How do I use MCP and A2A Enterprise Gateway?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MCP and A2A Enterprise Gateway list the pinned tools I'm authorized to call through the gateway" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

MCP and A2A Enterprise Gateway

by kogunlowo123

Overview Schema Source Related Servers Discussions Admin

Python

Remote

MCP and A2A Enterprise Gateway

A single, governed entry point for AI agents to reach enterprise tools (Model Context Protocol) and other agents (Agent2Agent protocol), including agents in partner trust domains. Every tool definition is reviewed and pinned by hash, every call is authorized by the agent identity fabric and the gateway's own policy, high-risk calls wait for a human, content crossing the boundary is inspected, and every decision lands in a signed audit chain.

Agent ─▶ Gateway ─▶ Authentication ─▶ Authorization ─▶ Federation
          │             │                  │                │
          │      fabric introspection  gateway policy   RFC 8693 delegated
          │      or federated JWKS     + fabric PDP     credential per hop
          ▼
   pinned tool catalog · approval gate · content inspection · signed audit

Capabilities

Capability	Implementation
MCP gateway	Official MCP SDK `MCPServer` (the successor of FastMCP in mcp 2.x) over stateless Streamable HTTP at `/mcp`; upstream servers reached with the SDK `Client`, protocol revisions 2025-11-25 and 2026-07-28
Tool registration and discovery	Upstream servers registered behind an egress allow list; `tools/list` discovery creates draft versions with a SHA-256 definition hash
Lifecycle	draft → approved → deprecated (with sunset) → revoked; approval by a reviewer who did not run discovery (separation of duties)
Rug-pull defense	Agents only ever see the pinned definition; a live definition that differs from its pin blocks calls until a reviewer approves the new version
Tool poisoning	Descriptions and schema text are scored for injection at discovery; flagged versions need a written override to approve
Per-tool allow lists	SPIFFE ID globs per tool version, plus credential scopes (`mcp:<server>:<tool>`)
Parameter validation	Arguments validated against the pinned JSON Schema (Draft 2020-12, formats checked) and size-capped
Response limits	Byte ceiling enforced on the wire before parsing, per tool or per server
Output inspection	agentic-core `ContentGuard`: prompt-injection indicators and credentials block the response; PII is redacted; structured output validated against the pinned output schema
Egress DLP	Credential material in tool arguments or A2A messages is blocked before it leaves
A2A gateway	Agent Card at `/.well-known/agent-card.json`, JSON-RPC `message/send`, `tasks/get`, `tasks/cancel`, authenticated extended card at `/a2a`
Agent card registry	Cards accepted only from configured trust domains and hosts, JWS-signed (RFC 8785 canonical form) by keys in the domain's JWKS, pinned by digest, same lifecycle as tools
Federation	Outbound: RFC 8693 token exchange at the identity fabric for every hop, delegation depth checked against the target domain. Inbound: partner tokens verified against the partner JWKS and confined to an inbound scope ceiling
Authorization	agentic-core `PolicyEngine` (`policies/gateway-authorization.yaml`) combined with the fabric's `/v1/authorize`; most restrictive wins
Human approval	`require_approval` decisions create an approval bound to caller, delegation chain, target and payload digest; single use; expires
Resilience	Per-agent token-bucket rate limits, per-upstream circuit breakers, timeouts everywhere, fail-closed on every dependency
Audit	agentic-core signed hash chain, one chain per replica stored in PostgreSQL, verifiable online (`/v1/audit/verify`) and exportable for WORM archival
Observability	Prometheus metrics, OpenTelemetry traces, JSON logs with correlation IDs, SLO and security alerts, Grafana dashboard

Related MCP server: production-mcp-server

Quick start (local)

Requires Docker. No API keys or cloud credentials are needed.

docker compose up --build
curl -s localhost:8090/.well-known/agent-card.json | jq .name
curl -s localhost:8090/.well-known/oauth-protected-resource | jq

The stack runs the gateway, the agent identity fabric, PostgreSQL for each, an OIDC provider standing in for the workload issuer and the enterprise IdP, and an OpenTelemetry collector. To use delegated upstream credentials locally, register the gateway as an agent in the fabric and set GATEWAY_GATEWAY_AGENT_ID and GATEWAY_WORKLOAD_TOKEN_FILE (configuration).

Development

uv sync
make check        # ruff, black, mypy --strict, bandit, contract drift, tests (coverage >= 90%)
make integration  # PostgreSQL tests (needs GATEWAY_TEST_DATABASE_URL)
make helm terraform

Test suites: tests/unit, tests/security (one test per threat T1-T18 in the threat model), tests/chaos (dependency failures), tests/performance (latency budgets; locustfile.py for load), tests/e2e (full HTTP lifecycle with the official MCP SDK client, both MCP protocol eras, A2A JSON-RPC, interoperability with the real identity fabric, and a property-based OpenAPI contract test), tests/integration (PostgreSQL). Upstream MCP servers in the tests are real SDK servers served in-process; no network is used.

API

Endpoint	Caller	Purpose
`POST /mcp`	Agents (fabric credential)	MCP Streamable HTTP: `tools/list`, `tools/call` over the pinned catalog
`POST /a2a`	Agents	A2A JSON-RPC: `message/send`, `tasks/get`, `tasks/cancel`, `agent/getAuthenticatedExtendedCard`
`GET /.well-known/agent-card.json`	Anyone	The gateway's A2A Agent Card
`GET /.well-known/oauth-protected-resource`	MCP clients	RFC 9728 metadata naming the identity fabric
`POST /v1/servers`, `/discover`, `/enable`, `/disable`	`gateway-admin`, `gateway-reviewer`	Upstream MCP servers and discovery
`GET /v1/tools`, `POST /v1/tools/{server}/{tool}/versions/{v}/approve\|deprecate\|revoke`	`gateway-reviewer`	Tool lifecycle
`POST /v1/agent-cards`, `/refresh`, `/versions/{v}/approve\|deprecate\|revoke`	`gateway-admin`, `gateway-reviewer`	Agent card registry
`GET /v1/approvals`, `POST /v1/approvals/{id}/approve\|deny`	`gateway-approver`	Human approval of high-risk calls
`GET /v1/audit/verify`	`gateway-auditor`	Verify this replica's signed audit chain

Full contract: docs/api/openapi.json; JSON Schemas in schemas/. Operator tools: python -m mcp_a2a_gateway.cardsign (sign your own agent cards), python -m mcp_a2a_gateway.audit_export (verified audit segments for WORM storage).

Deployment

Layer	Location
Container image	`Dockerfile` (non-root, read-only root filesystem compatible)
Helm chart	`deployments/helm/mcp-a2a-gateway` (Deployment, PDB, HPA, NetworkPolicy, ServiceMonitor, projected workload token)
Namespace and secret sync	`deployments/kubernetes` (restricted Pod Security, External Secrets)
Cloud infrastructure	`deployments/terraform/{aws,azure,gcp}`: managed PostgreSQL, KMS, secret store, WORM archive for audit segments, workload identity. AWS is the reference deployment

See the startup runbook.

Documentation

Shared controls (policy engine, audit chain, content guard, logging, telemetry) come from agentic-core.

License

Apache-2.0

This server cannot be deployed

Context Every Agent Can ShareAgents share what they learn, hand off work, and keep it when you switch models. Start with 5 GB free.fulcradynamics.comAd

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

AxioRank: Zero-Trust for AI Agents A
com.axiorank
Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
Security Observability
222
agentlock
io.github.Olum289
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Security Agent Orchestration
2
IMPOCOR-AI Nexus C
io.github.professoryilmaz1
Agent-native security, trust, reliability, data and procurement tools for AI workflows.
Security AI & Machine Learning Autonomous Agents
61
IdentArk Gateway
io.identark
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Security Agent Orchestration
29

Related MCP Servers

enterprise-agent-lab
Security Agent Orchestration
isaac-dev-ai
F
license
Not graded
quality
C
maintenance
Enables controlled AI-agent access to enterprise-shaped tools with a deny-by-default gated write path, human approval, dry-run execution, and append-only audit logging.
Updated a month ago (2026-09-05 13:15 UTC)
1
-
production-mcp-server
Security Agent Orchestration
TushGoel
A
license
Not graded
quality
B
maintenance
Enables AI agents to safely call enterprise tools through a governed MCP gateway with permission enforcement, blast-radius controls, input validation, and a full audit trail for every invocation.
Updated a month ago (2026-09-15 19:09 UTC)
MIT
MCP Toolshed
Security Agent Orchestration
derrickSh43
F
license
Not graded
quality
C
maintenance
Enables agents to securely discover and invoke a centrally governed catalog of tools from distributed internal and external providers, with policy enforcement, quotas, inspection, and audit controls.
Updated 2 months ago (2026-08-28 02:07 UTC)
-
agent-trust-firewall
Security Agent Orchestration
krishnashahane
A
license
Not graded
quality
B
maintenance
Enables AI agents to securely invoke tools by enforcing identity proof, capability verification, and risk scoring on every request, blocking unsafe calls before they execute.
Updated 6 days ago (2026-10-09 18:49 UTC)
MIT

MCP and A2A Enterprise Gateway

Capabilities

Quick start (local)

Development

API

Deployment

Documentation

License

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

enterprise-agent-lab

production-mcp-server

MCP Toolshed

agent-trust-firewall