gatehouse-mcp

The Gatehouse registry, as an MCP server. Ask an agent, at the moment it's deciding what to install, "is this tool safe? what's out there? give me the audit" and get Gatehouse's hands-on verdict, live.

Gatehouse is a vetted, living registry of agent tooling (MCP servers, Claude Code skills, plugins, subagents, agent frameworks). Every listing is proven alive by a nightly liveness check, and vetted listings carry a first-hand audit of what the tool actually injects. This server puts that in an agent's tool list so it never has to guess.

Tools

tool accepts a slug (postgres-mcp) or a name (Playwright MCP).

Related MCP server: airlock

Install

Claude Code:

claude mcp add gatehouse -- npx -y gatehouse-mcp

Any MCP client (.mcp.json / claude_desktop_config.json):

{
  "mcpServers": {
    "gatehouse": {
      "command": "npx",
      "args": ["-y", "gatehouse-mcp"]
    }
  }
}

How it gets its data

On demand, it fetches https://agentgatehouse.com/registry.json (cached in-process for an hour), so verdicts and liveness are always current, and the nightly liveness cron flows through automatically, with no package update. If the network is unreachable it falls back to a snapshot bundled in the package and says so in its answer. Point GATEHOUSE_REGISTRY_URL at a different endpoint to override the source.

It passes its own gate

Gatehouse flags other tools for telemetry, broad scopes, and heavy context cost, so this server holds itself to the same bar:

• Read-only. No tool writes, deletes, or mutates anything.

• No telemetry. The only network request is the one disclosed fetch to agentgatehouse.com for the registry itself. Nothing is sent about you, your agent, or your queries.

• Minimal surface. Three tools, all read-only, about 525 always-on tokens per turn (measured with Gatehouse's own audit script): the entire tool-definition footprint an agent carries, versus roughly 16k for a 44-tool server. One runtime dependency (@modelcontextprotocol/sdk, plus zod for schema validation).

• No metered anything. Free to run; the registry endpoint is a static file.

One open advisory, disclosed

npm audit reports 2 moderate advisories here, so here is the honest read rather than a silent audit fix. Both trace to one transitive package: @hono/node-server below 2.0.5, pulled in by @modelcontextprotocol/sdk, with a Windows-only path-traversal issue in its serve-static helper (GHSA-frvp-7c67-39w9).

It is not reachable from this server. serve-static belongs to the SDK's HTTP and SSE transports. gatehouse-mcp is stdio only (StdioServerTransport, one call site), never starts an HTTP listener, and never serves a file. The package sits in the dependency tree without its vulnerable path being callable.

It is also not currently fixable upward: @modelcontextprotocol/sdk@1.29.0 is the latest release, and npm's suggested remediation is a downgrade to 1.24.3, which is both a breaking change and older code. Declining that is the safer call. This note goes away when the SDK bumps its own dependency.

If you would rather verify than take our word for it, that is the entire point: npm ls @hono/node-server --all shows the path, and grep -rn "hono\|serveStatic" src/ returns nothing.

License

MIT © Dave Maynard