MCPGatewayBLOCK
Share local MCP servers across coding-agent sessions: avoid duplicate backend memory and startup work. Keep the agent-side MCP connection across settled configuration-only restarts (SDK/stdio). Tool discovery and exclusive workflows; sharing adds overhead.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Languages (16)
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Español · Français · Deutsch · Português (Brasil) · Italiano · Русский · العربية · हिन्दी · Bahasa Indonesia · Türkçe · Tiếng Việt
Running several coding sessions? Share one set of MCP backends to avoid duplicate memory and startup work. Keep your existing agent-to-gateway connection across a settled configuration-only restart on the tested SDK/stdio route.
Start with Copilot CLI · Client compatibility · Evidence and limits · Copilot updates
Concept artwork, not a screenshot or benchmark. English labels; three payoffs:
- Avoid duplicate backend memory: assumed 5 × 1.5 GB sets share one; 6 GB duplication avoided before gateway/connector overhead, not measured net savings.
- Reuse backend startup work: if all five sessions use twelve stdio services, 60 → 12 backend starts—not 80% faster elapsed startup.
- Keep the existing agent-to-gateway MCP connection: the connection survived a settled owned-gateway restart after configuration-only additions in the SDK/stdio experiment. Not hot reload, active-cal
33e165db21aaOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add shared-mcp-gateway-auth --env DEVICE_TEST_SECRET=${DEVICE_TEST_SECRET} --env ENTRA_SERVICE_TEST_SECRET=${ENTRA_SERVICE_TEST_SECRET} --env OAUTH_TEST_SECRET=${OAUTH_TEST_SECRET} -- npx -y [email protected]{
"mcpServers": {
"shared-mcp-gateway-auth": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DEVICE_TEST_SECRET": "${DEVICE_TEST_SECRET}",
"ENTRA_SERVICE_TEST_SECRET": "${ENTRA_SERVICE_TEST_SECRET}",
"OAUTH_TEST_SECRET": "${OAUTH_TEST_SECRET}"
}
}
}
}Exposed tools (13)
13 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
call_tool | read | |
claim_server | read | |
echo | read | |
get_tool_schema | read | |
hidden | read | |
list_servers | read | |
mutate | read | |
page_one | read | first page |
page_two | read | second page |
release_server | read | |
search_tools | read | |
slow | read | |
work | read | ${name} work |
Trust audit
BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (8 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (18)
if (!privateKey.includes('-----BEGIN PRIVATE KEY-----') || key.asymmetricKeyType !== 'rsa' ||!pem.includes('-----BEGIN PRIVATE KEY-----')) throw failure();| Plugin install fails | Confirm GitHub connectivity and normal Git access to `yeelam-gordon/MCPGateway`; do not collect credentials. |
console.log(`Shared MCP gateway listening on http://127.0.0.1:${options.port}/mcp`); console.log(`Bearer token file: ${tokenPath}`);get redirectUrl() { return this.serviceAccount ? undefined : `http://127.0.0.1:${this.config.oauth?.redirectPort ?? 7340}/oauth/callback`; }console.log(`Shared MCP gateway listening on http://127.0.0.1:${options.port}/mcp`); console.log(`Bearer token file: ${tokenPath}`);const endpoint = new URL(`http://127.0.0.1:${port}/mcp`);env: { ...microsoftHostEnv(), SHARED_MCP_VSCODE_CALLBACK: `http://127.0.0.1:${server.address().port}/host-token`,const token = 'oauth-lease-test-token';
const secret = 'never-print-invalid-secret';
const token = 'synthetic-scale-test-token';
const secret = 'DO_NOT_ECHO_THIS_SECRET';
const token = 'confidence-heartbeat-token';
console.log(`Token ACL timing: cold ${coldMs.toFixed(1)} ms; warm ${warmMs.toFixed(1)} ms`);Register the exact redirect URI `http://127.0.0.1:7340/oauth/callback` with your identity provider. The port defaults to 7340 and must be available. Registered-client Entra authentication requires a s
ajv, express, zod
**Microsoft Entra app-only:** use `oauth.provider: "entra"`, a registered `oauth.clientId`, `oauth.grantType: "client_credentials"`, and omit `redirectPort`. MSAL's supported `ConfidentialClientApplic
The exact backend notification GET (`Accept: text/event-stream`) has a bounded wait for response headers. Once successful SSE headers arrive, its body remains open until transport/controller cancellat
Gates applied: critical_finding, no_behavioural_pass.
33e165db21aafull audit observations/trust-audit/mcp-server/yeelam-gordon__mcpgateway.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 33e165db21aa | BLOCK | F | 52 | first audit |
Questions
What is the MCPGateway MCP server?
Share local MCP servers across coding-agent sessions: avoid duplicate backend memory and startup work. Keep the agent-side MCP connection across settled configuration-only restarts (SDK/stdio). Tool discovery and exclusive workflows; sharing adds overhead.
What tools does MCPGateway expose?
13 in total: 13 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is MCPGateway safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (52/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does MCPGateway need?
It reads DEVICE_TEST_SECRET, ENTRA_SERVICE_TEST_SECRET and OAUTH_TEST_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does MCPGateway run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as shared-mcp-gateway-auth at 0.0.1.
How current is this page?
The grade is for one exact copy of the source (33e165db21aa), read on 2026-10-11. The repository is watched and re-audited when it changes.