fold

fold is the one. fold.run is the execution.

The high-performance enterprise MCP gateway: one governed endpoint between every MCP client and every MCP server. fold sits in front of any number of upstream MCP servers — in any language, on any SDK, from any team or vendor — providing federation, enterprise auth, policy, caching, rate limiting, and audit, while staying automatically aligned with the MCP specification, SEPs, and official SDK releases.

Use cases

• Unify a federation. Acquisitions, child orgs, and teams each ship their own MCP servers; fold presents them as one virtual server with namespaced tools — no team rewrites anything.

• Draw the security boundary. One choke point for authentication, deny-by-default tool allowlists, per-principal visibility, and an audit event for every request including denials.

• Insulate protocol eras. fold speaks 2026-07-28 natively and translates in both directions — teams migrate off legacy SDKs on their own schedule while clients never notice.

• Broker credentials. Clients hold one token with fold as audience; fold exchanges it per upstream (RFC 8693) or injects service credentials — API keys never reach agents.

• Protect fragile services. SEP-2549 caching, global and per-upstream rate limits, and circuit breakers stand between agent traffic storms and your internal systems.

• Govern vendor MCP servers. Put third-party/SaaS MCP endpoints behind your own auth, policy, and audit instead of scattering per-user API keys.

• Expose tools outward, carefully. Offer partners or customers a curated, policy-scoped subset of internal tools on one hardened endpoint — self-hosted or at the edge on Cloudflare Workers.

Related MCP server: Master MCP Server

Highlights

• Native 2026-07-28 stateless core. Routes on the Mcp-Method/Mcp-Name headers (SEP-2243) without parsing request bodies; responses stream through untouched.

• Legacy compatible. Stateful 2025-era clients and upstream servers work through the gateway during the deprecation window.

• Portable. One TypeScript core built on web-standard APIs, deployable on Node.js (Docker/k8s) and Cloudflare Workers.

• Conformant, provably. The official @modelcontextprotocol/conformance suite runs against fold fronting a reference server on every merge — 40/40 scenarios on Node.js AND on Cloudflare Workers (workerd). Receipt: latest CI run (conformance job), or any run in Actions.

• Fast, measurably. < 2 ms p50 added latency on the passthrough path (CI-gated on every merge), ~7,500 req/s sustained per instance with p99 ≤ 16 ms. Methodology, full tables, and reproduce-it-yourself commands: docs/benchmarks.md.

• Enterprise-governed. OAuth 2.0 resource server (RFC 9207/8707/9728), Enterprise-Managed Authorization (ID-JAG exchange), per-upstream token exchange (RFC 8693), deny-by-default tool allowlists with per-principal list filtering, and an audit event for every request including denials.

Try it now

A live demo gateway runs at https://demo.fold.run/mcp — Cloudflare's modern 2026-07-28 docs server, GitMCP (a stateful 2025-era server), and a task-minting demo server, unified behind one endpoint. Point any MCP client at it:

https://demo.fold.run/mcp

You'll see cfdocs__*, git__*, and jobs__* tools side by side; the legacy upstream is translated live through a held session in a Durable Object. Call jobs__start_job, poll it with tasks/get, or watch subscriptions/listen — long-running work flows across the federation with fold routing every poll to the owning server. Rate-limited, unauthenticated, no warranty.

Quick start

cat > fold.config.json <<'EOF'
{
  "upstreams": [
    { "id": "github", "url": "https://mcp.example.com/mcp", "namespace": "github" }
  ]
}
EOF

npx @fold-run/gateway --config fold.config.json --port 8080
# MCP endpoint: http://localhost:8080/mcp

Embedding in your own Node service is one call: createFoldGateway(config) from the same package.

Edge deployment (same core, Durable Object-backed sessions and rate limits):

cd apps/gateway-workers
# set FOLD_CONFIG in wrangler.jsonc vars (or a secret), then:
npx wrangler deploy

A single upstream without a namespace runs in zero-copy passthrough mode. Multiple upstreams require namespaces; tools are exposed as {namespace}__{name}.

A federated multi-org config — each upstream owned by a different team, in any language:

{
  "upstreams": [
    {
      "id": "github-tools",
      "url": "https://mcp.platform.acme.com/mcp",
      "namespace": "gh",
      "owner": { "org": "acme-platform", "team": "devex" }
    },
    {
      "id": "ml-search",
      "url": "https://mcp.ml.acquired-co.com/mcp",
      "namespace": "search",
      "owner": { "org": "acquired-co", "team": "ml" },
      "rateLimit": { "requestsPerMinute": 600 },
      "circuitBreaker": { "failureThreshold": 5, "halfOpenAfterMs": 30000 }
    }
  ],
  "server": { "rateLimit": { "requestsPerMinute": 6000 } }
}

fold fans list requests out across all upstreams, merges and namespaces the results (honoring SEP-2549 ttlMs/cacheScope caching), synthesizes server/discover for the virtual server, degrades gracefully when an upstream is down (_meta["run.fold/partialFailure"]), and short-circuits unhealthy upstreams with a per-upstream circuit breaker. Set REDIS_URL to share cache, rate-limit, and breaker state across instances.

Repository layout

Portable packages may only use web-standard APIs (enforced by pnpm lint). Only runtime-* packages touch node:* / cloudflare:*.

Development

pnpm check          # boundaries + typecheck + tests
pnpm test           # unit + integration (real SDK client/server fixtures)

Conformance gate (requires the conformance repo's everything-server as upstream):

npx @modelcontextprotocol/conformance server --url http://localhost:8080/mcp

Documentation

Live docs: docs.fold.run — searchable, with /llms.txt for AI agents. Source lives in apps/docs; in-repo copies below.

• Configuration reference — upstreams, auth, policy, audit, server

• Deployment — Node/Docker, Cloudflare Workers, observability, production checklist

• Architecture — pipeline, era translation, package boundaries, spec alignment

• Benchmarks — latency gate + throughput sweep: methodology, numbers, how to reproduce

• SPEC_ALIGNMENT.md — generated per-SEP coverage

License

Apache-2.0 © fold.run

Status

All planned milestones are shipped: federation + caching/rate limiting, enterprise auth (EMA, token exchange, policy) with audit and OpenTelemetry, bidirectional legacy↔stateless translation (including the durable MRTR parking bridge), federated tasks with the subscriptions/listen fan-in, the Cloudflare Workers runtime, and the automated spec/SEP/SDK alignment pipeline. Per-SEP coverage lives in spec-alignment.json / SPEC_ALIGNMENT.md — every row is implemented or not-applicable.