Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-gateway Sanitize all tool responses for sensitive information."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A secure middle layer for the MCP ecosystem — building a protective barrier between LLMs and tool servers
When an LLM Agent calls external tools through the MCP protocol, there are three core risks:
Credential leakage — tool responses may contain sensitive information such as API Keys, Tokens, etc., exposed directly to the LLM context
Privacy data leakage — user personal information (names, ID card numbers, bank card numbers) may be passed along the tool call chain
Malicious tool injection — tool descriptions may hide prompt injection instructions that trick the Agent into performing dangerous operations
MCP Gateway acts as a proxy layer that intercepts all traffic and performs security filtering before requests/responses reach the Agent.
Related MCP server: arc-gate-mcp
┌─────────────┐ ┌──────────────────────────────────┐ ┌─────────────┐
│ │ │ MCP Gateway │ │ │
│ LLM Agent │ ───► │ ┌──────────┐ ┌──────────────┐ │ ───► │ MCP Server │
│ │ │ │ Sanitize │ │ Plugin │ │ │ (tools) │
│ │ ◄─── │ │ Request │ │ Pipeline │ │ ◄─── │ │
└─────────────┘ │ └──────────┘ └──────────────┘ │ └─────────────┘
│ ▲ │ │
│ │ ┌──────────▼──┐ │
│ │ │ Sanitize │ │
│ │ │ Response │ │
│ │ └─────────────┘ │
└──────────────────────────────────┘Core flow:
Request direction: Plugin Pipeline desensitizes parameters (e.g., removes PII, filters out injection instructions)
Response direction: applies Token masking and sensitive information filtering to tool return values
Startup phase: Security Scanner performs reputation assessment on all configured MCP Servers
git clone <your-repo-url>
cd mcp-gateway
pip install -e .Optional dependencies:
pip install -e .[presidio] # 启用 PII 检测（基于 Microsoft Presidio）Create mcp.json in the project root directory:
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "."]
}
}
}# 启用基础 Token 掩码
mcp-gateway -p basic
# 启用 Token 掩码 + PII 检测
mcp-gateway -p basic -p presidio
# 调试模式
LOGLEVEL=DEBUG mcp-gateway -p basic{
"mcpServers": {
"mcp-gateway": {
"command": "mcp-gateway",
"args": [
"--mcp-json-path", "~/.cursor/mcp.json",
"-p", "basic",
"-p", "xetrack"
],
"servers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "."]
}
}
}
}
}{
"mcpServers": {
"mcp-gateway": {
"command": "<python-path>",
"args": [
"-m", "mcp_gateway.server",
"--mcp-json-path", "<path-to-config>",
"-p", "basic"
],
"servers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "."]
}
}
}
}
}basic plugin)Automatically detects and replaces sensitive credentials in responses, supporting 12 major cloud platform and developer tool secret formats:
Type | Example format |
AWS Access Key |
|
GitHub Token |
|
JWT Token |
|
HuggingFace Token |
|
Microsoft Teams Webhook |
|
mcp-gateway -p basicpresidio plugin)Based on the Microsoft Presidio engine, it automatically identifies and anonymizes personally identifiable information in text:
Credit card numbers, IP addresses, email addresses
Phone numbers, SSNs (ID card numbers)
See Presidio documentation for more entity types
pip install -e .[presidio]
mcp-gateway -p presidio--scan)Before startup, it performs reputation assessment and tool description analysis on all MCP Servers:
mcp-gateway --scan -p basicScan dimensions:
Reputation assessment — calculates a comprehensive score based on GitHub data (stars, forks, issue activity) and NPM download counts
Tool description scanning — detects hidden prompt injection instructions, sensitive file path references, and dangerous operation instructions
Automatic blocking — servers with a reputation score below the threshold (default: 30 points) are marked as blocked and blocked from loading.
Scan results are written to the configuration file:
{
"servers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "."],
"blocked": "passed"
}
}
}Status values: "passed" (safe) | "blocked" (blocked) | "skipped" (manually skipped) | null (not scanned)
Records the full context of every tool invocation, supporting SQLite and DuckDB queries:
pip install xetrack
mcp-gateway -p xetrackEnvironment variable configuration:
XETRACK_DB_PATH — SQLite database path
XETRACK_LOGS_PATH — log file directory
{
"mcpServers": {
"mcp-gateway": {
"command": "mcp-gateway",
"args": ["--mcp-json-path", "~/.cursor/mcp.json", "-p", "xetrack"],
"env": {
"XETRACK_DB_PATH": "tracing.db",
"XETRACK_LOGS_PATH": "logs/"
}
}
}
}Query examples:
from xetrack import Reader
df = Reader("tracing.db").to_df()-- DuckDB
INSTALL sqlite; LOAD sqlite; ATTACH 'tracing.db' (TYPE sqlite);
SELECT server_name, capability_name, content_text FROM db.events LIMIT 10;The Gateway exposes two standardized tools to the LLM:
Tool | Description |
| Retrieves the capability list of all registered MCP Servers, helping the LLM choose the right tool |
| Executes any MCP tool invocation through the Gateway, automatically applying request/response security processing |
The plugin system is based on the ABC base class + decorator registration pattern:
from mcp_gateway.plugins.base import GuardrailPlugin
from mcp_gateway.plugins.manager import register_plugin
@register_plugin
class MyPlugin(GuardrailPlugin):
@property
def name(self) -> str:
return "my-plugin"
def process_request(self, context):
# 请求方向的处理逻辑
return context.arguments
def process_response(self, context, response):
# 响应方向的处理逻辑
return responsePlugins are automatically discovered and loaded via PluginManager, supporting bidirectional request/response interception.
mcp_gateway/
├── __init__.py # 包入口
├── server.py # MCP Server 生命周期管理
├── gateway.py # 动态工具注册、CLI 参数解析
├── config.py # 配置文件加载
├── sanitizers.py # 请求/响应安全分发
├── plugins/
│ ├── base.py # Plugin ABC 基类
│ ├── manager.py # 插件发现、注册、Pipeline
│ ├── guardrails/
│ │ ├── basic.py # Token 掩码插件
│ │ └── presidio.py # PII 检测插件
│ └── tracing/
│ └── xetrack.py # 调用追踪插件
├── security_scanner/
│ ├── scanner.py # 扫描器主入口
│ ├── github_collector.py # GitHub API 数据采集
│ ├── npm_collector.py # NPM Registry 数据采集
│ ├── smithery_collector.py# Smithery 市场数据采集
│ ├── project_analyzer.py # 综合信誉评分算法
│ └── tool_poisoning_analyzer.py # 工具描述安全分析
└── tests/
├── test_sanitizers.py
├── test_tool_poisoning_analyzer.py
├── test_plugin_pipeline.py
└── test_config.pyThis server cannot be installed
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
The WAF for agents. Pattern-based + heuristic firewall scans prompts, RAG documents, tool argume...
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/wxsh-hub/mcp-gateway'
If you have feedback or need assistance with the MCP directory API, please join our Discord server