AllMCP

One MCP endpoint, every business integration — multi-tenant, context-efficient, self-hostable.

AllMCP is an open-source MCP hub: point any MCP client at a single endpoint and your AI agents get native, typed tools for CRMs, spreadsheets, telephony, ads platforms, and more. You host it; your users self-service their own provider connections through one-click browser flows. AllMCP handles OAuth, token refresh, credential encryption, and every API call.

Claude / ChatGPT / any MCP client
        │
        ▼
   https://your-host/mcp/          ← one endpoint, one API key
        │
        ├─ bitrix24_list_contacts()
        ├─ google_sheets_values_get()
        ├─ amocrm_create_lead()
        └─ … 12 providers, hundreds of tools

Why AllMCP

• Native three-level multi-tenancy. Client → Organization → User is built into the connection layer (URL + headers), not bolted on with string tags. One deployment serves an entire AI platform's customer base; every end user connects their own accounts, and credentials are encrypted per user per provider.

• Context-efficient by design. Advertising hundreds of tools kills an agent's context window. AllMCP shows only system tools plus the connected providers' core tools; everything else stays hidden until the agent calls describe_category() — or is revealed automatically on dispatch. Agents keep their context; tools stay one call away.

• Native connectors, typed responses. Every tool is a hand-written connector returning typed, documented schemas — no proxying third-party MCP servers, no raw JSON dumps. Provider quirks (pagination, error shapes, rate limits) are absorbed inside the connector and documented in per-provider findings.md research notes.

• Per-category agent skills. Connectors ship with workflow guides that describe_category() serves to agents — the agent learns how to use a provider's tools, not just their signatures.

• MCP OAuth 2.1 authorization server. Header-less clients (Claude web/mobile/Desktop connectors, ChatGPT dev mode) connect with nothing but the URL — authorization-code + PKCE, dynamic client registration, rotating refresh tokens.

• Production-grade engineering. Real-database tests (PostgreSQL + DragonflyDB via containers), structured logging, Prometheus metrics, encrypted credential storage, strict pre-commit gauntlet (isort → black → ruff → mypy → bandit).

Providers

Adding a connector is deliberately cheap: one folder, a CONNECTOR_META, and tool modules that follow a documented pattern. See CONTRIBUTING.md.

Quickstart (self-host)

Requirements: Docker + Docker Compose, uv.

git clone https://github.com/Perception-Dynamics-Inc/allmcp.git
cd allmcp
cp .env.example .env          # dev defaults work out of the box
make dev                      # postgres + dragonfly + rabbitmq + app + celery
make migrate                  # apply schema

The MCP endpoint is now at http://localhost:8000/mcp/, the REST API at http://localhost:8000/api, interactive docs at http://localhost:8000/docs.

Register a client and connect an agent (set PUBLIC_API_REGISTRATION_ENABLED=true in .env first — self-registration is off by default):

curl -X POST http://localhost:8000/api/auth/register \
  -H 'Content-Type: application/json' \
  -d '{"name": "my-platform"}'
# → returns your API key (shown once): allmcp_...

{
  "mcpServers": {
    "allmcp": {
      "url": "http://localhost:8000/mcp/",
      "headers": { "X-API-Key": "allmcp_..." }
    }
  }
}

Multi-tenant mode: append ?org_id=<your-org-ref>&user_id=<your-user-ref> to the URL and AllMCP scopes every credential and tool call to that end user — no other changes required.

There is also a CLI: npx allmcp (npm, source in cli/).

Provider OAuth apps

For OAuth2 providers (Google, amoCRM, …) each deployment registers its own OAuth app with the provider, then stores the client credentials in the provider_oauth_apps table:

INSERT INTO provider_oauth_apps (_id, provider, client_id, client_secret_encrypted, ...)

Secrets are encrypted with your ENCRYPTION_KEY — see src/allmcp/services/oauth.py for the exact row shape. API-key providers (Bitrix24 webhooks, YouGile, …) need no setup: users paste their key into the hosted connect page.

Architecture

src/allmcp/
├── core/           # config, database, cache, logger, security, celery
├── models/         # SQLAlchemy ORM — UUID7 PKs, one file per table
├── schemas/        # Pydantic — typed request/response models
├── services/       # business logic — ServiceResult[T], no exceptions
├── mcp/            # FastMCP server, tenant middleware, system tools
│   ├── middleware.py   # per-call tenant resolution, rate limits, usage logs
│   └── tools/          # list_providers, connect_provider, describe_category, …
├── connectors/     # one folder per provider — the heart of the project
└── api/            # FastAPI REST — dashboard, OAuth callbacks, key entry

The agent loop every MCP client follows:

list_providers() → connect_provider("bitrix24", api_key=…) → bitrix24_list_deals()

For OAuth providers, connect_provider returns a browser URL; the end user clicks, consents, and the agent's next call just works.

Hosted version

Don't want to run infrastructure? The managed cloud version lives at allmcp.co — same core, plus a hosted dashboard, usage analytics, and zero-setup provider OAuth apps.

Contributing

New connectors, bug fixes, and docs are all welcome — see CONTRIBUTING.md for the connector-authoring guide and dev workflow. Security reports: see SECURITY.md.

License

Apache-2.0 © Perception Dynamics, Inc.