mcp-brokerSAFE
An MCP gateway for tool servers that aren't up yet — upstreams appear mid-session instead of blocking agent startup
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An MCP gateway for tool servers that aren't up yet.
Point your agent at the broker instead of at each tool server. A server that is still booting — or that you haven't started — doesn't block the session and doesn't appear as a phantom tool that hangs on first call. When it comes up, its tools appear mid-session, without restarting the agent or the broker.
It's a library, not a service: you mount it in your own ASGI app.
The problem
Agent runtimes read their MCP server list once, at session start. So every tool server has to be listening before the agent starts, and your startup time is the slowest one. Anything heavy — a browser, a CAD toolchain, a model server — is either on the critical path or missing for the whole session.
Point the agent at a broker instead and that ordering constraint goes away.
Install
pip install mcp-broker
Use
from mcp_broker import ToolBroker, broker_route
broker = ToolBroker.from_env([
("office", "http://127.0.0.1:9101/mcp"),
("slowly", "http://127.0.0.1:9102/mcp"), # not running yet — fine
])
app = Starlette(lifespan=...) # see examples/serve_broker.py
for name in broker.names:
app.mount(broker_route(name), broker.asgi_app(name))broker.run() — an async context manager, entered from your lifespan — owns the dial loop that notices an upstream arriving and pushes tools/list_changed to every attached session. Without it the broker still proxies, but nothing ever appears mid-session.
Each upstream gets its own endpoint, /_broker//mcp, so agents see them as separate servers and can be granted them separately.
Using it from Claude Code
claude mcp add --transport http office http://127.0.0.1:9000/_broker/office/mcp claude mcp add --transport http slowly http://127.0.0.1:9000/_broker/slowly/mcp
Both register instantly, whether or not the upstream behind them is running.
Any MCP client works the same way — the broker sp
41843211c77fOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-broker -- uvx mcp-broker
{
"mcpServers": {
"mcp-broker": {
"command": "uvx",
"args": [
"mcp-broker"
]
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
shout | read | Return the text in upper case. Exists only to prove the call arrived. |
Trust audit
SAFEgrade B · trust 87/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (7)
streamable-http
("office", "http://127.0.0.1:9101/mcp"),("slowly", "http://127.0.0.1:9102/mcp"), # not running yet — fineclaude mcp add --transport http office http://127.0.0.1:9000/_broker/office/mcp
claude mcp add --transport http slowly http://127.0.0.1:9000/_broker/slowly/mcp
"office": { "type": "http", "url": "http://127.0.0.1:9000/_broker/office/mcp" }mcp, starlette
Gates applied: no_behavioural_pass.
41843211c77ffull audit observations/trust-audit/mcp-server/korals-ai__mcp-broker.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 41843211c77f | SAFE | B | 87 | first audit |
Questions
What is the mcp-broker MCP server?
An MCP gateway for tool servers that aren't up yet — upstreams appear mid-session instead of blocking agent startup
What tools does mcp-broker expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-broker safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (87/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-broker need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-broker run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as mcp-broker.
How current is this page?
The grade is for one exact copy of the source (41843211c77f), read on 2026-10-12. The repository is watched and re-audited when it changes.