simon Willison's summary (MCP has prompt injection security problems) lay out the threat model.

mcp-gateway puts every backend tool description behind one audit surface and defends it structurally:

  • Tool-poisoning validator (AX-010). Every backend tool description is scanned before it reaches the agent's context window. HIGH patterns fail closed: <IMPORTANT> blocks, ~/.ssh/~/.aws/id_rsa/.env//etc/passwd, sidenote exfiltration language, curl .* https?://, and base64 in an exfil context. MEDIUM patterns warn: 40+ consecutive spaces, zero-width or bidi-override Unicode, and oversized descriptions. Implementation: src/validator/rules/tool_poisoning.rs (19 tests).

  • Optional SHA-256 capability hash-pinning. mcp-gateway cap pin <file> writes a sha256: line over the file's canonical hash (grep -v '^sha256:' capability.yaml | sha256sum reproduces it from any shell). Unpinned files still load. A pinned file that no longer matches fails closed on load and on every watcher event.

  • Rug-pull detection. When a pinned capability's on-disk content changes after approval, the watcher unloads it and logs RUG-PULL DETECTED. The capability stays quarantined until an operator re-pins it. Implementation: src/capability/hash.rs and detect_rug_pulls in src/capability/backend.rs.

  • Centralized audit surface. Capability YAMLs are plain text: diffable, greppable, and reviewable in a PR. The agent only ever sees the compact meta-surface, so there is no N-server tool-list pollution and no N-server attack surface.

Full walkthrough, PoC snippets, and roadmap: docs/blog/security-aware-mcp-gateway.md.

  • OWASP Agentic AI Top 10 (self-assessed). Controls are mapped across all 10 ASI risks at the gateway boundary in-tree. That is not a certification. Hardening follow-ups are tracked separately for SBOMs, release signing, live remote attestation discovery, multi-gateway signing, SQL-sink defaults, and collusion detection. See docs/OWASP_AGENTIC_AI_COMPLIANCE.md.

  • MITRE Fight Fraud Framework (F3). A tactic-by-tactic mapping of the same gateway-boundary controls to F3 v1.1, including the two F3-native tactics (FA0001 Positioning, FA0002 Monetization). Most cash-out and card-scheme techniques are explicit gaps. See docs/compliance/MITRE-F3-MAPPING.md.

Recent additions

  • OpenAPI importer. mcp-gateway cap import <spec-url-or-file> turns an OpenAPI 3 spec into one validated capability YAML per operation. The full Swagger Petstore spec becomes 19 validated capability YAMLs end to end:

    mcp-gateway cap import https://petstore3.swagger.io/api/v3/openapi.json --output capabilities/ --prefix petstore

    22 tests across src/capability/openapi.rs and tests/openapi_import_tests.rs.

Architecture

flowchart TB
    subgraph GW["MCP Gateway (:39400)"]
        META["Meta-MCP surface: 14-17 tools<br/>gateway_list_servers · gateway_list_tools<br/>gateway_search_tools · gateway_invoke"]
        FS["Failsafes: circuit breaker · retry · rate limit"]
        META --> FS
    end
    FS --> B1["Tavily<br/>(stdio)"]
    FS --> B2["Context7<br/>(http)"]
    FS --> B3["Pieces<br/>(sse)"]
    FS --> B4["REST capabilities<br/>(110+)"]

Single-binary gateway. An AI client talks to the compact meta-surface, and the gateway dynamically discovers and routes to backend tools. Key modules: gateway/ (core router, OAuth, streaming, UI), provider/ (MCP/composite/capability), capability/ (discovery, validation), transport/ (HTTP, stdio), security/ (firewall, mTLS, message signing, agent identity, memory scanner), identity_propagation/, key_server/, cost_accounting/, scheduler/, skills/, tool_profiles/, config_reload/, and a2a/ (A2A transport adapter).

Features

Web dashboard

Embedded web UI at /ui: live status, searchable tools, server health, a read-only control-plane view, and a config viewer. Operator dashboard at /dashboard, which needs the admin credential — on a loopback bind serve prints a single-use link to open it with, since a browser cannot attach an Authorization header to a navigation. Cost tracking at /ui#costs. All served from the same binary and port, with no frontend build step.

Security and governance

Feature

Description

Docs

Authentication

Bearer tokens, API keys, explicit admin keys, per-client rate limits, and opt-in per-client circuit breakers. With auth disabled every caller over HTTP is anonymous and holds no admin; a stdio caller is admin, because the client spawned the process

examples/per-client-tool-scopes.yaml

Cross-site protection

Origin, Host and Sec-Fetch-Site validation refuses web pages reaching the local port. A client that sends no Origin is not refused for that, but the Host check applies to every request, so a client reaching the gateway by a name it does not answer to is refused whether or not it is a browser

docs/DEPLOYMENT.md

End-user identity propagation

Three configured strategies (identity_propagation config): gateway-signed assertion, client-token passthrough, and RFC 8693 token exchange. Fails closed when a backend requires identity. Per-user cache isolation. Enforced on dispatch, Code Mode, and direct routes.

docs/adr/ADR-007-identity-propagation.md

Per-user OAuth isolation

Fail-closed default (v3.0): a backend that requires a per-user OAuth identity refuses a call that lacks one instead of serving a shared stored token. Opt into the previous shared-credential behavior with auth.single_user: true (personal gateway) or oauth.shared_account: true (a specific backend). Upgrading from 2.x backs up gateway.yaml and prints a one-time posture notice; no config changes automatically.

docs/adr/ADR-008-multi-user-oauth-isolation.md, docs/UPGRADING-3.0.md

Cleartext credential refusal

A backend whose configuration is credential-bearing — an oauth section, identity propagation, injected secrets, any static header whatever its name, or userinfo or a query in the URL — over plain http:// to a host off this machine is refused at config load rather than started. Loopback is exempt; allow_cleartext_credentials: true on that backend accepts the exposure knowingly

docs/REMOTE_BACKENDS.md

Per-client tool scopes

Allowlist or denylist tools per API key with glob patterns

examples/per-client-tool-scopes.yaml

Security firewall

Credential redaction, prompt-injection detection, and shell/SQL/path-traversal scanning

CHANGELOG

Cost governance

Per-tool, per-key, daily budgets with alert thresholds (log/notify/block)

CHANGELOG

Session sandboxing

Per-session call limits, duration caps, backend restrictions

CHANGELOG

mTLS

Certificate-based auth for tool execution

CHANGELOG

MITRE F3 mapping

Tactic-by-tactic map of gateway-boundary controls to Fight Fraud Framework v1.1. Monetization and card-scheme techniques are listed as gaps

docs/compliance/MITRE-F3-MAPPING.md

Integration and discovery

The gateway ships with 110+ built-in capabilities: weather, Wikipedia, GitHub, stock quotes, package tracking, and more. Capability YAMLs hot-reload automatically after file changes, no restart needed.

Feature

Description

Capability system

REST API to MCP tool via YAML. Hot-reloaded. 110+ built-in. OpenAPI import supported.

Transform chains

Namespace, filter, rename, and response transforms. Example.

Webhooks

GitHub/Linear/Stripe push events as MCP notifications. Docs.

Auto-discovery

Discover MCP servers from existing client configs and running processes.

Surfaced tools

Pin high-value tools directly in tools/list for one-hop invocation.

Semantic search

TF-IDF ranked search across all tool names and descriptions.

Tool profiles

Usage analytics per tool: latency, errors, trends. Persisted to disk.

Config export

Export sanitized config as YAML or JSON via mcp-gateway config export.

Protocol and transport

  • MCP versions: the initialize handshake negotiates up to 2025-11-25. The newer 2026-07-28 revision is reached only on the stateless POST /mcp path, via the MCP-Protocol-Version header; it is served by default and is switched off with server.modern_protocol: false

  • Transports: stdio, Streamable HTTP, SSE, WebSocket

  • Hot reload: capability YAMLs and backends are watched and reloaded live. server.public_url and control_plane.role_mapping are re-read per request; everything else needs a restart

  • Reload outcomes: gateway_reload_config and /ui/api/reload report restart_required, and keep reporting it until a restart, for every field a reload cannot apply — which is every field outside that short live list, auth included. A reload that would leave the tool endpoint reachable without a credential is refused rather than applied

  • Config discovery: auto-finds gateway.yaml in cwd, ~/.config/mcp-gateway/, and /etc/mcp-gateway/

  • "Did you mean?": Levenshtein-based typo correction on tool names

  • Tool annotations: MCP 2025-11-25 title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint; gateway meta-tools are fully annotated, while backend tools use the hybrid pass-through/fill policy in ADR-003

  • Dynamic descriptions: live tool and server counts in meta-tool descriptions

  • Tunnel mode: expose via Tailscale or pipenet without opening ports

  • Shell completions: mcp-gateway completions bash|zsh|fish

  • Spec preview (opt-in): filtered tools/list (SEP-1821), tools/resolve (SEP-1862), dynamic promotion

Supported backends

Any MCP-compliant server works. All three transport types are supported:

Transport

Examples

stdio

@anthropic/mcp-server-tavily, @modelcontextprotocol/server-filesystem, @modelcontextprotocol/server-github

HTTP

Any Streamable HTTP server

SSE

Pieces, LangChain, GitMCP (free remote docs and code search for any GitHub repo)

Remote MCP servers plug in by URL, with no extra code. See examples/gateway-full.yaml for a commented GitMCP backend entry and docs/REMOTE_BACKENDS.md for a step-by-step walkthrough.

Public MCP Gateway Comparison

This table compares public, user-facing behavior, not internal roadmap scoring. MCP Gateway entries are grounded in this repo's public docs: quickstart, deployment, OWASP controls, TrustCard/CBOM, CatalogTrustLab, adaptive ranking, identity grants, ADR-007 identity propagation, ADR-008 multi-user OAuth isolation, and the Trust Fabric roadmap. Competitor entries are grounded in public project docs: Docker MCP Catalog and Toolkit, MCPJungle README, mcpo README, and Supergateway README.

Axis

MCP Gateway

Docker MCP Gateway / Toolkit

MCPJungle

mcpo / Supergateway

Primary job

MCP and REST capability router with a compact meta-surface

Docker-managed catalog, profiles, containerized MCP servers, and gateway

Self-hosted gateway that runs many MCP servers behind one endpoint

Protocol bridges: MCP to OpenAPI for mcpo; stdio to SSE/WS for Supergateway

Install

Standalone Rust binary via cargo, Homebrew, VS Code, Cursor, and local build

Docker Desktop / Docker CLI plugin flow

Self-hosted gateway install and server registration

Python/uvx/Docker for mcpo; npm/CLI bridge for Supergateway

Configuration

Wizard, local starter profile, service templates, client export, doctor JSON, backup and rollback

Docker profiles and catalog selection

Centralized server and client configuration

Per-bridge command/config for each exposed server or transport

Security

OWASP Agentic AI matrix, MITRE F3 gateway-boundary mapping (gaps stated), firewall, response inspection, hash-pinned capabilities, mTLS/signing options

Verified container images with versioning, provenance, and security updates in Docker catalog

Centralized access control and observability

Transport/API exposure layer; security depends on bridge auth and deployment boundary

Identity and grants

Local identity-grant contract and CLI; multi-user OAuth isolation is credential-agnostic by default (ADR-008), and a backend configured required fails closed rather than serve a shared credential; per-user identity propagation to backends via signed assertion, caller-token passthrough, or RFC 8693 token exchange; the OIDC key server is disabled by default, delegated-bearer acceptance is a separate opt-in, and control-plane role mappings are issuer-scoped

Docker/team controls depend on Docker organization setup

Authenticated clients and server access control

Not a grant engine; delegates identity policy to the surrounding deployment

Runtime isolation

RuntimeProvider policy planning plus Docker/Podman/Kubernetes deployment paths

Container-first isolation is the core runtime model

Runs and manages MCP servers behind the gateway

Bridges existing server processes/transports rather than isolating arbitrary tools

Trust metadata

TrustCard/CBOM generation, validation, TrustLab evidence, provenance stubs

Catalog packages carry image provenance and security update flow

Gateway inventory and observability focus

Protocol metadata bridge; trust metadata is not the primary product surface

Discovery

Meta-MCP listing/search, ShadowRadar unmanaged-server inventory, capability registry

Docker MCP Catalog of packaged servers

Centralized discovery across configured servers

Exposes one bridged server surface at a time unless composed externally

Policy and governance

Policy, grants, audit events, read-only control-plane tab/API, enterprise evidence boundary

Docker org/catalog/profile policy model

Centralized access control for teams

No broad governance plane; use with another policy layer when needed

Imports and bridges

Native MCP backends plus REST capability YAML and protocol-import planning

Docker-packaged MCP server catalog

MCP server aggregation

Strong bridge story for OpenAPI, SSE, WebSocket, and stdio compatibility

Ranking and routing

Safety-aware ranking, explanations, cost/latency/trust/health signals

Catalog/profile selection, not an MCP tool ranker

Gateway-level routing to configured servers

Transport routing, not semantic tool ranking

Deployment

Local, team gateway, Docker Compose, systemd, launchd, a security-hardened Helm chart (non-root, seccomp, read-only rootfs), and experimental (v1alpha1) Kubernetes CRDs

Docker Desktop, Docker CLI, Docker Hub/catalog workflow

Local or shared self-hosted gateway

Local or remote bridge process beside the target MCP server

Licensing

PolyForm Noncommercial 1.0.0 throughout; commercial use requires a license

Docker product and repository licensing apply

See project repository license

See each bridge repository license

vs Anthropic MCP tunnels

On 2026-05-19 Anthropic shipped Claude Managed Agents with self-hosted sandboxes (public beta) and MCP tunnels (research preview). An MCP tunnel lets a Claude agent reach a single MCP server inside a private network through one outbound connection from a lightweight gateway, with no inbound firewall rules, no public endpoint, and end-to-end encryption.

mcp-gateway and Anthropic's MCP tunnel sit at different layers and compose. The tunnel is reachability plumbing for one private MCP server. mcp-gateway is the aggregation, routing, capability-namespacing, and observability layer across many MCP and REST backends. Deploy both and mcp-gateway becomes the private MCP server that the tunnel exposes: one tunnel, one outbound connection, every backend behind it.

Concern

Anthropic MCP tunnel

mcp-gateway

Boundary

Backend topology

Single MCP server per tunnel, exposed through one outbound connection (overview)

N-backend aggregation: 110+ REST capabilities plus multiple MCP backends behind a compact 14-17 tool meta-surface (src/gateway/, capabilities/*.yaml)

Different primitive: 1-server reachability vs many-backend aggregation

Tool routing

Opaque pass-through; the agent sees whatever tool list the tunneled server publishes

Capability namespacing plus dynamic gateway_search_tools / gateway_invoke discovery (src/gateway/); SHA-256 pinning per capability (src/capability/hash.rs)

Different layer: transport reachability vs tool-surface curation and integrity

Observability

Per-tunnel session telemetry from Anthropic's side

Unified trace_id and cost accounting across every backend invocation (src/cost_accounting/, src/gateway/)

Scope distinction: per-tunnel session vs cross-backend trace correlation

They solve adjacent problems. A team that wants Claude Managed Agents to reach a private-network deployment of mcp-gateway uses the tunnel for reachability and mcp-gateway for fan-out, capability hygiene, OWASP Agentic AI controls, and unified cost and trace telemetry.

API

Endpoint

Method

Description

/health

GET

Health check with backend status; authenticated admin callers also see per-backend runtime profile lifecycle state

/mcp

POST

Meta-MCP mode (dynamic discovery)

/mcp/{backend}

POST

Direct backend access

/ui

GET

Web dashboard

/ui/api/control-plane

GET

Read-only local control-plane projection for inventory, runtime health, decisions, RBAC, and license boundaries

/dashboard

GET

Operator dashboard. Admin only; opened with the single-use link serve prints on a loopback bind

/metrics

GET

Prometheus metrics (with --features metrics)

Performance

Metric

Value

Notes

Startup time

~8ms

Measured with hyperfine (benchmarks)

Binary size

~12-13 MB

Release build with LTO, stripped

Hot-path microbenchmarks

Included

Criterion suite covers registry, parsing, cache-key, firewall, and semantic-search hot paths

End-to-end latency

Backend-dependent

Measure with your real MCP servers and REST APIs rather than relying on a synthetic single number

SKILL.md / agentskills.io compatibility

MCP Gateway can ingest Agent Skills and Claude Code SKILL.md files and expose them as discoverable skills alongside capability YAML. This lets the gateway consume any SKILL.md, whether authored locally, shipped from agentskills.io, or pulled from a GitHub release, and surface it through the same meta-tool surface used for capabilities.

# Import a local skill directory (auto-discovers SKILL.md + resources/)
mcp-gateway skills import ~/.claude/skills/gws-gmail-send

# Import a single SKILL.md file
mcp-gateway skills import ./path/to/SKILL.md

# Import from an agentskills.io URL
mcp-gateway skills import https://agentskills.io/skills/my-skill/SKILL.md

# List imported skills
mcp-gateway skills list

# Search by name, description, trigger, or keyword
mcp-gateway skills search "gmail"

# Show the full body (including any embedded code blocks)
mcp-gateway skills show gws-gmail-send

# Remove a skill
mcp-gateway skills remove gws-gmail-send

What gets parsed

  • YAML frontmatter (name, description, version, effort, allowed-tools, triggers, keywords)

  • Markdown body, with fenced bash/python/json code blocks extracted as structured SkillCodeBlock entries

  • Progressive-disclosure resources: SKILL.advanced.md, reference.md, README.md, and any resources/*.md files in the skill directory

Security model (read-only)

Imported skills are stored as data, not executed. Embedded bash or python blocks are parsed and surfaced to users and agents via skills show, but MCP Gateway will never run them automatically. A future release may add opt-in execution gated on per-skill user consent. To run a skill's commands today, copy them from skills show and run them in your own shell.

Registry location: ~/.mcp-gateway/skills.json (override with MCP_GATEWAY_SKILLS_REGISTRY or --registry).

Reference: Anthropic SKILL.md spec and agentskills.io.

Documentation

Document

Contents

Quick Start

Zero to running in 2 minutes

Annotated config example

Commented gateway.yaml covering the most-used config sections

OAuth Configuration

OAuth 2.0 setup with Slack and Figma examples

Upgrading to 4.0

Per-issuer OAuth storage, strict env_files parsing, protocol floor, and the single-license change

Upgrading to 3.0

Per-user OAuth isolation and identity-propagation upgrade path

Deployment Guide

Docker, systemd, TLS/mTLS, scaling

OpenAPI Import

Generate capabilities from OpenAPI specs

Webhooks

Event integration setup

Community Registry

Share and install capabilities

Benchmarks

Performance measurements

Changelog

Release history

OWASP Agentic AI Compliance

Risk coverage matrix

MITRE F3 mapping

Fight Fraud Framework tactic map (PARTIAL/GAP, not a coverage claim)

ShadowRadar

Passive local discovery and static network-rule export

Enterprise agent governance comparison

Willow/Webrix feature bar and mcp-gateway's current gaps

vs Anthropic MCP tunnels

Where mcp-gateway and Anthropic's MCP tunnel compose

Troubleshooting

Backend will not connect? Test the command directly (npx -y @anthropic/mcp-server-tavily), then check gateway logs with --log-level debug.

Circuit breaker open? Ask your MCP client for gateway_list_servers: it reports circuit_breaker per backend and works on the shipped config. The HTTP equivalent, curl -H "Authorization: Bearer $ADMIN_KEY" localhost:39400/health | jq '.backends', additionally needs auth.enabled: true and an admin credential — authentication is off by default, and while it is off every caller is anonymous, so the token is ignored and even a bearer-carrying request sees just {count, all_healthy}. Adjust thresholds in failsafe.circuit_breaker (default: opens after 5 consecutive failures, retries after 30s).

One tool went quiet, then came back on its own about five minutes later? That is the per-capability error budget, not the circuit breaker — separate mechanism, separate keys. A capability whose failure rate crosses error_budget.capability.threshold is disabled on its own, leaving the rest of its backend serving, and re-enables itself on the next call once error_budget.capability.cooldown (default 5 minutes) has elapsed. gateway_list_disabled_capabilities names the ones currently suspended.

A whole backend went offline and stayed offline? The backend-level error budget auto-killed it: its failure rate crossed error_budget.threshold over the sliding window. Unlike a capability, a killed backend does not come back by itself — revive it with gateway_revive_server, and raise the threshold or the window if the kill was premature. gateway_list_servers reports a killed backend as "status": "disabled", which is how you tell an auto-kill apart from an open breaker.

Every key of both budgets is documented inline in examples/gateway-full.yaml under error_budget:. Rate-limited responses (429, RESOURCE_EXHAUSTED) are excluded from both budgets: a throttled backend is a working backend, so throttling alone can neither kill a backend nor disable a capability.

Tools not appearing? Verify the backend is running (gateway_list_servers). Tool lists are cached for 5 minutes.

Versioning and stability

This project follows Semantic Versioning over its product surface: the CLI, and the configuration file format. Changes to either are versioned accordingly — a config key that stops being accepted, or a command that changes behaviour, is a breaking change.

The Rust library API is not part of that surface. Types are pub for modularity and testing, not as a supported embedding API, and they may change in any release. The crate ships a binary; at the time of writing crates.io reports zero reverse dependencies. If you embed the library, pin an exact version (=4.0.0) rather than a caret range.

This is stated explicitly because "removing a pub field" and "breaking a supported API" are only the same thing when the API is supported. Here it is not, and that needs to be published rather than assumed.

Contributing

  1. Fork and branch (git checkout -b feature/your-feature)

  2. Test (cargo test) and lint (cargo fmt && cargo clippy -- -D warnings)

  3. Open a PR against main with a clear description and a CHANGELOG entry

See CONTRIBUTING.md for full details. Look for good first issue or help wanted to get started.

Ecosystem

mcp-gateway is part of a suite of MCP tools:

Tool

Description

mcp-gateway

Universal MCP gateway: a compact 14-17 tool surface replaces 100+ registrations

trvl

AI travel agent, 36 MCP tools for flights, hotels, ground transport

nab

Web content extraction: fetch any URL with cookies and anti-bot bypass

axterminator

macOS GUI automation, 34 MCP tools via the Accessibility API

License

mcp-gateway is licensed under the PolyForm Noncommercial License 1.0.0 (LICENSE-NONCOMMERCIAL). Every first-party file carries a copyright line and an explicit // SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0 header. There is no second license and no allowlist.

What this means:

  • Personal and noncommercial use is free, including running the whole gateway.

  • Running the gateway commercially requires a commercial license. This covers the whole project — dispatch, transport, backend management, identity, security, governance — including the generic building blocks that earlier 3.x releases shipped under MIT headers. See COMMERCIAL.md.

  • Rights granted in earlier releases are not revoked. Versions 3.0.0–3.2.1 were published with MIT package metadata, and v3.3.0 onward in the 3.x line shipped a small MIT core under per-file headers. Those copies stay MIT for their recipients; from v4.0.0 there is no MIT core. See NOTICE.md.

Full model: LICENSES.md.

Credits

Created by Mikko Parkkola. Implements Model Context Protocol versions 2025-11-25 and 2026-07-28; the newer revision is served by default and can be switched off.

Changelog | Releases

Available Tools

15 tools
gateway_cost_reportCost ReportA

Return current session and API-key spend. Includes total cost, call count, and breakdown by backend and tool. Per-key totals are shown for 24 h / 7 d / 30 d rolling windows.

ParametersJSON Schema
NameRequiredDescriptionDefault
include_all_keysNoReturn all API key accumulators (admin view). Default false.
include_all_sessionsNoReturn all active sessions (admin view). Default false.
session_idNoSpecific session ID to report on. Defaults to current session.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses behavioral traits such as the types of data returned (cost, call count, breakdowns) and time windows, but lacks details on permissions, rate limits, or error handling. It adequately describes the operation but could be more comprehensive for a tool with potential admin functions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence, followed by specific details in a compact format. Every sentence adds essential information without redundancy, making it highly efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (cost reporting with admin options) and lack of annotations or output schema, the description is mostly complete. It covers what data is returned and parameter context, but could benefit from mentioning output format or error cases to be fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents parameters. The description adds value by explaining the context of the parameters (e.g., 'admin view' for include_all_keys and include_all_sessions, and default behavior for session_id), enhancing understanding beyond the schema's technical details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('Return', 'Includes') and resources ('current session and API-key spend', 'total cost, call count, breakdown by backend and tool', 'Per-key totals'). It distinguishes itself from siblings by focusing on cost reporting, unlike tools like gateway_get_stats (general stats) or gateway_list_tools (tool listing).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for monitoring spend and provides context on what data is included (e.g., 24h/7d/30d windows), but it does not explicitly state when to use this tool versus alternatives like gateway_get_stats or provide exclusions. Usage is inferred from the content rather than directly guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_get_profileGet Routing ProfileB

Show the active routing profile for this session and what it allows or denies.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool 'shows' information, implying a read-only operation, but doesn't clarify if it requires authentication, has rate limits, or what happens if no profile is active. For a tool with zero annotation coverage, this is a significant gap in transparency, as it lacks details on permissions, errors, or response format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose ('show the active routing profile') and adds useful context ('for this session and what it allows or denies'). There is no wasted verbiage, and every word contributes to understanding the tool's function, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (0 parameters, no output schema, no annotations), the description is minimally adequate. It explains what the tool does but lacks details on behavioral aspects like error handling or return values. Without an output schema, the description should ideally hint at the response format, but it doesn't, leaving some gaps in completeness for a tool that interacts with session settings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, and the input schema has 100% description coverage (though empty). The description adds no parameter information, which is appropriate here. In such cases, the baseline score is 4, as there are no parameters to document, and the description doesn't need to compensate for any schema gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to 'show the active routing profile for this session and what it allows or denies.' It specifies the verb ('show') and resource ('active routing profile'), and distinguishes it from siblings like 'gateway_list_profiles' (which likely lists all profiles) and 'gateway_set_profile' (which modifies profiles). However, it doesn't explicitly contrast with these siblings, keeping it from a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by mentioning 'for this session,' suggesting it's used to check current session settings. However, it provides no explicit guidance on when to use this tool versus alternatives like 'gateway_list_profiles' or 'gateway_set_profile,' nor does it mention prerequisites or exclusions. This leaves usage somewhat inferred rather than clearly defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_get_statsGet Gateway StatisticsC

Get usage statistics including invocations, cache hits, token savings, and top tools

ParametersJSON Schema
NameRequiredDescriptionDefault
price_per_millionNoToken price per million for cost calculations (default 15.0 for Opus 4.6)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. While it indicates this is a read operation ('Get'), it doesn't mention authentication requirements, rate limits, whether this is real-time or historical data, or what format the statistics are returned in. For a statistics tool with zero annotation coverage, this leaves significant behavioral questions unanswered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that clearly states the tool's purpose. Every word earns its place by specifying what statistics are included, making it appropriately concise and front-loaded with essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a statistics tool with no annotations and no output schema, the description is insufficiently complete. It doesn't explain what format the statistics are returned in, whether they're aggregated or detailed, what time periods they cover, or how to interpret the results. The description should provide more context about the statistical output given the lack of structured documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description mentions 'token savings' which relates to the 'price_per_million' parameter in the schema, but doesn't add meaningful semantic context beyond what the schema already provides (100% coverage). The schema already documents this parameter with a clear description and default value, so the description adds minimal additional value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get') and resource ('Gateway Statistics'), and specifies the types of statistics included (invocations, cache hits, token savings, top tools). However, it doesn't explicitly differentiate from sibling tools like 'gateway_cost_report' or 'gateway_get_profile' which might also provide statistical data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. With multiple sibling tools that might provide related statistics (gateway_cost_report, gateway_get_profile), there's no indication of when this specific statistics tool is appropriate versus those other options.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_invokeInvoke ToolA

Invoke any tool on any backend server. Routes through the gateway's auth, rate-limit, caching, and failsafe middleware. Use gateway_search_tools first to discover the right tool and server.

ParametersJSON Schema
NameRequiredDescriptionDefault
argumentsNoTool arguments
serverYesBackend server name
toolYesTool name to invoke

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable behavioral context beyond annotations by specifying that it 'Routes through the gateway's auth, rate-limit, caching, and failsafe middleware.' While annotations provide readOnlyHint=false and openWorldHint=true, the description elaborates on the gateway's processing pipeline, which helps the agent understand the execution environment and potential side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly concise with two sentences that each earn their place: the first states the core functionality and behavioral traits, the second provides crucial usage guidance. No wasted words, front-loaded with essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (invoking arbitrary tools with middleware routing) and lack of output schema, the description does well by explaining the gateway middleware and discovery prerequisite. However, it doesn't detail response formats, error handling, or specific auth/rate-limit implications, leaving some gaps for a tool with openWorldHint=true and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the schema already documents all three parameters (arguments, server, tool) adequately. The description doesn't add specific meaning about parameter usage beyond implying that 'server' and 'tool' should be discovered via gateway_search_tools, which is minimal additional value. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Invoke any tool on any backend server') and distinguishes it from siblings by mentioning routing through gateway middleware and the need to use gateway_search_tools first. It explicitly names the resource (tools on backend servers) and the verb (invoke) with clear scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool ('Use gateway_search_tools first to discover the right tool and server') and implies when not to use it (when you already know the specific tool from other sibling tools). It names an alternative (gateway_search_tools) for discovery, making usage context very clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_kill_serverKill ServerA

Immediately disable routing to a backend server (operator kill switch). The server's tools remain visible in search/list but are marked as disabled.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYesName of the backend server to disable

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: the immediate effect ('Immediately disable'), the partial nature of the disablement ('tools remain visible... but are marked as disabled'), and the operational context ('operator kill switch'). It doesn't mention authentication requirements, rate limits, or error conditions, but provides substantial behavioral context for a destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences that are perfectly front-loaded and efficient. The first sentence states the core action and context, the second clarifies the partial nature of the disablement. Every word earns its place with zero redundancy or wasted verbiage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive operation with no annotations and no output schema, the description provides good coverage of what the tool does and its behavioral effects. It explains the partial disablement (tools remain visible but marked disabled) which is crucial context. It doesn't describe the return value or error conditions, but given the tool's relative simplicity and clear purpose, the description is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description doesn't add any parameter-specific information beyond what's already in the schema (which has 100% coverage). The schema already documents that 'server' is a required string parameter representing the backend server name. No additional semantics about parameter format, constraints, or examples are provided in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Immediately disable routing') and target resource ('backend server'), distinguishing it from sibling tools like gateway_revive_server (which presumably re-enables servers) and gateway_list_servers (which only lists them). The 'operator kill switch' phrase reinforces the emergency nature of the operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context about when to use this tool ('Immediately disable routing'), but doesn't explicitly state when NOT to use it or name specific alternatives. However, the existence of gateway_revive_server as a sibling implies this is for disabling rather than permanent removal, and the 'operator kill switch' wording suggests emergency scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_list_disabled_capabilitiesList Disabled CapabilitiesA

List capabilities that have been automatically disabled due to a high error rate. Each entry shows the backend, capability name, and how long it has been suspended. Disabled capabilities auto-recover after the configured cooldown period (default 5 min). Use gateway_revive_server to manually re-enable an entire backend immediately.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so effectively by disclosing key behavioral traits: it explains the cause of disabling ('high error rate'), the auto-recovery mechanism ('auto-recover after the configured cooldown period'), and the default cooldown time ('default 5 min'), though it could mention output format or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence, followed by additional context in a second sentence, and ends with a usage guideline—all sentences are essential with zero waste, making it highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (listing disabled capabilities with recovery details) and no annotations or output schema, the description is mostly complete: it covers purpose, behavior, and usage. However, it lacks details on the output structure (e.g., format of entries) or potential errors, leaving a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Since there are 0 parameters and schema description coverage is 100%, the baseline is 4. The description adds no parameter information, which is appropriate here, but does not detract from the schema's completeness.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('List capabilities that have been automatically disabled due to a high error rate') and resource ('capabilities'), distinguishing it from siblings like gateway_list_servers or gateway_list_tools by focusing on disabled capabilities rather than general listings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool ('List capabilities that have been automatically disabled') and provides a clear alternative for manual re-enablement ('Use gateway_revive_server to manually re-enable an entire backend immediately'), guiding the agent on tool selection based on the desired outcome.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_list_profilesList Tool ProfilesA

List all available routing profiles with their descriptions. Use gateway_set_profile to switch to a profile that narrows the visible toolset to the current task (e.g. "coding", "research").

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes the tool's function (listing profiles) and hints at context (profiles narrow the visible toolset), but lacks details on output format, pagination, or error handling. For a read-only listing tool with zero annotation coverage, this is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with zero waste: the first states the purpose, and the second provides usage guidelines with a clear alternative. It is front-loaded and efficiently structured, earning its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (0 parameters, no output schema, no annotations), the description is mostly complete—it explains what the tool does and when to use it. However, it lacks details on behavioral aspects like output format, which slightly reduces completeness for a tool with no structured data to rely on.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description does not discuss parameters, which is appropriate, but it adds value by explaining the tool's purpose and usage context, justifying a score above the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('List') and resource ('all available routing profiles with their descriptions'), making the purpose specific and unambiguous. It distinguishes this tool from its sibling gateway_set_profile by indicating that one lists profiles while the other switches to them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides when to use this tool ('List all available routing profiles') and when to use an alternative ('Use gateway_set_profile to switch to a profile'), including a named sibling tool and example use cases like 'coding' or 'research'. This gives clear guidance on tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_list_serversList ServersA
Read-onlyIdempotent

List all 0 connected MCP backend servers with their status, tool count, and circuit-breaker state.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is a read-only, non-destructive, idempotent operation with a closed-world scope. The description adds valuable context by specifying what information is returned (status, tool count, circuit-breaker state), which helps the agent understand the output format beyond the safety profile covered by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose ('List all connected MCP backend servers') and immediately specifies the returned attributes. There is zero wasted verbiage, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (0 parameters, no output schema) and rich annotations covering safety and behavior, the description is nearly complete. It adds output details (status, tool count, circuit-breaker state) that compensate for the lack of output schema. A minor gap is the absence of explicit usage guidance versus siblings, but overall it provides sufficient context for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description appropriately focuses on the tool's purpose and output details, earning a baseline score of 4 for zero-parameter tools that avoid unnecessary parameter discussion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('List all'), resource ('connected MCP backend servers'), and scope ('with their status, tool count, and circuit-breaker state'), which distinguishes it from siblings like gateway_get_stats or gateway_list_tools that focus on different resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving server status information, but does not explicitly state when to use this tool versus alternatives like gateway_get_stats (which might provide aggregated metrics) or gateway_list_tools (which lists tools rather than servers). It provides clear context but lacks explicit exclusions or named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_list_toolsList ToolsA
Read-onlyIdempotent

List tools from a specific backend, or omit server to list all 0 tools across 0 backends. Returns names and descriptions — use gateway_search_tools for ranked results with full schemas.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverNoName of backend server. Omit to list ALL tools across all backends.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, non-destructive, and idempotent behavior, so the description doesn't need to repeat these. It adds useful context about the return format ('names and descriptions') and the scope of listing, but doesn't disclose additional behavioral traits like rate limits or pagination. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with zero waste: the first sentence states the purpose and parameter usage, and the second provides a clear alternative. It's front-loaded and efficiently structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (one optional parameter), rich annotations covering safety and behavior, and no output schema, the description is mostly complete. It clarifies the return format and sibling differentiation, but could mention if the list is paginated or sorted. Still, it's adequate for the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents the single parameter. The description adds no extra parameter details beyond what's in the schema, but it reinforces the semantics by explaining the effect of omitting the server parameter. Baseline 3 is appropriate as the schema handles the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('List') and resource ('tools'), specifies the scope ('from a specific backend' or 'all tools across all backends'), and distinguishes it from sibling gateway_search_tools by noting the latter provides 'ranked results with full schemas'. This is specific and avoids tautology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool (list tools with names and descriptions) versus an alternative (gateway_search_tools for ranked results with full schemas). The guidance on omitting the server parameter to list all tools provides clear context for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_reload_configReload ConfigA

Trigger an immediate reload of config.yaml from disk without restarting the gateway. Returns a summary of what changed (backends added/removed/modified, profile updates). Server host/port changes require a restart and are reported but not applied.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so well. It discloses key behavioral traits: it triggers an immediate action, returns a summary of changes, and notes limitations (server host/port changes are reported but not applied). This covers mutation effects and output behavior adequately.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, followed by return details and limitations. Every sentence adds value without redundancy, making it efficient and well-structured for quick understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (a mutation with no annotations and no output schema), the description is mostly complete. It explains what the tool does, what it returns, and key constraints. However, it could briefly mention error cases or prerequisites, but the coverage is strong for the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0 parameters with 100% coverage, so the baseline is 4. The description does not need to add parameter details, and it appropriately focuses on the tool's behavior and output instead.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('trigger an immediate reload of config.yaml from disk') and resource ('gateway'), distinguishing it from siblings like gateway_kill_server or gateway_revive_server. It goes beyond the title by specifying the config file and the no-restart requirement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear context on when to use this tool (to reload config without restarting) and implicitly when not to use it (for server host/port changes, which require a restart). However, it does not explicitly name alternatives like gateway_kill_server for full restarts or compare to other config-related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_revive_serverRevive ServerA

Re-enable routing to a previously disabled backend server. Also resets the error budget so the server gets a clean slate.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYesName of the backend server to re-enable

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the core action (re-enabling routing) and an important side effect (resetting error budget), but doesn't mention potential consequences, permissions required, rate limits, or what happens if the server isn't actually disabled. It provides basic behavioral context but lacks completeness for a mutation operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly concise with two sentences that each add distinct value: the first states the primary action, the second reveals important behavioral context. There's zero wasted language, and the information is front-loaded with the core purpose immediately clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description provides adequate basic information about what the tool does but lacks details about what happens after invocation (success/failure indicators, return values, side effects beyond error budget reset). Given the complexity of server management operations, more context about dependencies, permissions, or system state requirements would be helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the schema already documents the single parameter thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema, but since there's only one parameter and the schema coverage is complete, this represents minimal information loss. The baseline for high schema coverage would be 3, but the single parameter case with complete documentation justifies a slightly higher score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('re-enable routing') on a specific resource ('previously disabled backend server'), and distinguishes it from siblings by mentioning the unique 'reset error budget' functionality. It uses precise verbs and identifies the target resource without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context ('previously disabled backend server') but doesn't explicitly state when to use this tool versus alternatives like 'gateway_kill_server' or 'gateway_reload_config'. No guidance is provided about prerequisites, dependencies, or exclusions for using this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_run_playbookRun PlaybookC

Execute a multi-step playbook (collapses multiple tool calls into one invocation)

ParametersJSON Schema
NameRequiredDescriptionDefault
argumentsNoPlaybook input arguments
nameYesPlaybook name to execute

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden but only states it executes and collapses multiple tool calls. It lacks details on permissions needed, side effects (e.g., if it's destructive), error handling, or performance implications like rate limits, leaving significant behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly conveys the core functionality without any wasted words, making it easy to understand at a glance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of executing multi-step playbooks, no annotations, and no output schema, the description is insufficient. It doesn't explain what a playbook is, expected outcomes, error cases, or integration with other tools, leaving critical context missing for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents parameters adequately. The description adds no additional meaning beyond the schema, such as examples of playbook names or argument structures, but doesn't contradict it, meeting the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('execute') and resource ('multi-step playbook'), and distinguishes it from siblings by specifying it collapses multiple tool calls into one invocation. However, it doesn't explicitly differentiate from 'gateway_invoke' which might also execute something, leaving some ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'gateway_invoke' or other siblings. The description implies it's for multi-step operations but doesn't specify prerequisites, exclusions, or typical scenarios for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_search_toolsSearch ToolsA
Read-onlyIdempotent

Search 0 tools across 0 servers by keyword. Returns ranked matches with full schemas, saving ~95% context tokens vs loading all tool definitions. Supports multi-word queries and synonym expansion.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum results (default 10)
queryYesSearch keyword

Output Schema

ParametersJSON Schema
NameRequiredDescription
matchesYesRanked list of matching tools

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable context beyond annotations: it specifies that results are ranked, include full schemas, save ~95% context tokens, and support multi-word queries and synonym expansion. Annotations cover read-only, non-destructive, and idempotent traits, but the description enriches this with performance and functionality details without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and key benefits in two concise sentences. Every sentence earns its place by adding specific value: the first states the action and efficiency gain, the second details query support. No wasted words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (search functionality with ranking and schema retrieval), rich annotations (read-only, idempotent, etc.), and the presence of an output schema, the description is complete enough. It covers purpose, usage, behavioral traits, and efficiency benefits, leaving output details to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents the 'limit' and 'query' parameters. The description adds no additional parameter semantics beyond what the schema provides, such as details on query syntax or result ranking, but it does imply the 'query' parameter supports multi-word and synonyms, which slightly enhances understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific verb ('Search') and resource ('tools'), and distinguishes from siblings like 'gateway_list_tools' by emphasizing keyword-based search with ranking and schema retrieval. It explicitly mentions the efficiency benefit of saving context tokens versus loading all definitions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool: for searching tools by keyword with ranked results and full schemas, and when not to use it (implied by contrasting with 'gateway_list_tools' for listing all tools without search). It also mentions the benefit of saving context tokens, guiding usage based on efficiency needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_set_profileSet Routing ProfileA

Switch the active routing profile for this session. A routing profile restricts which tools and backends are available.

ParametersJSON Schema
NameRequiredDescriptionDefault
profileYesName of the routing profile to activate (e.g. "research", "coding")

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It mentions that routing profiles restrict tool/backend availability, which is helpful, but lacks details on permissions needed, whether changes are session-specific or persistent, error conditions, or side effects. For a mutation tool with zero annotation coverage, this is insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with zero waste: the first states the action and resource, and the second explains the purpose of routing profiles. It is front-loaded and efficiently structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (mutates session state), lack of annotations, and no output schema, the description is incomplete. It covers the basic purpose but misses behavioral details like effects, permissions, or response format. However, it does provide enough to understand the core function.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the 'profile' parameter with examples. The description does not add any parameter-specific details beyond what the schema provides, such as valid profile names or constraints, meeting the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Switch') and resource ('active routing profile for this session'), and distinguishes from siblings by focusing on profile activation rather than listing, getting, or other operations. It explains what a routing profile does, adding useful context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing to change tool/backend availability, but does not explicitly state when to use this vs. alternatives like 'gateway_get_profile' or 'gateway_list_profiles'. No exclusions or prerequisites are mentioned, leaving some ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gateway_webhook_statusWebhook StatusA

List registered webhook endpoints and their delivery statistics (received, delivered, failures, last event)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It implies a read-only operation by using 'List', but lacks details on permissions, rate limits, pagination, or response format, leaving significant gaps for a tool that likely returns structured data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the purpose ('List registered webhook endpoints') and adds necessary detail ('delivery statistics') without any wasted words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (a read operation with no parameters) and lack of annotations or output schema, the description is minimally adequate. It states what the tool does but omits behavioral details like response structure or constraints, making it incomplete for full agent understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters with 100% schema description coverage, so the schema fully documents the absence of inputs. The description adds no parameter information, which is acceptable here, but a baseline of 4 is appropriate as it doesn't need to compensate for any gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('List registered webhook endpoints') and the resources involved ('delivery statistics'), distinguishing it from siblings like gateway_get_stats or gateway_list_servers by focusing on webhook-specific data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like gateway_get_stats or gateway_list_servers, nor does it mention prerequisites or context for retrieving webhook status versus other gateway information.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 15 tool updatesv0.1.0
    • First observedgateway_cost_report
    • First observedgateway_get_profile
    • First observedgateway_get_stats
    • First observedgateway_invoke
    • First observedgateway_kill_server
    • First observedgateway_list_disabled_capabilities
    • First observedgateway_list_profiles
    • First observedgateway_list_servers
    • First observedgateway_list_tools
    • First observedgateway_reload_config
    • First observedgateway_revive_server
    • First observedgateway_run_playbook
    • First observedgateway_search_tools
    • First observedgateway_set_profile
    • First observedgateway_webhook_status

TDQS

A4/5.0

Scored across 15 tools

Disambiguation5/5

Each tool has a clearly distinct purpose with no ambiguity. For example, gateway_list_tools lists tools, gateway_search_tools searches them, gateway_invoke invokes them, and gateway_get_stats provides usage statistics. Tools like gateway_kill_server and gateway_revive_server are complementary but distinct in their actions (disable vs. re-enable).

Naming Consistency5/5

All tools follow a consistent 'gateway_verb_noun' pattern, such as gateway_list_servers, gateway_set_profile, and gateway_reload_config. This uniformity makes the tool set predictable and easy to navigate, with no deviations in naming conventions.

Tool Count5/5

With 15 tools, the count is well-scoped for a gateway server that manages backend servers, routing, and monitoring. Each tool serves a specific function in this domain, such as listing, searching, invoking, and controlling servers, without being excessive or insufficient.

Completeness5/5

The tool set provides complete coverage for gateway operations, including server management (list, kill, revive), tool discovery (list, search), invocation, routing control (profiles), monitoring (stats, cost reports), and configuration (reload). There are no obvious gaps, enabling agents to handle all typical gateway workflows.

Maintenance

ActivityActive
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    A meta-server that aggregates multiple MCP servers into a single interface, reducing token usage by 98%+ through progressive tool discovery and direct code execution that processes data between tools without consuming context window space.
    16 npm
    10
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    A universal gateway that aggregates multiple MCP servers into a single interface while providing advanced token optimization, result filtering, and automated summarization. It enables efficient management of large tool catalogs and reduces context usage by up to 95% for major AI clients.
    13 npm
    15
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    A unified gateway and web dashboard that aggregates multiple MCP servers into a single Streamable HTTP endpoint. It supports stdio, SSE, and HTTP protocols, featuring optimized tool exposure modes to reduce token consumption for AI clients.
    5
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    A single MCP server gateway that reduces context bloat by providing progressive tool discovery and invocation, dynamically provisioning downstream servers on demand.
    26
    20
    MIT