DOCSEARCHbyAlgolia
Submit Docs

MCP Gateway & Registry

repository·main·Indexed 21 days ago

https://github.com/agentic-community/mcp-gateway-registry

A unified, governed control plane for AI assets, including MCP servers, AI agents, and custom skills. It provides an authenticated entry point for discovery, access control, and auditing. The system includes a Registry Management API for managing users, groups, servers, and agents, and supports multiple authentication providers including Keycloak, Microsoft Entra ID, Okta, Auth0, and AWS Cognito.

Tokens
545.9K
Snippets
1.3K
Records
2.1K
Agent score
71%

What's inside mcp-gateway-registry

  1. Overview of MCP Gateway & Registry capabilities

    main

    The MCP Gateway & Registry provides a governed control plane for AI assets (MCP servers, agents, and skills).

    Core Components

    • Registry: A central inventory for humans, agents, and AI coding assistants to discover MCP servers, agents, and skills.
    • Gateway (Optional): An authenticated entry point that routes all traffic through a single point, enforcing access via your existing Identity Provider (IdP) before requests reach backends.

    Security and Governance Features

    • Identity: Supports six IdP providers: Keycloak, Amazon Cognito, Microsoft Entra ID, Okta, Auth0, and PingFederate.
    • Authorization: Uses Scopes to govern access to servers, tools, and agents. Skills include per-skill tool allowlists.
    • Audit Logging: A dedicated subsystem records access events with credential masking.
    • Security Scanning: Automatically scans registered assets; unsafe items are held for review.
    • Admission Control: An optional external registration gate can approve or deny assets. This gate fails closed (if the gate is unreachable, registration is blocked).
    • Agent Trust: Optional integration with ANS ID to verify agent identity metadata without managing certificates.

  2. Overview of MCP Gateway Registry Authentication

    main

    The MCP Gateway Registry uses an OAuth2-based authentication system designed for enterprise environments. It supports integration with Identity Providers (IdP) like Amazon Cognito or SAML and manages access through Role-Based Access Control (RBAC).

    Core Authentication Methods:

    • OAuth2 Integration: Connects to enterprise IdPs (e.g., Amazon Cognito, SAML).
    • Session Management: Uses secure, digitally signed HTTP cookies for session persistence.
    • Role-Based Access Control (RBAC): Provides dynamic permissions based on user groups.

    Key Features:

    • Fine-grained RBAC system.
    • Secure, encrypted, and signed session cookies.
    • Dynamic UI rendering based on user permissions.
    • Comprehensive audit logging for authentication events.

  3. Overview of the MCP Metrics Collection Service database schema

    main

    The MCP Metrics Collection Service uses SQLite as its primary data store. The schema is specifically engineered to handle high-volume metric ingestion and time-series data analysis.

    Key capabilities include:

    • High-volume writes: Optimized for rapid metric ingestion.
    • Time-series support: Efficient querying based on timestamps.
    • Aggregation support: Uses pre-computed summaries to improve query performance.
    • Data retention: Supports automatic cleanup of aging data.
    • Schema evolution: Managed via a version-controlled migration system.

  4. Overview of MCP Gateway Registry Telemetry

    main

    The MCP Gateway Registry collects anonymous usage telemetry to understand adoption patterns and improve the product. Telemetry is enabled by default and consists of two tiers of data collection: a Startup Ping sent once at startup and a Daily Heartbeat sent at a configurable interval (defaulting to every 24 hours).

    Privacy Commitments:

    • No Personally Identifiable Information (PII) is collected (no IP addresses, MAC addresses, hostnames, or user credentials).
    • No query content, agent card content, or skill code is collected.
    • Embeddings configuration (model names, API keys, dimensions, etc.) is never sent; only derived coarse categories are included.

  5. Overview of MCP Gateway Registry configuration files

    main

    The MCP Gateway Registry uses several configuration files to manage environment variables, authentication, and orchestration. Depending on your deployment needs (e.g., using OAuth or AgentCore), you will need to modify specific files.

    FilePurposeTypeLocationUser Modification
    .envMain project environment variablesEnvironmentProject rootYes - Required
    .env (OAuth)OAuth provider credentialsEnvironmentcredentials-provider/oauth/Yes - Required
    .env (AgentCore)AgentCore authentication configEnvironmentcredentials-provider/agentcore-auth/Optional (if using AgentCore)
    oauth2_providers.ymlOAuth2 provider definitionsYAMLauth_server/No (Pre-configured)
    oauth_providers.yamlProvider-specific OAuth configurationsYAMLcredentials-provider/oauth/No (Pre-configured)
    docker-compose.ymlContainer orchestrationYAMLProject rootRarely (Custom deployments only)

  6. Overview of Operations Runbooks

    main

    The MCP Gateway Registry provides a set of self-contained, step-by-step operational runbooks designed for incident response and system maintenance. Each runbook follows a standardized format: a procedure block, verification commands for every step, and direct links to the underlying code or configuration.

    Runbooks are categorized into available procedures (ready for use) and planned procedures (under development).

  7. Observability Architecture for MCP Gateway on AWS ECS

    main

    When deployed on AWS ECS via Terraform, the MCP Gateway Registry uses a centralized observability pipeline to aggregate metrics from various services (like registry and auth-server).

    Key Components:

    • metrics-service: Receives application metrics via HTTP POST. It includes an OpenTelemetry instrumentation layer that exposes a Prometheus endpoint on port 9465.
    • ADOT Collector (Sidecar): Runs alongside the metrics-service in the same ECS task. It scrapes the local Prometheus endpoint and uses SigV4 authentication to remote-write metrics to Amazon Managed Prometheus (AMP).
    • Amazon Managed Prometheus (AMP): Acts as the durable, long-term time-series store (150-day default retention).
    • Grafana OSS: Runs on ECS and provides visualization via pre-loaded dashboards (e.g., 'MCP Analytics') by querying AMP using SigV4 authentication via IAM task roles.

    Configuration Note: All observability resources are controlled by the Terraform variable var.enable_observability (defaults to true).

  8. Key Features of MCP Gateway

    main

    The platform provides features across four main categories:

    Architecture

    • Reverse Proxy: Centralized access point for all MCP servers.
    • Service Discovery: Automatic registration and health monitoring.
    • Load Balancing: Intelligent request distribution.
    • Multi-Instance Support: Redundancy through various deployment patterns.

    Security & Authentication

    • OAuth 2.0 Integration: Supports Amazon Cognito, Google, GitHub, and custom providers.
    • Fine-Grained Access Control: Role-based permissions with scope management.
    • JWT Token Vending: Secure token generation and validation.
    • Audit Logging: Comprehensive security event tracking.

    AI Agent Optimization

    • Dynamic Tool Discovery: Runtime enumeration of MCP servers and tools.
    • Intelligent Tool Finder: AI-powered tool recommendation.
    • Autonomous Access Control: Context-aware permission management.
    • Multi-Agent Coordination: Shared resource access with conflict resolution.

    Developer Experience

    • React Web Interface: Intuitive management and monitoring.
    • REST API: Programmatic registry management.
    • AI Coding Assistant Integration: Support for VS Code, Cursor, and Claude Code.
    • Real-Time Monitoring: Live health and performance metrics.

  9. Anthropic MCP Registry API v0.1 Overview

    main
    The Anthropic MCP Registry API provides a RESTful interface compatible with the Anthropic MCP Registry v0.1 specification. It enables server discovery for MCP ecosystem tools through three primary endpoints. The implementation features JWT Bearer token authentication via Keycloak, cursor-based pagination, and permission-based filtering using MCP scopes. Data is automatically transformed from internal formats to match the Anthropic schema using Pydantic models.

  10. Executive Overview of MCP Gateway & Registry

    main

    The MCP Gateway & Registry acts as a central hub connecting AI consumers (Human Users via Browser UI, AI Coding Assistants like VS Code/Cursor/Claude Code, and Autonomous Agents via the A2A protocol) to backend MCP services and data.

    It provides several core capabilities:

    • Gateway: Routes requests to the appropriate backend tools.
    • Registry: Maintains a catalog of all available tools and agents.
    • Security: Handles authentication, security scanning, and fine-grained access control.
    • Discovery: Enables semantic search (natural language queries) to find tools.
    • Federation: Allows connecting to other organizations' registries.
    • Monitoring: Provides health checks, logs, metrics, and an audit trail.

  11. Enterprise features provided by the Gateway

    main

    The Gateway provides several critical enterprise-grade capabilities:

    • Fine-Grained Access Control (FGAC): Authorization is decided per caller and per resource (server, agent, tool, or skill) based on identity and group membership from an IdP (e.g., Keycloak, Okta). Authorization fails closed if policy is missing.
    • Rate Limiting: Implemented in two layers:
      • Edge (per-IP) limiting: Handled at the nginx level to prevent volumetric floods.
      • Application-level limiting: Identity-aware limiting that caps requests based on a caller's rate-limit group membership or the capacity of a specific MCP server/A2A agent.
    • Dynamic Client Registration (DCR): Supports RFC 7591, allowing MCP clients to register themselves with the IdP and obtain a client_id via OAuth + PKCE without manual IT intervention.
    • Egress Authentication: Allows the Gateway to act as a credential vault. When a caller needs to reach a third-party service (e.g., GitHub, Slack) that requires authentication, the Gateway attaches the user's credentials from a secure store to the outbound request. This allows the agent to act 'as the user' without the client ever seeing the sensitive third-party tokens.

  12. Access the MCP Gateway Registry documentation

    main

    The MCP Gateway Registry documentation is available in two formats:

    1. GitHub Repository: Browse the raw Markdown files directly in the docs/ directory for the most up-to-date technical details.
    2. Published Landing Page: A single-page version of the documentation is hosted at agentic-community.github.io/mcp-gateway-registry.

    Use the repository-based Markdown files when you need to reference specific technical details or when contributing to the project.