Atlas / MCP servers / agentic-community / Gateway Registry

Gateway RegistryBLOCK

Name: Gateway Registry
Author: agentic-community

mcp/agentic-community/gateway-registry

MCP server by agentic-community · a2a · agentic ai · agents · Audited 2026-09-27

Enterprise-ready MCP Gateway & Registry that centralizes AI development tools with secure OAuth authentication, dynamic tool discovery, and unified access for both autonomous AI agents and AI coding assistants. Transform scattered MCP server chaos into governed, auditable tool access with Keycloak/E

Verdict

BLOCK

Grade

Trust score

19 /100

Exposed tools

9 7r · 2w · 0d

Transport

stdio · streamable-http

License

Apache-2.0

Stars

944

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Unified Agent & MCP Server Registry – Gateway for AI Development Tools

[](https://github.com/agentic-community/mcp-gateway-registry/stargazers) [](https://github.com/agentic-community/mcp-gateway-registry/network) [](LICENSE) [](https://github.com/agentic-community/mcp-gateway-registry/releases)

The MCP Gateway & Registry is a single, governed control plane for every AI asset in your organization, from MCP servers and AI agents to skills and any custom asset your teams build. It is open source, licensed under Apache 2.0, and runs on Kubernetes (Amazon EKS), fully managed serverless (Amazon ECS), or Docker Compose (Amazon EC2).

It began as a gateway and registry for the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introdu

Read from source at commit d5525b8f8615OBSERVED · 2026-09-27

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-gateway-registry-infra --env A2A_SCANNER_LLM_API_KEY=${A2A_SCANNER_LLM_API_KEY} --env AGENT_BEARER_TOKEN=${AGENT_BEARER_TOKEN} --env AGENT_TOKEN=${AGENT_TOKEN} --env AI_DEFENSE_API_KEY=${AI_DEFENSE_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "mcp-gateway-registry-infra": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "A2A_SCANNER_LLM_API_KEY": "${A2A_SCANNER_LLM_API_KEY}",
        "AGENT_BEARER_TOKEN": "${AGENT_BEARER_TOKEN}",
        "AGENT_TOKEN": "${AGENT_TOKEN}",
        "AI_DEFENSE_API_KEY": "${AI_DEFENSE_API_KEY}"
      }
    }
  }
}

Exposed tools (9)

7 read · 2 write · 0 destructive.

Tool	Risk	Description
`Gadget`	read	A custom type
`admins`	read	Admin group
`current_time_by_timezone`	read
`currenttime-users`	read	Users with access to currenttime server
`ds1`	read
`mcp_command`	read	Call MCP gateway commands (ping, list, call, init).
`read_docs`	read	Search and read documentation files from the docs folder. Use this when users ask questions about the project, features, setup, configuration, or troubleshooting.
`registry_task`	write	Run service management, imports, user management, or diagnostics tasks.
`shell_command`	write	Run a read-only diagnostic command. Only a fixed allowlist of inspection binaries

Trust audit

BLOCKgrade F · trust 19/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (16 observation(s))
Network: declared (15 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

.env.example:869

# GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

terraform/aws-ecs/terraform.tfvars.example:1296

# github_app_private_key     = "-----BEGIN RSA PRIVATE KEY-----\\n...\\n-----END RSA PRIVATE KEY-----"

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

.claude/skills/agentcore-register/SKILL.md:19

Send the MCP `initialize` request and capture the response headers (for the session ID) and body (for server info).

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

.claude/skills/terraform-setup/SKILL.md:595

**Authentication:** with `REGISTRY_URL` and `KEYCLOAK_URL` exported, `register` fetches the JWT it needs dynamically (this is the same flow the README's post-deployment registration uses). **Do not re

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

.claude/skills/terraform-setup/SKILL.md:758

After login the browser lands on `https://<cloudfront>/login?error=oauth2_callback_failed`. The auth-server logs (`/ecs/<name>-auth-server`) show its server-side token exchange returning **401** on `P

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

infra/lib/registry/registry-config.ts:706

parsed = yaml.load(raw) as Record<string, any> | null;

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

.claude/skills/usage-report/run_report.sh:36

SSH_KEY="${SSH_KEY:-$HOME/.ssh/id_ed25519}"

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

docker-compose.yml:558

# AWS credentials are OPT-IN. Mounting the whole ~/.aws directory into an

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

terraform/telemetry-collector/bastion-scripts/setup-bastion.sh:9

SSH_KEY="${SSH_KEY:-~/.ssh/id_ed25519}"

Why it matters. touches a credential store

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

.claude/skills/macos-setup/SKILL.md:865

The cloud metadata address (169.254.169.254) is never permitted by either

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

.env.example:1381

# unless you allowlist them here. The cloud metadata address (169.254.169.254)

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

.env.example:1830

# workload-credential endpoints: EC2 IMDS (169.254.169.254, fd00:ec2::254),

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

auth_server/server.py:9234

"GATEWAY_GENERIC_TLS_VERIFY=false — the generic hop will NOT verify "

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

credentials-provider/generate_creds.sh:92

./generate_creds.sh -a keycloak -k https://kc.example.com

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.env.example:1516

#   MONGODB_CONNECTION_STRING=mongodb://admin:admin@mongodb:27017/mcp_registry?authMechanism=SCRAM-SHA-256&authSource=admin&retryWrites=false

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.claude/skills/macos-setup/SKILL.md:332

# Read from .env by init-keycloak.sh in Phase 10; see the generation block above.