# gatehouse-mcp

**The [Gatehouse](https://agentgatehouse.com) registry, as an MCP server.** Ask an agent, at
the moment it's deciding what to install, *"is this tool safe? what's out there? give me the
audit"* and get Gatehouse's hands-on verdict, live.

Gatehouse is a vetted, living registry of agent tooling (MCP servers, Claude Code skills,
plugins, subagents, agent frameworks). Every listing is proven alive by a nightly liveness
check, and vetted listings carry a first-hand audit of what the tool actually injects. This
server puts that in an agent's tool list so it never has to guess.

## Tools

| Tool | Use it to… |
| --- | --- |
| `check_tool({ tool })` | Get the quick trust verdict for one tool: vetted / flagged / unvetted, the one-paragraph take, liveness, install line. The "is X safe to install?" call. |
| `get_tool({ tool })` | Get the full record: metadata, compat matrix, health, and the complete first-hand audit write-up. |
| `search_tools({ query?, category?, kind?, status? })` | Find tools in the registry, ranked vetted-first. |

`tool` accepts a slug (`postgres-mcp`) or a name (`Playwright MCP`).

## Install

Claude Code:

```sh
claude mcp add gatehouse -- npx -y gatehouse-mcp
```

Any MCP client (`.mcp.json` / `claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "gatehouse": {
      "command": "npx",
      "args": ["-y", "gatehouse-mcp"]
    }
  }
}
```

## How it gets its data

On demand, it fetches `https://agentgatehouse.com/registry.json` (cached in-process for an hour),
so verdicts and liveness are always current, and the nightly liveness cron flows through
automatically, with no package update. If the network is unreachable it falls back to a snapshot
bundled in the package and says so in its answer. Point `GATEHOUSE_REGISTRY_URL` at a different
endpoint to override the source.

## It passes its own gate

Gatehouse flags other tools for telemetry, broad scopes, and heavy context cost, so this server
holds itself to the same bar:

- **Read-only.** No tool writes, deletes, or mutates anything.
- **No telemetry.** The *only* network request is the one disclosed fetch to `agentgatehouse.com`
  for the registry itself. Nothing is sent about you, your agent, or your queries.
- **Minimal surface.** Three tools, all read-only, about **525 always-on tokens** per turn
  (measured with Gatehouse's own audit script): the entire tool-definition footprint an agent
  carries, versus roughly 16k for a 44-tool server. One runtime dependency
  (`@modelcontextprotocol/sdk`, plus `zod` for schema validation).
- **No metered anything.** Free to run; the registry endpoint is a static file.

### One open advisory, disclosed

`npm audit` reports 2 moderate advisories here, so here is the honest read rather than a silent
`audit fix`. Both trace to one transitive package: `@hono/node-server` below 2.0.5, pulled in by
`@modelcontextprotocol/sdk`, with a Windows-only path-traversal issue in its `serve-static`
helper ([GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9)).

**It is not reachable from this server.** `serve-static` belongs to the SDK's HTTP and SSE
transports. gatehouse-mcp is stdio only (`StdioServerTransport`, one call site), never starts an
HTTP listener, and never serves a file. The package sits in the dependency tree without its
vulnerable path being callable.

It is also not currently fixable upward: `@modelcontextprotocol/sdk@1.29.0` is the latest
release, and npm's suggested remediation is a *downgrade* to 1.24.3, which is both a breaking
change and older code. Declining that is the safer call. This note goes away when the SDK bumps
its own dependency.

If you would rather verify than take our word for it, that is the entire point:
`npm ls @hono/node-server --all` shows the path, and `grep -rn "hono\|serveStatic" src/` returns
nothing.

## License

MIT © Dave Maynard