GatewayBLOCK
Too much tools in context. Use a gateway
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@eznix/mcp-gateway) [](https://www.npmjs.com/package/@eznix/mcp-gateway) [](LICENSE) [](https://github.com/eznix86/mcp-gateway/stargazers)
MCP Gateway is a server aggregation tool that connects multiple Model Context Protocol (MCP) servers into a single gateway, exposing all tools from connected servers through unified search, describe, and invoke interfaces and it exposes only 5 tools.
The Context Limit Problem
When connecting an client (Claude Code, Opencode, etc.) to multiple MCP servers, each server lists all its tools. With 10+ MCPs each exposing 10-50 tools, you can easily exceed 500+ tool descriptions in the system prompt:
10 servers × 20 tools each = 200+ tool descriptions Each tool: 200-500 chars → 40KB-100KB of description just for tool schemas!
This creates two problems:
- Context overflow: Many LLMs hit their context limit before any conversation happens
- Cognitive overload: LLMs struggle to choose the right tool from hundreds of options
The Gateway Solution
MCP Gateway solves this by providing tool search instead of dumping all tool schemas:
┌─────────────┐ gateway.search ┌─────────────────┐ kubernetes::pods_list ┌──────────────────┐ │ AI Client │ ───────────────────► │ MCP Gateway │ ─────────────────────────► │ Kubernetes MCP │ │ │ │ │ │ │ │ │ ◄────────────────────│ │ ◄───────────────────────── │ │ └─────────────┘ pods_list schema └─────────────────┘ pods output └──────────────────┘
How It Works
MCP Gateway operates as both
77c534377367OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-gateway --env DB_PASS=${DB_PASS} --env JUPYTER_TOKEN=${JUPYTER_TOKEN} -- npx -y @eznix/[email protected]{
"mcpServers": {
"mcp-gateway": {
"command": "npx",
"args": [
"-y",
"@eznix/[email protected]"
],
"env": {
"DB_PASS": "${DB_PASS}",
"JUPYTER_TOKEN": "${JUPYTER_TOKEN}"
}
}
}
}Exposed tools (5)
2 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
gateway.describe | read | |
gateway.invoke | write | |
gateway.invoke_async | write | |
gateway.invoke_status | write | |
gateway.search | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (10)
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);"DATABASE_URL": "postgresql://{env:DB_USER}:{env:DB_PASS}@localhost:5432/mydb"DATABASE_URL: "postgresql://{env:DB_USER}:{env:DB_PASS}@localhost:5432/mydb"DATABASE_URL: "postgresql://admin:secret123@localhost:5432/mydb"
const binaryString = atob(base64);
atob(data);
const parsedHeader = JSON.parse(atob(header));
atob(val);
const decoded = JSON.parse(atob(base642));
@modelcontextprotocol/sdk, lru-cache, minisearch, @types/bun, @types/node, typescript
Gates applied: no_behavioural_pass.
77c534377367full audit observations/trust-audit/mcp-server/eznix86__gateway-15.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 77c534377367 | BLOCK | D | 69 | first audit |
Questions
What is the Gateway MCP server?
Too much tools in context. Use a gateway
What tools does Gateway expose?
5 in total: 2 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Gateway safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Gateway need?
It reads DB_PASS and JUPYTER_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Gateway run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @eznix/mcp-gateway at 1.5.2.
How current is this page?
The grade is for one exact copy of the source (77c534377367), read on 2026-10-09. The repository is watched and re-audited when it changes.