Server data from the Official MCP Registry
Discover, judge and safely run any MCP server: 57k+ scored servers, sandboxed.
About
Discover, judge and safely run any MCP server: 57k+ scored servers, sandboxed.
Security Report
The MCP Gateway is a sophisticated meta-proxy server with reasonable architecture and intentional security controls (trust tiers, sandbox isolation, permission managers, audit logging). However, several medium-severity security concerns exist: unsafe string matching in host validation (timing-attack resistant compare only used for tokens, not hosts), unchecked deserialization of downstream responses via passthrough Zod schemas, missing validation on critical user-supplied parameters (slug, profile data), and potential DNS rebinding vulnerabilities in multi-tenant scenarios. Permissions are appropriate for a gateway (process spawning, network I/O, env vars), but the lack of input validation on connection parameters and downstream tool/resource deserialization creates exploitable attack surfaces. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.
4 files analyzed · 12 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-mcprating-gateway": {
"args": [
"-y",
"@mcp-rating/gateway"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
@mcp-rating/gateway
MCP Gateway is a meta-MCP server that auto-discovers, connects, and proxies other MCP servers. Add one line to your AI desktop client config and get dynamic access to the entire MCP ecosystem.
How It Works
┌────────────────────┐ ┌──────────────┐ ┌──────────────────┐
│ Claude Desktop / │ stdio │ │ stdio │ MCP Server A │
│ Cursor / Windsurf │◄─────►│ MCP Gateway │◄──────►│ (e.g. filesystem)│
│ (host client) │ │ │◄──┐ └──────────────────┘
└────────────────────┘ └──────────────┘ │ ┌──────────────────┐
│ └───►│ MCP Server B │
▼ │ (e.g. github) │
┌──────────────┐ └──────────────────┘
│ MCP-Rating │
│ Registry API │
└──────────────┘
Instead of manually configuring each MCP server in your client, the Gateway:
- Discovers servers via the MCP-Rating registry
- Connects to them on-demand (spawns as child processes)
- Proxies their tools through namespaced names (
servername__toolname) - Notifies your client when tools are added/removed
Quick Start
With Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"gateway": {
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"]
}
}
}
Then ask Claude:
- "Search for MCP servers that work with databases" (uses
mcp_discover) - "Connect to the sqlite server" (uses
mcp_connect) - "Query my database" (calls the proxied tool directly)
With Any MCP Client
{
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"]
}
Meta-Tools
The gateway exposes 5 built-in tools:
| Tool | Description |
|---|---|
mcp_discover | Search the MCP-Rating registry for servers |
mcp_connect | Connect to a server (by slug or explicit command) |
mcp_disconnect | Disconnect a server and remove its tools |
mcp_list_active | List all connected servers |
mcp_server_info | Get detailed info about a server |
Trust Tiers
Every connected server is labeled with a trust tier based on its MCP-Rating quality score:
- [Verified] — High quality + officially verified
- [Trusted] — Good quality with repository and install command
- [Community] — Listed in registry with basic quality
- [Unverified] — Unknown origin (manually connected)
Configuration
The gateway reads config from ~/.mcp-gateway/config.json:
{
"registryApiUrl": "https://mcp-rating.example.com/api/v1",
"proxyTimeoutMs": 30000,
"maxConnections": 10,
"logLevel": "info"
}
Environment Variables
| Variable | Description | Default |
|---|---|---|
MCP_GATEWAY_REGISTRY_URL | MCP-Rating API base URL | https://mcprating.io/api/v1 |
MCP_GATEWAY_TIMEOUT | Proxy timeout (ms) | 30000 |
MCP_GATEWAY_MAX_CONNECTIONS | Max simultaneous connections | 10 |
MCP_GATEWAY_LOG_LEVEL | Log level (debug/info/warn/error) | info |
Development
# Install dependencies
pnpm install
# Run in development mode
pnpm dev
# Type check
pnpm typecheck
# Build
pnpm build
Architecture
The gateway is built on the MCP SDK and uses:
- StdioServerTransport — communicates with the host client
- StdioClientTransport — spawns and communicates with downstream servers
- Dynamic tool registration —
McpServer.registerTool()+sendToolListChanged() - Tool namespacing —
slug__toolnamepattern prevents collisions - Passthrough Zod schemas — preserves parameter names for host client UI while letting downstream servers validate
License
ISC
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
