# MCP Enterprise Gateway

A production-grade MCP (Model Context Protocol) proxy server with enterprise security features including JWT authentication, SQL AST guardrails, Kafka audit logging, and rate limiting.

## Architecture

```
┌─────────────────┐     ┌──────────────────────────────────────────────────────┐
│  Cursor IDE /   │────▶│              MCP Enterprise Gateway                 │
│  Claude Desktop │     │  ┌─────────────┐  ┌─────────────┐  ┌──────────┐  │
│  n8n Workflow   │     │  │ JWT Auth    │  │ Rate Limit   │  │ SQL AST   │  │
└─────────────────┘     │  │ Middleware  │─▶│ (Redis)      │─▶│ Guardrails│  │
                        │  └─────────────┘  └─────────────┘  └──────────┘  │
                        │         │                                   │       │
                        │         ▼                                   ▼       │
                        │  ┌─────────────┐                    ┌──────────┐  │
                        │  │ PostgreSQL  │◀────────────────────│ Kafka    │  │
                        │  │ (Telemetry) │                     │ (Audit)  │  │
                        │  └─────────────┘                    └──────────┘  │
                        └──────────────────────────────────────────────────────┘
```

## Features

### Phase 1: Security & Identity
- **JWT Verification** - All requests require valid Bearer token
- **Role-Based Access Control** - 5 roles: `admin`, `senior_analyst`, `junior_analyst`, `hr_admin`, `readonly`
- **Redis Rate Limiting** - Sliding window rate limits (100 req/min per user)

### Phase 2: SQL AST Guardrails
- Blocks destructive operations: `DROP`, `DELETE`, `TRUNCATE`, `ALTER`
- Enforces table-level access policies
- Column-level PII redaction
- Automatic `LIMIT` injection for SELECT queries

### Phase 3: Observability
- `/healthz` - Basic liveness check
- `/readyz` - Full dependency check (PostgreSQL + Kafka)
- Kafka audit events for all query attempts

## Quick Start

```bash
# Start all services
docker-compose up --build -d

# Verify health
curl http://localhost:3000/healthz
curl http://localhost:3000/readyz

# Get SSE connection (requires JWT)
curl -N http://localhost:3000/sse \
  -H "Authorization: Bearer <YOUR_JWT_TOKEN>"

# Send tool call
curl -X POST "http://localhost:3000/message?sessionId=<SESSION_ID>" \
  -H "Authorization: Bearer <YOUR_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "query_enterprise_db",
      "arguments": {
        "sql": "SELECT * FROM users LIMIT 10;",
        "userRole": "admin"
      }
    }
  }'
```

## Environment Variables

| Variable | Default | Description |
|----------|---------|-------------|
| `PORT` | `3000` | HTTP server port |
| `DATABASE_URL` | `postgres://...` | PostgreSQL connection string |
| `KAFKA_BROKER` | `kafka:29092` | Kafka broker address |
| `JWT_SECRET` | (required) | JWT signing secret |
| `REDIS_URL` | `redis://localhost:6379` | Redis for rate limiting |

## Table Access Policies

| Table | Allowed Roles | Blocked Columns |
|-------|--------------|-----------------|
| `salary_records` | admin, hr_admin | ssn, credit_card_no, bank_account_no |
| `user_passwords` | admin | password_hash, salt |
| `pii_data` | admin, hr_admin | credit_card_no, tax_id, passport_no |
| `audit_logs` | all | - |
| `users` | all | password |

## Client Integrations

### Cursor IDE
```bash
# Copy config
cp integrations/.cursor/mcp.json ~/.cursor/mcp.json
```

### Claude Desktop
Edit `~/.claude_desktop_config.json`:
```json
{
  "mcpServers": {
    "enterprise-gateway": {
      "transport": "sse",
      "url": "http://localhost:3000/sse"
    }
  }
}
```

### n8n Workflow
Import `integrations/n8n/mcp-trigger.json` and set `MCP_GATEWAY_TOKEN` environment variable.

## Generate JWT Token

```javascript
const jwt = require('jsonwebtoken');
const token = jwt.sign(
  { sub: 'user_123', role: 'admin', email: 'admin@corp.com' },
  'super_secret_enterprise_key_2026',
  { expiresIn: '24h' }
);
console.log(token);
```

## Development

```bash
# Local development
npm install
npm run dev

# Run tests
npm test

# Type check
npx tsc --noEmit
```