Enterprise MCP Gateway
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Logging level | INFO |
| DOCDB_HOST | No | MongoDB/DocumentDB host | localhost |
| JWT_ISSUER | Yes | Expected issuer; always required, see the fail-closed note below | |
| JWT_SECRET | Yes | Shared secret for JWT signing/validation | |
| KMS_KEY_ID | No | AWS KMS CMK ARN or alias | alias/enterprise-mcp-gateway-tokens |
| JIRA_BACKEND | No | Backend mode: `pat`, `basic`, or `llm-orchestrator` | pat |
| JWT_AUDIENCE | No | Expected audience; required when `JWT_VERIFY_AUD=true` | |
| JIRA_BASE_URL | No | Jira REST API base URL | https://jira.example.com |
| NEO4J_ENABLED | No | Enable Neo4j backend | true |
| DOCDB_DATABASE | No | Database name | ENTERPRISE_MCP_GATEWAY |
| JWT_ALGORITHMS | No | Accepted JWT signing algorithms. Must stay within one key family (HMAC, RSA or EC); a mixed list is refused | HS512 |
| JWT_VERIFY_AUD | No | Verify the `aud` claim. Requires `JWT_AUDIENCE` to be set | true |
| MCP_SERVER_PORT | No | Gateway HTTP port | 8100 |
| RATE_LIMIT_JIRA | No | Global Jira calls per window | 30 |
| JWT_AUTH_ENABLED | No | Enable JWT bearer token validation | false |
| JWT_CLAIM_GROUPS | No | Candidate claim keys for group membership | groups,roles |
| TERADATA_MCP_URL | No | Teradata sidecar URL | http://localhost:8001/mcp |
| WRITE_RATE_LIMIT | No | Max writes per consumer per write window | 5 |
| DOCDB_TLS_ENABLED | No | Connect with TLS and full certificate validation. The DocumentDB/RDS CA bundle must be in the host trust store | true |
| JWT_CLAIM_USER_ID | No | Comma-separated candidate claim keys for user ID | sAMAccountName,sub |
| KIRO_RBAC_ENABLED | No | Require a gateway-signed token for IDE consumers | true |
| ENCRYPTION_ENABLED | No | Enable KMS envelope encryption | false |
| RATE_LIMIT_DEFAULT | No | Default group limit, enforced per pod (not a global cap) | 59 |
| KIRO_TOKEN_TTL_HOURS | No | Kiro token expiry in hours | 24 |
| TERADATA_MCP_ENABLED | No | Enable Teradata sidecar | true |
| GATEWAY_STDIO_TRUST_LOCAL | No | Grant a local stdio caller (no AuthMiddleware, therefore no identity) unrestricted tool and project scope. Keep false for any HTTP deployment | false |
| RATE_LIMIT_WINDOW_SECONDS | No | Sliding window duration | 60 |
| GATEWAY_ALLOW_INSECURE_LOCAL | No | Opt-in escape hatch for the legacy auto-whitelist. Also requires `KIRO_RBAC_ENABLED=false` and a loopback client | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues