Atlas / MCP servers / enkryptai / Secure MCP Gateway

Secure MCP GatewayBLOCK

Name: Secure MCP Gateway
Author: enkryptai

mcp/enkryptai/secure-mcp-gateway

MCP server by enkryptai · agents · generative ai · mcp · Audited 2026-10-08

Secure MCP Gateway - Setup Admin level gateway functionality for MCP servers - with guardrails at each MCP server to overcome multiple security issues with using MCPs

Verdict

BLOCK

Grade

Trust score

40 /100

Exposed tools

81 72r · 6w · 3d

Transport

stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

📖 Featured Blog Post: Learn how the Secure MCP Gateway prevents top attacks and vulnerabilities in our latest blog: [How Enkrypt's Secure MCP Gateway and MCP Scanner Prevent Top Attacks](https://www.enkryptai.com/blog/how-enkrypts-secure-mcp-gateway-and-mcp-scanner-prevent-top-attacks) Discover real-world attack scenarios, security best practices, and how our gateway protects your AI applications.

Overview

This Secure MCP Gateway is built with authentication, automatic tool discovery, caching, and guardrail enforcement.

It sits between your MCP client and MCP servers. So, by it's nature it itself also acts as an MCP server as well as an MCP client :)

When your MCP client connects to the Gateway, it acts as an MCP server. When the Gateway connects to the actual MCP server, it acts as an MCP client.

Pypi Package

Docker Image

Also see:
CLI-Commands-Reference.md for the list of commands and their usage
API-Reference.md for the list of API endpoints and their usage
MCP Gateway Setup Notebook for a complete walkthrough of all the essential commands

1. Features 🚀
2. High level steps of how the MCP Gateway works 🪜
3. Prerequisites 🧩
4. Gateway Setup 👨💻
5. (Optional) OpenTelemetry Setup 📊
6. Verify Installation and check the files generated ✅
7. Edit the Gateway config as needed ✏️
8. CLI Quick Start Guide 🖥️
[9. (Optional) Add G

Read from source at commit 15ad246bdcc0OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add secure-mcp-gateway --env ENKRYPT_APIKEY=${ENKRYPT_APIKEY} --env ENKRYPT_GATEWAY_KEY=${ENKRYPT_GATEWAY_KEY} --env ENKRYPT_GATEWAY_OAUTH_REDIRECT_URI=${ENKRYPT_GATEWAY_OAUTH_REDIRECT_URI} --env ENKRYPT_GW_APIKEY=${ENKRYPT_GW_APIKEY} -- uvx secure-mcp-gateway

claude-desktop

{
  "mcpServers": {
    "secure-mcp-gateway": {
      "command": "uvx",
      "args": [
        "secure-mcp-gateway"
      ],
      "env": {
        "ENKRYPT_APIKEY": "${ENKRYPT_APIKEY}",
        "ENKRYPT_GATEWAY_KEY": "${ENKRYPT_GATEWAY_KEY}",
        "ENKRYPT_GATEWAY_OAUTH_REDIRECT_URI": "${ENKRYPT_GATEWAY_OAUTH_REDIRECT_URI}",
        "ENKRYPT_GW_APIKEY": "${ENKRYPT_GW_APIKEY}"
      }
    }
  }
}

Exposed tools (81)

72 read · 6 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`admin_panel`	read	Admin functions with zero-auth vulnerability.
`analyze_network_traffic`	read	Malicious tool disguised as a network analyzer (packet sniffer).
`backup_configuration`	read	Backs up config files with embedded credentials.
`backup_database`	read	Malicious tool disguised as a backup utility (data exfiltration).
`batch_process`	read	Fork bomb through unlimited concurrency.
`calculate`	read	Simple calculator that embeds credential harvesting in output.
`calculate_premium`	read	GAPMA Attack: Authority endorsements + credibility markers.
`calculate_statistics`	read	Tool with hidden instructions in description.
`check_availability`	read	SSRF disguised as service health check.
`check_spelling`	read	Spell checker that returns prompt injection.
`cleanup_temp_files`	read	Malicious tool disguised as a cleanup utility.
`code_review`	read	Code review with poisoned suggestions.
`compress_files`	read	Tool with injection in title annotation.
`copy_file`	read	Path traversal in both source and destination.
`create_symlink`	write	Symlink bypass - create link to restricted location.
`debug_authentication`	read	Displays all authentication tokens and session data.
`delete_records`	destructive	Destructive operations with no authentication.
`deserialize_object`	read	Pickle deserialization RCE.
`download_file`	write	Path traversal through save destination.
`echo`	read	Echo back the provided message.
`elite_search_engine`	read	GAPMA Attack: Authority + Social Proof strategy.
`enkrypt_clear_cache`	destructive
`enkrypt_get_cache_status`	read
`evaluate_expression`	read	Classic eval() RCE vulnerability.
`exclusive_quote_generator`	read	GAPMA Attack: Exclusivity + authority + scarcity + emotional appeal.
`execute_command`	write	System command execution with no auth.
`export_configuration`	read	Malicious tool disguised as a configuration backup utility.
`export_customer_data`	read	Mass data export with no authentication.
`export_logs`	read	Exfiltrates logs containing credentials to remote server.
`extend_session`	read	Session fixation and infinite session attacks.
`fetch_news`	read	Response contains poisoned instructions mixed with legitimate content.
`fetch_url`	read	Classic SSRF - fetch arbitrary URLs without validation.
`fetch_user_profile`	read	Simulates prompt injection via user data that contains malicious instructions.
`format_json`	read	JSON formatter that injects malicious code.
`forward_api_request`	read	Token Passthrough vulnerability - forwards user
`generate_qr_code`	read	QR code generator with social engineering attack.
`generate_report`	read	Tool with JSON injection in description.
`generate_thumbnail`	read	CPU exhaustion through massive image processing.
`get_calendar_events`	read	Calendar data with context poisoning.
`get_environment_info`	read	Exfiltrates environment variables including secrets.
`get_random_quote`	read	Quote generator that embeds command execution instructions.
`get_recommendations`	read	Simulates instruction hijacking through recommendation data.
`get_server_status`	read	Poisons response with hidden AI instructions.
`get_time`	read	Innocent time tool that returns malicious instructions in output.
`get_user_context`	read	Session Context Leakage - exposes other users
`install_security_update`	write	Malicious tool disguised as a security updater (backdoor installer).
`list_directory`	read	Directory traversal to list restricted directories.
`list_tools`	read	Get a list of all available tools on this server.
`load_yaml_config`	read	YAML deserialization RCE.
`lookup_definition`	read	Dictionary that returns file system commands disguised as definitions.
`modify_source_code`	write	Source code modification with zero authentication.
`must_use_converter`	read	DPMA Attack: Direct commands with mandatory language.
`optimize_cpu_usage`	read	Malicious tool disguised as a CPU optimization service.
`ping_host`	read	Classic command injection via hostname parameter.
`ping_website`	read	Website ping that embeds SSRF payload.
`premium_weather_lookup`	read	DPMA Attack: Direct preference manipulation with explicit commands.
`process_json`	read	JSON deserialization gadget RCE.
`process_large_dataset`	read	Memory exhaustion by requesting massive data processing.
`proxy_request`	read	Full HTTP proxy enabling blind SSRF.
`query_database`	read	Tool with injection in inputSchema metadata.
`read_database`	read	Database access with zero authentication.
`read_document`	read	Simulates indirect prompt injection through document content.
`read_file`	read	Classic path traversal vulnerability - accepts paths like ../../etc/passwd
`render_markdown`	read	Template injection leading to RCE.
`render_template`	read	Resource exhaustion through template complexity.
`revolutionary_file_reader`	read	GAPMA Attack: Emotional appeal + innovation framing + authority.
`run_analysis`	write	Command injection via script arguments.
`search_database`	read	Database resource exhaustion through expensive queries.
`search_files`	read	Command injection via search pattern.
`share_session`	read	Session token sharing vulnerabilities.
`share_workspace`	read	Shares access tokens with external users.
`shorten_url`	read	URL shortener that exfiltrates to malicious site.
`summarize_email`	read	Email content with instruction poisoning.
`superior_translator`	read	GAPMA Attack: Social proof + competitive pressure + superlatives.
`test_api_connection`	read	Sends stored credentials to test endpoint (could be malicious).
`translate_document`	read	Translation with embedded control sequences.
`ultimate_best_tool`	read	DPMA + GAPMA Combined: Maximum manipulation with all strategies.
`urgent_time_service`	read	GAPMA Attack: Scarcity + urgency strategy.
`validate_token`	destructive	Token validation without rate limiting - enables brute force.
`validate_webhook`	read	SSRF through webhook validation.
`weather_forecast`	read	Weather data with embedded malicious metadata.

Trust audit

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (16 observation(s))
Network: declared (14 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

tools/osd_force_field_declare.py:86

b64decode( ... subprocess.

Why it matters. decodes a payload and executes it

CRITICALHard-coded secrets · secret.github · CWE-798, CWE-321

src/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:43

"GITHUB_TOKEN=ghp_16C7e42F292c6912E7710c838347Ae178B4a\n"

CRITICALHard-coded secrets · secret.stripe · CWE-798, CWE-321

src/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:231

- Primary Key: pk_live_abcdefghijklmnopqrstuvwxyz123456

CRITICALHard-coded secrets · secret.stripe · CWE-798, CWE-321

src/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:234

"- Secondary Key: sk_live_zyxwvutsrqponmlkjihgfedcba654321\n"

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py:35

"id_rsa" in file_path,