MCP Gateway
Front multiple MCP backends behind one OAuth-gated, audited gateway when you outgrow a single stdio server on a laptop.
Overview
MCP Gateway is a MCP server for the Operate phase that exposes tenant-scoped MCP over SSE with OAuth 2.1, Entra SSO, RBAC, and audit logging.
What is this MCP server?
- Multi-tenant MCP platform with org-scoped SSE remote URLs
- OAuth 2.1 plus Microsoft Entra SSO for workforce identity
- RBAC and audit logging for MCP tool access
- Self-hosted deployment on your-gateway.example.com pattern
- Manifest version 1.0.0 (schema 2025-12-11)
- Remote transport type: sse
- Stated controls: OAuth 2.1, Entra SSO, RBAC, audit logging
Community signal: 6 GitHub stars.
What problem does it solve?
Sharing raw MCP servers and API keys across teammates creates no SSO, no RBAC, and no audit trail when agents call production tools.
Who is it for?
Small teams or startups standardizing agent access to multiple MCP backends under Microsoft-centric identity and compliance needs.
Skip if: A solo hacker on one machine who only needs a single local stdio MCP and no tenant isolation.
What do I get? / Deliverables
Agents connect through a single governed SSE endpoint per org with authenticated, logged access to downstream MCP capabilities.
- Org-scoped SSE MCP endpoint for agent clients
- Authenticated, RBAC-filtered tool exposure
- Audit log trail for MCP invocations
Recommended MCP Servers
Journey fit
Operate/infra is where you govern how agents reach production-adjacent tools; a gateway is infrastructure policy, not a feature sprint task. Infra covers tenancy, identity, and secure exposure of MCP endpoints—exactly what this gateway advertises with OAuth 2.1, Entra SSO, and RBAC.
How it compares
Self-hosted MCP control plane and IdP gateway, not a curated skill marketplace or a single third-party SaaS connector.
Common Questions / FAQ
Who is MCP Gateway for?
Teams operating multiple MCP integrations who need OAuth 2.1, Entra SSO, RBAC, and audit logs instead of handing every developer separate API secrets.
When should I use MCP Gateway?
Use it when MCP moves from personal experiments to shared production agents and you must enforce who can invoke which tools and prove it in audit logs.
How do I add MCP Gateway to my agent?
Deploy MCP Gateway from the GitHub repo, configure OAuth/Entra and tenants, then point your MCP client at your SSE URL (e.g. https://your-gateway.example.com/t/your-org/mcp/sse) per your deployment docs.