supergatewaySAFE
Run MCP stdio servers over HTTP streamable, SSE and SSE over stdio. AI gateway.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Supergateway runs MCP stdio-based servers over SSE (Server-Sent Events) or WebSockets (WS) with one command. This is useful for remote access, debugging, or connecting to clients when your MCP server only supports stdio.
Questions, ideas or just want to chat? Join the community on Discord.
Supported by:
- Supercov — Coverage for coding agents and software factories 🌙
- Superinterface
- Supercorp
Installation & Usage
Run Supergateway via npx:
npx -y supergateway --stdio "uvx mcp-server-git"
- `--stdio "command"`: Command that runs an MCP server over stdio
- `--sse "https://mcp-server-ab71a6b2-cd55-49d0-adba-562bc85956e3.supermachine.app"`: SSE URL to connect to (SSE→stdio mode)
- `--streamableHttp "https://mcp-server.example.com/mcp"`: Streamable HTTP URL to connect to (StreamableHttp→stdio mode)
- `--outputTransport stdio | sse | ws | streamableHttp`: Output MCP transport (default:
ssewith--stdio,stdiowith--sseor--streamableHttp). A remote server given with--sseor--streamableHttpcan be served oversse,wsorstreamableHttptoo; see Remote server → SSE, WS or Streamable HTTP - `--port 8000`: Port to listen on (stdio→SSE, stdio→WS or stdio→Streamable HTTP mode, default:
8000) - `--host 127.0.0.1`: Address to listen on, e.g.
127.0.0.1or::1([::1]also works) (stdio→SSE, stdio→WS or stdio→Streamable HTTP mode, default: every interface).--baseUrldoes not control binding: only--hostlimits which addresses accept connections. Refused in SSE→stdio and Streamable HTTP→stdio mode, which listen on nothing - `--baseUrl "http://localhost:8000"`: Base URL for SSE clients (stdio
21a82611f485OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add supergateway --env CONTINUATION_SHARED_TEST_KEY=${CONTINUATION_SHARED_TEST_KEY} -- npx -y [email protected]{
"mcpServers": {
"supergateway": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CONTINUATION_SHARED_TEST_KEY": "${CONTINUATION_SHARED_TEST_KEY}"
}
}
}
}Exposed tools (39)
38 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Template | read | A resource template |
Watched | read | A resource to subscribe to |
add | write | |
announce | read | |
arg1 | read | First test argument |
arg2 | read | Second test argument |
armExit | read | |
ask | read | |
big | read | |
chatty | read | |
crash | read | |
delayed | read | |
diagnostic | read | |
echo | read | |
elicit | read | |
gh_search | read | d |
hold | read | |
large | read | |
log | read | |
note | read | |
ping | read | |
plain | read | |
probe | read | |
progress | read | |
resourceUri | read | The resource |
roots | read | |
sample | read | |
search | read | d |
separators | read | |
shadowedError | read | |
slow | read | |
status | read | |
step | read | |
throws | read | |
toolError | read | |
toolsChanged | read | |
touch | read | |
unicode | read | |
whoami | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (18)
tool('read_text_file', { path: '/etc/hosts' }),.prettierignore
JSON.parse(readFileSync(resolve(entry, '../../package.json'), 'utf8'))
JSON.parse(readFileSync(resolve(entry, '../../package.json'), 'utf8'))
readFileSync(resolve(entry, '../../package.json'), 'utf8'),
readFileSync(resolve(entry, '../../../../artifact.json'), 'utf8'),
readFileSync(resolve(entry, '../../package.json'), 'utf8'),
if ! timeout 5 wget -q -S -O /dev/null http://127.0.0.1:8123/sse 2>&1 |
const response = await fetch(`http://127.0.0.1:${port}/mcp`, {sse: `http://127.0.0.1:${ports.sse}/sse`,stateful: `http://127.0.0.1:${ports.stateful}/mcp`,stateless: `http://127.0.0.1:${ports.stateless}/mcp`,export const UNICODE = 'a👩👩👧👦b عربى c éèê d 漢字 e Uni f'
unicodeStr = "a👩👩👧👦b عربى c éèê d 漢字 e Uni f"
const UNICODE = 'a👩👩👧👦b عربى c éèê d 漢字 e Uni f'
UNICODE = "a👩👩👧👦b عربى c éèê d 漢字 e Uni f"
UNICODE = "a\u{1F469}\u{1F469}\u{1F467}\u{1F466}b عربى c éèê d 漢字 e \u{1D518}\u{1D52B}\u{1D526} f"body-parser, cors, express, uuid, ws, yargs, zod, @types/body-parser
Gates applied: no_behavioural_pass.
21a82611f485full audit observations/trust-audit/mcp-server/supercorp-ai__supergateway.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 21a82611f485 | SAFE | B | 89 | first audit |
Questions
What is the supergateway MCP server?
Run MCP stdio servers over HTTP streamable, SSE and SSE over stdio. AI gateway.
What tools does supergateway expose?
39 in total: 38 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is supergateway safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does supergateway need?
It reads CONTINUATION_SHARED_TEST_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does supergateway run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as supergateway at 4.2.0-rc.1.
How current is this page?
The grade is for one exact copy of the source (21a82611f485), read on 2026-10-12. The repository is watched and re-audited when it changes.