Atlas / MCP servers / korals-ai / mcp-broker

mcp-brokerSAFE

mcp/korals-ai/mcp-broker

An MCP gateway for tool servers that aren't up yet — upstreams appear mid-session instead of blocking agent startup

Verdict
SAFE
Grade
B
Trust score
87 /100
Exposed tools
1 1r · 0w · 0d
Transport
streamable-http
License
Apache-2.0
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

An MCP gateway for tool servers that aren't up yet.

Point your agent at the broker instead of at each tool server. A server that is still booting — or that you haven't started — doesn't block the session and doesn't appear as a phantom tool that hangs on first call. When it comes up, its tools appear mid-session, without restarting the agent or the broker.

It's a library, not a service: you mount it in your own ASGI app.

The problem

Agent runtimes read their MCP server list once, at session start. So every tool server has to be listening before the agent starts, and your startup time is the slowest one. Anything heavy — a browser, a CAD toolchain, a model server — is either on the critical path or missing for the whole session.

Point the agent at a broker instead and that ordering constraint goes away.

Install

pip install mcp-broker

Use

from mcp_broker import ToolBroker, broker_route

broker = ToolBroker.from_env([
("office", "http://127.0.0.1:9101/mcp"),
("slowly", "http://127.0.0.1:9102/mcp"),   # not running yet — fine
])

app = Starlette(lifespan=...)          # see examples/serve_broker.py
for name in broker.names:
app.mount(broker_route(name), broker.asgi_app(name))

broker.run() — an async context manager, entered from your lifespan — owns the dial loop that notices an upstream arriving and pushes tools/list_changed to every attached session. Without it the broker still proxies, but nothing ever appears mid-session.

Each upstream gets its own endpoint, /_broker//mcp, so agents see them as separate servers and can be granted them separately.

Using it from Claude Code

claude mcp add --transport http office http://127.0.0.1:9000/_broker/office/mcp
claude mcp add --transport http slowly http://127.0.0.1:9000/_broker/slowly/mcp

Both register instantly, whether or not the upstream behind them is running.

Any MCP client works the same way — the broker sp

Read from source at commit 41843211c77fOBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp-broker -- uvx mcp-broker
claude-desktop
{
  "mcpServers": {
    "mcp-broker": {
      "command": "uvx",
      "args": [
        "mcp-broker"
      ]
    }
  }
}
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
shoutreadReturn the text in upper case. Exists only to prove the call arrived.
04

Trust audit

SAFEgrade B · trust 87/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (7)

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:33
("office", "http://127.0.0.1:9101/mcp"),
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:34
("slowly", "http://127.0.0.1:9102/mcp"),   # not running yet — fine
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:53
claude mcp add --transport http office http://127.0.0.1:9000/_broker/office/mcp
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:54
claude mcp add --transport http slowly http://127.0.0.1:9000/_broker/slowly/mcp
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:65
"office": { "type": "http", "url": "http://127.0.0.1:9000/_broker/office/mcp" }
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
mcp, starlette
Why it matters. 2 requirement(s) not pinned with ==
Fix. pin exact versions

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 41843211c77ffull audit observations/trust-audit/mcp-server/korals-ai__mcp-broker.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1241843211c77fSAFEB87first audit
06

Questions

What is the mcp-broker MCP server?

An MCP gateway for tool servers that aren't up yet — upstreams appear mid-session instead of blocking agent startup

What tools does mcp-broker expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp-broker safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (87/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does mcp-broker need?

No credential environment variables were found in its source, so it appears to need none.

How does mcp-broker run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as mcp-broker.

How current is this page?

The grade is for one exact copy of the source (41843211c77f), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement