Back to Browse

Gateway MCP Server

Developer ToolsUse Caution4.7MCP RegistryLocal
Free

Server data from the Official MCP Registry

Discover, judge and safely run any MCP server: 57k+ scored servers, sandboxed.

About

Discover, judge and safely run any MCP server: 57k+ scored servers, sandboxed.

Security Report

4.7
Use Caution4.7High Risk

The MCP Gateway is a sophisticated meta-proxy server with reasonable architecture and intentional security controls (trust tiers, sandbox isolation, permission managers, audit logging). However, several medium-severity security concerns exist: unsafe string matching in host validation (timing-attack resistant compare only used for tokens, not hosts), unchecked deserialization of downstream responses via passthrough Zod schemas, missing validation on critical user-supplied parameters (slug, profile data), and potential DNS rebinding vulnerabilities in multi-tenant scenarios. Permissions are appropriate for a gateway (process spawning, network I/O, env vars), but the lack of input validation on connection parameters and downstream tool/resource deserialization creates exploitable attack surfaces. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

4 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

process_spawn

Check that this permission is expected for this type of plugin.

Shell Command Execution

Runs commands on your machine. Be cautious — only use if you trust this plugin.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

HTTP Network Access

Connects to external APIs or services over the internet.

network_websocket

Check that this permission is expected for this type of plugin.

network_sse

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-mcprating-gateway": {
      "args": [
        "-y",
        "@mcp-rating/gateway"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

@mcp-rating/gateway

MCP Gateway is a meta-MCP server that auto-discovers, connects, and proxies other MCP servers. Add one line to your AI desktop client config and get dynamic access to the entire MCP ecosystem.

How It Works

┌────────────────────┐       ┌──────────────┐       ┌──────────────────┐
│  Claude Desktop /  │ stdio │              │ stdio  │ MCP Server A     │
│  Cursor / Windsurf │◄─────►│  MCP Gateway │◄──────►│ (e.g. filesystem)│
│  (host client)     │       │              │◄──┐    └──────────────────┘
└────────────────────┘       └──────────────┘   │    ┌──────────────────┐
                                    │           └───►│ MCP Server B     │
                                    ▼                │ (e.g. github)    │
                             ┌──────────────┐        └──────────────────┘
                             │ MCP-Rating   │
                             │ Registry API │
                             └──────────────┘

Instead of manually configuring each MCP server in your client, the Gateway:

  1. Discovers servers via the MCP-Rating registry
  2. Connects to them on-demand (spawns as child processes)
  3. Proxies their tools through namespaced names (servername__toolname)
  4. Notifies your client when tools are added/removed

Quick Start

With Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"]
    }
  }
}

Then ask Claude:

  • "Search for MCP servers that work with databases" (uses mcp_discover)
  • "Connect to the sqlite server" (uses mcp_connect)
  • "Query my database" (calls the proxied tool directly)

With Any MCP Client

{
  "command": "npx",
  "args": ["-y", "@mcp-rating/gateway"]
}

Meta-Tools

The gateway exposes 5 built-in tools:

ToolDescription
mcp_discoverSearch the MCP-Rating registry for servers
mcp_connectConnect to a server (by slug or explicit command)
mcp_disconnectDisconnect a server and remove its tools
mcp_list_activeList all connected servers
mcp_server_infoGet detailed info about a server

Trust Tiers

Every connected server is labeled with a trust tier based on its MCP-Rating quality score:

  • [Verified] — High quality + officially verified
  • [Trusted] — Good quality with repository and install command
  • [Community] — Listed in registry with basic quality
  • [Unverified] — Unknown origin (manually connected)

Configuration

The gateway reads config from ~/.mcp-gateway/config.json:

{
  "registryApiUrl": "https://mcp-rating.example.com/api/v1",
  "proxyTimeoutMs": 30000,
  "maxConnections": 10,
  "logLevel": "info"
}

Environment Variables

VariableDescriptionDefault
MCP_GATEWAY_REGISTRY_URLMCP-Rating API base URLhttps://mcprating.io/api/v1
MCP_GATEWAY_TIMEOUTProxy timeout (ms)30000
MCP_GATEWAY_MAX_CONNECTIONSMax simultaneous connections10
MCP_GATEWAY_LOG_LEVELLog level (debug/info/warn/error)info

Development

# Install dependencies
pnpm install

# Run in development mode
pnpm dev

# Type check
pnpm typecheck

# Build
pnpm build

Architecture

The gateway is built on the MCP SDK and uses:

  • StdioServerTransport — communicates with the host client
  • StdioClientTransport — spawns and communicates with downstream servers
  • Dynamic tool registrationMcpServer.registerTool() + sendToolListChanged()
  • Tool namespacingslug__toolname pattern prevents collisions
  • Passthrough Zod schemas — preserves parameter names for host client UI while letting downstream servers validate

License

ISC

Reviews

No reviews yet

Be the first to review this server!