Lunar API Gateway and Management Platform

repository·main·Indexed 17 days ago

https://github.com/thelunarcompany/lunar

An open-source API gateway and management platform designed for the AI era, providing a mediation layer to govern, optimize, and observe third-party API consumption for applications and autonomous AI agents. Includes the Lunar Interceptor for Java, Node.js, and Python, as well as the mcpx-monorepo featuring identity-aware MCP servers and E2E testing harnesses.

Tokens
52.8K
Snippets
161
Records
221
Agent score
67%

What's inside Lunar

  1. Introduction to Lunar MCPX

    main

    Lunar MCPX is an MCP (Model Context Protocol) server that acts as an aggregator for other MCP servers. It is designed to simplify the integration and management of multiple MCP servers dynamically.

    Key features include:

    • Dynamic MCP server dispatch: Routes requests to the appropriate underlying servers.
    • Zero-code integration: Connect to MCP services using only JSON configuration.
    • Unified API interface: Provides a single interface to interact with multiple disparate MCP services.
    • Remote-first approach: Designed to be run in remote environments.
  2. Overview of Lunar.dev

    main

    Lunar.dev is an open-source platform designed for managing, governing, and optimizing third-party API consumption. It acts as a mediation layer and unified API Gateway for applications and AI agent workloads, providing visibility and control over outbound traffic.

    Key capabilities include:

    • Live API Traffic Visibility: Real-time metrics on latency, errors, cost, and token usage (including LLM and agent calls).
    • AI-Aware Policy Enforcement: Fine-grained rules to control tool access and throttle agent actions.
    • Advanced Traffic Shaping: Management of load via rate limits, retries, priority queues, and circuit breakers.
    • Cost & Performance Optimization: Identification of waste and reduction of costly API overuse.
    • Centralized MCP Aggregation: Consolidation of multiple MCP servers into a single gateway for improved security and observability.
  3. How identity-aware MCP servers work with MCPX

    main

    In an MCPX environment, MCPX acts as a gateway between AI agents and your MCP servers. When a user authenticates via an identity provider (Okta, Microsoft Entra, Google, etc.), MCPX issues a signed JWT containing identity claims.

    On every tool call, MCPX injects this JWT into the request's _meta.authorization field. Your server, running as a standard stdio MCP server, can read this field, verify the signature using provided environment variables, and use the claims to scope data, enforce permissions, or log actions.

    Identity Claims available in the JWT:

    • sub: Unique user ID (stable across sessions)
    • email: User's email
    • name: Display name
    • roles: User roles (e.g., Member, Admin, or Owner)
  4. Understand the EnvVar value schema

    main

    When working with the environment variable editor in the dashboard, the EnvValue union type defines how values are stored. A value can be one of four types:

    • Literal value: A standard string.
    • Intentionally empty: Represented as null.
    • Environment reference: An object { fromEnv: string } used to reference an existing environment variable.
    • Saved secret reference: An object { fromSecret: string } used to reference a saved secret.
  5. Understand the E2E test structure

    main

    The E2E testing suite is organized into the following directory structure:

    • e2e/pages/: Contains the page object models/tests.
    • e2e/helpers/: Contains test helpers and utilities.
    • e2e/mocks/: Contains mock data used for testing.
    • e2e/constants/: Contains test constants such as delays and timeouts.
  6. Choose between Lunar Proxy and Lunar MCPX

    main

    Lunar.dev offers two primary components depending on your integration needs:

    1. Lunar Proxy: The core API gateway and control layer used for managing and governing API traffic.
    2. Lunar MCPX: A zero-code aggregator designed to consolidate multiple MCP (Model Context Protocol) servers into a single gateway with unified API access.

    You can use either component individually or combine them for a full-stack solution.

  7. How Identity-Aware MCP Servers work

    main

    This server implements an identity-aware pattern where the MCP server knows who the user is by verifying the same identity token issued by the OIDC provider configured for mcpx login.

    The Authentication Flow:

    1. The client sends a JWT in the authorization header (mcpx allows this).
    2. The server extracts the Bearer token from the header on each tool call.
    3. The server verifies the JWT signature against the OIDC provider's JWKS endpoint.
    4. The server exposes verified claims (e.g., email, name, sub) through tools.
    5. The server rejects missing, expired, or fabricated tokens with an error.

    Note: This pattern is specifically for verifying the identity of the user logged into mcpx. It is not the pattern for implementing OAuth flows for third-party services like GitHub or Jira; those require independent OAuth implementations.

  8. Plugin Runner execution model

    main

    The Plugin Runner (spoa_python/plugin_runner/plugin_runner.py) executes plugins based on configured policies.

    Policy Matching

    Policies are mapped to specific HTTP methods and endpoints (e.g., GET on httpbin.org/json). When a request matches a method and endpoint defined in a policy, the runner executes the plugins associated with that policy in the order they are configured.

    Policy Configuration

    Each policy consists of:

    1. A Policy Type.
    2. A Configuration object.
    3. A list of Plugins to run.
  9. How to write a Lunar SPOA plugin

    main

    A plugin is a custom component used to intercept and manipulate network traffic. To create one, you must create a subclass of spoa_python.plugins.Plugin and implement two mandatory methods: on_request and on_response.

    Lifecycle and Arguments

    Both methods receive the following shared context:

    • id: A transaction ID (string) that remains identical for both the request and the corresponding response.
    • config: The PolicyConfig associated with the policy triggering the plugin.

    Implementation Details

    • on_request: Triggered when a request matches a configured policy. It receives additional arguments describing the request: method, path, query, headers, and body.
    • on_response: Triggered when a response is received. It receives additional arguments describing the response: status, headers, and body.

    Each method must return an Action to determine how the Plugin Runner should proceed.

    from spoa_python.plugins import Plugin
    
    class MyPlugin(Plugin):
        def on_request(self, id, config, method, path, query, headers, body):
            # Logic for intercepting requests
            return NoOpAction()
    
        def on_response(self, id, config, status, headers, body):
            # Logic for intercepting responses
            return NoOpAction()
  10. Automatically format long Go lines with golines

    main

    The lll linter reports lines longer than 80 characters. To automatically wrap these lines in VSCode, follow these steps:

    1. Install golines: go install github.com/segmentio/golines@latest.
    2. Ensure your PATH includes your GOPATH/bin (e.g., add export GOPATH="$HOME/go" and PATH="$GOPATH/bin:$PATH" to your .zshrc).
    3. Install the VSCode Run On Save extension by Emeraldwalk.
    4. Configure the extension in your VSCode settings.json to run golines on .go files with a 100-character limit.
    "emeraldwalk.runonsave": {
        "commands": [
          {
            "match": "\\.go$",
            "cmd": "golines ${file} -w -m 100"
          }
        ]
    }
  11. Run E2E tests for MCPX UI

    main

    MCPX UI uses Playwright for End-to-End (E2E) testing. These tests use mocked system state and do not require a live MCPX server; Playwright will automatically start the dev server if it is not running.

    Prerequisites:

    1. Install dependencies: npm install
    2. Install Playwright browsers: npx playwright install (specifically Chromium).
    npm install
    npx playwright install