Enables n8n workflows to trigger MCP tools through the gateway, providing access to enterprise databases with security and audit logging.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MCP Enterprise Gateway Show me the latest 10 users from the enterprise DB, redacting sensitive columns."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A production-grade MCP (Model Context Protocol) proxy server with enterprise security features including JWT authentication, SQL AST guardrails, Kafka audit logging, and rate limiting.
┌─────────────────┐ ┌──────────────────────────────────────────────────────┐
│ Cursor IDE / │────▶│ MCP Enterprise Gateway │
│ Claude Desktop │ │ ┌─────────────┐ ┌─────────────┐ ┌──────────┐ │
│ n8n Workflow │ │ │ JWT Auth │ │ Rate Limit │ │ SQL AST │ │
└─────────────────┘ │ │ Middleware │─▶│ (Redis) │─▶│ Guardrails│ │
│ └─────────────┘ └─────────────┘ └──────────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌─────────────┐ ┌──────────┐ │
│ │ PostgreSQL │◀────────────────────│ Kafka │ │
│ │ (Telemetry) │ │ (Audit) │ │
│ └─────────────┘ └──────────┘ │
└──────────────────────────────────────────────────────┘Related MCP server: mcp-guardian
JWT Verification - All requests require valid Bearer token
Role-Based Access Control - 5 roles: admin, senior_analyst, junior_analyst, hr_admin, readonly
Redis Rate Limiting - Sliding window rate limits (100 req/min per user)
Blocks destructive operations: DROP, DELETE, TRUNCATE, ALTER
Enforces table-level access policies
Column-level PII redaction
Automatic LIMIT injection for SELECT queries
/healthz - Basic liveness check
/readyz - Full dependency check (PostgreSQL + Kafka)
Kafka audit events for all query attempts
# Start all services
docker-compose up --build -d
# Verify health
curl http://localhost:3000/healthz
curl http://localhost:3000/readyz
# Get SSE connection (requires JWT)
curl -N http://localhost:3000/sse \
-H "Authorization: Bearer <YOUR_JWT_TOKEN>"
# Send tool call
curl -X POST "http://localhost:3000/message?sessionId=<SESSION_ID>" \
-H "Authorization: Bearer <YOUR_JWT_TOKEN>" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "query_enterprise_db",
"arguments": {
"sql": "SELECT * FROM users LIMIT 10;",
"userRole": "admin"
}
}
}'Variable | Default | Description |
|
| HTTP server port |
|
| PostgreSQL connection string |
|
| Kafka broker address |
| (required) | JWT signing secret |
|
| Redis for rate limiting |
Table | Allowed Roles | Blocked Columns |
| admin, hr_admin | ssn, credit_card_no, bank_account_no |
| admin | password_hash, salt |
| admin, hr_admin | credit_card_no, tax_id, passport_no |
| all | - |
| all | password |
# Copy config
cp integrations/.cursor/mcp.json ~/.cursor/mcp.jsonEdit ~/.claude_desktop_config.json:
{
"mcpServers": {
"enterprise-gateway": {
"transport": "sse",
"url": "http://localhost:3000/sse"
}
}
}Import integrations/n8n/mcp-trigger.json and set MCP_GATEWAY_TOKEN environment variable.
const jwt = require('jsonwebtoken');
const token = jwt.sign(
{ sub: 'user_123', role: 'admin', email: 'admin@corp.com' },
'super_secret_enterprise_key_2026',
{ expiresIn: '24h' }
);
console.log(token);# Local development
npm install
npm run dev
# Run tests
npm test
# Type check
npx tsc --noEmitThis server cannot be deployed
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
