Skip to main content
hc
Submit
mcpSource-backed
MetaMCP logo

MetaMCP Gateway

Docker-deployed MCP gateway that aggregates downstream MCP servers into namespaces, endpoints, SSE, Streamable HTTP, OpenAPI, auth, and rate limits.

by metatool-ai · submitted by oktofeesh1·added 2026-06-05·
Claude CodeCodexCursorClaude Desktop
HarnessClaude CodeCodexCursorClaude Desktop
Review first — review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL
https://heyclau.de/entry/mcp/metamcp-gateway
Source URLs
https://docs.metamcp.com, https://github.com/metatool-ai/metamcp
Brand
MetaMCP
Brand domain
metamcp.com
Brand asset source
brandfetch
Safety notes
MetaMCP can start, aggregate, and expose multiple downstream MCP servers through a single managed endpoint., Public endpoints and public API keys can expose tool surfaces broadly if bootstrap settings or UI registration controls are left permissive., The README notes that APP_URL and CORS settings must match the URL used to access the service., Stdio-only clients generally need a proxy such as `mcp-proxy` to reach MetaMCP's remote endpoints., Rate limits, endpoint ownership, namespace visibility, OIDC, and registration controls should be configured before production use.
Privacy notes
MetaMCP can receive prompts, tool names, tool arguments, resource data, downstream MCP responses, endpoint metadata, API keys, OAuth tokens, user identifiers, and logs., Downstream stdio server environment variables may include secrets that are resolved from the MetaMCP container environment., Postgres persistence, file logs, bootstrap configuration, API keys, namespace definitions, and endpoint settings may retain sensitive operational data., Do not commit real `.env` files, bootstrap passwords, API keys, OIDC secrets, downstream service credentials, or exported gateway configs.
Author
metatool-ai
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-05

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

63

Baseline

—

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Needs review

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done

  • Source provenance statusRequired

    Marked as source-backed.

    Done

  • Metadata reviewed

    No reviewed flag detected in metadata.

    Pending

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done

  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done

  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done

  • Package verification flag

    No package verification flag provided.

    Pending

  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending

  • Baseline comparison available

    No baseline peer selected yet.

    Pending

  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

30 minutes

Install command

Provided

Config snippet

Provided

Copy snippet

Provided

Prerequisites

5 to clear

Platforms

4 listed

Install type

CLI install

Adoption plan

Balanced adoption plan

Current risk score 24/100. Use staged verification before broader rollout.

Risk 24

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done

  • Confirm metadata review state

    No review metadata found; increase manual validation.

    Pending

  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done

  • Review privacy notesRequired

    Privacy notes are present.

    Done

  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending

  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending

  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Missing required evidence: Metadata review. Risk score 31.

Risk 31

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Missing

Review metadata is missing.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required gaps: Metadata review

Decision timeline

Decision timeline · balanced

Blocking gaps: Check metadata review status. Risk 28.

Risk 28

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is missing.

Pending

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

Blockers: Check metadata review status

Prerequisite readiness

Prerequisite readiness

5 prerequisites to line up before setup. Have accounts and credentials ready first. Includes a review or approval gate.

0/5 ready
Account & credentials1Install & runtime2Review & approval1General130 minutes

Safety & privacy surface

Safety & privacy surface

5 safety and 4 privacy notes across 3 risk areas. Review closely: credentials & tokens, network access.

3 areas
  • SafetyNetwork accessMetaMCP can start, aggregate, and expose multiple downstream MCP servers through a single managed endpoint.
  • SafetyCredentials & tokensPublic endpoints and public API keys can expose tool surfaces broadly if bootstrap settings or UI registration controls are left permissive.
  • SafetyGeneralThe README notes that APP_URL and CORS settings must match the URL used to access the service.
  • SafetyNetwork accessStdio-only clients generally need a proxy such as `mcp-proxy` to reach MetaMCP's remote endpoints.
  • SafetyNetwork accessRate limits, endpoint ownership, namespace visibility, OIDC, and registration controls should be configured before production use.
  • PrivacyCredentials & tokensMetaMCP can receive prompts, tool names, tool arguments, resource data, downstream MCP responses, endpoint metadata, API keys, OAuth tokens, user identifiers, and logs.
  • PrivacyCredentials & tokensDownstream stdio server environment variables may include secrets that are resolved from the MetaMCP container environment.
  • PrivacyCredentials & tokensPostgres persistence, file logs, bootstrap configuration, API keys, namespace definitions, and endpoint settings may retain sensitive operational data.
  • PrivacyCredentials & tokensDo not commit real `.env` files, bootstrap passwords, API keys, OIDC secrets, downstream service credentials, or exported gateway configs.

Safety notes

  • MetaMCP can start, aggregate, and expose multiple downstream MCP servers through a single managed endpoint.
  • Public endpoints and public API keys can expose tool surfaces broadly if bootstrap settings or UI registration controls are left permissive.
  • The README notes that APP_URL and CORS settings must match the URL used to access the service.
  • Stdio-only clients generally need a proxy such as `mcp-proxy` to reach MetaMCP's remote endpoints.
  • Rate limits, endpoint ownership, namespace visibility, OIDC, and registration controls should be configured before production use.

Privacy notes

  • MetaMCP can receive prompts, tool names, tool arguments, resource data, downstream MCP responses, endpoint metadata, API keys, OAuth tokens, user identifiers, and logs.
  • Downstream stdio server environment variables may include secrets that are resolved from the MetaMCP container environment.
  • Postgres persistence, file logs, bootstrap configuration, API keys, namespace definitions, and endpoint settings may retain sensitive operational data.
  • Do not commit real `.env` files, bootstrap passwords, API keys, OIDC secrets, downstream service credentials, or exported gateway configs.

Prerequisites

  • Docker and Docker Compose available for the recommended deployment.
  • Postgres storage, app URL, CORS, bootstrap users, API keys, and registration settings reviewed before first start.
  • Downstream MCP server commands, environment variables, and secrets prepared for the MetaMCP container runtime.
  • [object Object]
  • Network exposure, TLS, reverse proxy, and rate limit policies reviewed before making endpoints available beyond a trusted local network.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
30 minutes
Difficulty
advanced
Full copyable content
{
  "mcpServers": {
    "metamcp": {
      "url": "METAMCP_ENDPOINT_MCP_URL",
      "headers": {
        "Authorization": "Bearer ${METAMCP_API_KEY}"
      }
    }
  }
}

About this resource

Content

MetaMCP is a Docker-deployed MCP gateway for aggregating downstream MCP servers into managed namespaces and endpoints. It can expose those grouped tools as SSE or Streamable HTTP endpoints, provide OpenAPI endpoints for compatible clients, inspect saved server configs, override tool names and annotations, and apply auth or rate-limit controls.

The upstream README describes MetaMCP as a proxy, aggregator, orchestrator, middleware layer, and gateway. It is itself an MCP-facing service, so clients can connect to one MetaMCP endpoint while MetaMCP coordinates the selected downstream MCP servers behind it.

Source Review

These sources were reviewed on 2026-06-05. Prefer the live repository, README, OAuth notes, environment example, Docker Compose file, package metadata, GHCR package page, and documentation site for current deployment, auth, transport, namespace, endpoint, bootstrap, and rate-limit behavior.

Features

  • Group one or more downstream MCP servers into a namespace.
  • Enable or disable servers and tools within a namespace.
  • Expose namespaces through SSE or Streamable HTTP endpoints.
  • Provide OpenAPI endpoints for compatible tool-calling clients.
  • Authenticate endpoints with API keys or MCP OAuth.
  • Configure endpoint and per-client rate limits.
  • Edit tool names, titles, descriptions, and custom MCP annotations.
  • Inspect saved server configs and debug MetaMCP endpoints.
  • Bootstrap users, API keys, namespaces, and endpoints from environment settings.
  • Deploy with Docker Compose and Postgres persistence.

Installation

The repository documents Docker Compose as the recommended quick start:

git clone https://github.com/metatool-ai/metamcp.git
cd metamcp
cp example.env .env
${EDITOR:-vi} .env

Review and save .env before starting the service. Replace default secrets, bootstrap users, bootstrap passwords, API key settings, app URL, registration settings, Postgres credentials, and OIDC settings before exposing the service. After hardening the environment and network settings, start MetaMCP:

docker compose up -d

For MCP clients that support remote servers, connect to the MetaMCP endpoint URL with the approved auth header. For stdio-only clients, the README recommends bridging through mcp-proxy for API-key-authenticated MetaMCP endpoints.

Use Cases

  • Give Claude one managed endpoint for a curated group of internal MCP servers.
  • Publish separate namespaces for development, production, analytics, or admin workflows.
  • Apply endpoint-level or user-level rate limits to shared agent tool surfaces.
  • Centralize API key or OAuth access for MCP endpoints.
  • Debug downstream MCP tool definitions through a saved-config inspector.
  • Override tool metadata and annotations for a safer client experience.
  • Host MCP-backed OpenAPI endpoints for compatible clients.

Safety and Privacy

MetaMCP is gateway infrastructure. Treat it like an access layer for every downstream tool it exposes. Restrict namespaces, default endpoints, public API keys, UI registration, SSO registration, and network access before connecting production systems.

The example environment file includes bootstrap users, API keys, namespaces, endpoints, registration controls, OIDC variables, and Postgres settings. Replace defaults and keep real values out of version control. Review logs and Postgres data as sensitive because they may contain endpoint metadata, tool traffic, user identifiers, prompts, arguments, responses, and downstream service details.

Duplicate Check

No metatool-ai/metamcp entry, MetaMCP Gateway entry, or matching source URL was found in content/mcp.

#gateway#orchestration#proxy#security#infrastructure

Source citations

Add this badge to your README

Show that MetaMCP Gateway is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/metamcp-gateway.svg)](https://heyclau.de/entry/mcp/metamcp-gateway)

How it compares

MetaMCP Gateway side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field
MetaMCP logoMetaMCP Gateway

Docker-deployed MCP gateway that aggregates downstream MCP servers into namespaces, endpoints, SSE, Streamable HTTP, OpenAPI, auth, and rate limits.

Open dossier
Bifrost logoBifrost MCP Gateway

Open-source AI gateway that can connect to downstream MCP servers and expose their aggregated tools through a single HTTP or SSE MCP endpoint for Claude Desktop, Cursor, and other MCP clients.

Open dossier
tbxark MCP Proxy Server

MIT-licensed MCP proxy server that aggregates multiple downstream MCP servers behind one HTTP service, exposing each configured server through SSE or Streamable HTTP endpoints with auth tokens and tool filtering.

Open dossier
Docker MCP Gateway logoDocker MCP Gateway

Docker's MCP CLI plugin and gateway for running catalog, OCI, registry, or local-file MCP servers in containers and exposing them to Claude, Cursor, VS Code, and other MCP clients through a shared gateway profile.

Open dossier
Next steps
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Trust
Review statusNot reviewedNot reviewedNot reviewedNot reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
Submitteroktofeesh1oktofeesh1oktofeesh1oktofeesh1
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandMetaMCP logoMetaMCPBifrost logoBifrost—Docker MCP Gateway logoDocker MCP Gateway
Categorymcpmcpmcpmcp
SourceSource-backedSource-backedSource-backedSource-backed
Authormetatool-aimaximhqtbxarkdocker
Added2026-06-052026-06-062026-06-062026-06-06
Platforms
Claude CodeCodexCursorClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Harness
Claude CodeCodexCursorClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Source repo————
Safety notes✓MetaMCP can start, aggregate, and expose multiple downstream MCP servers through a single managed endpoint. Public endpoints and public API keys can expose tool surfaces broadly if bootstrap settings or UI registration controls are left permissive. The README notes that APP_URL and CORS settings must match the URL used to access the service. Stdio-only clients generally need a proxy such as `mcp-proxy` to reach MetaMCP's remote endpoints. Rate limits, endpoint ownership, namespace visibility, OIDC, and registration controls should be configured before production use.✓Bifrost can expose all selected downstream MCP tools through one `/mcp` gateway endpoint, so treat the endpoint like an access layer for every connected tool. The docs state that default LLM tool calls are suggestions until an explicit tool execution API call is made, but agent mode can enable configured automatic execution. Gateway-mode auto-approval is controlled by the external MCP host, such as Claude Desktop, Cursor, Cline, or a custom client, not by Bifrost's `tools_to_auto_execute` setting. Stdio connections spawn local commands inside the Bifrost runtime; Docker deployments need images that include the requested executables. Use virtual keys, per-tool allowlists, auth headers, OAuth, per-user credentials, and network controls to limit which clients can reach high-impact tools.✓tbxark MCP Proxy Server can spawn stdio subprocess MCP servers and connect to remote SSE or Streamable HTTP MCP endpoints. Every exposed route inherits the permissions of its downstream server; use per-server `authTokens` and tool filters instead of exposing all tools broadly. The docs support remote config URLs and an `--insecure` TLS flag; avoid untrusted configs and do not disable TLS verification outside controlled testing. Token-in-route fallback can expose credentials through browser history, proxy logs, metrics, and referrers; prefer authorization headers when clients support them. Logging can be enabled globally or per server, so review logs before routing secrets, prompts, tool arguments, or tool outputs.✓Docker MCP Gateway can start and route multiple MCP servers, so each connected client inherits the permissions of every enabled server and tool. Container isolation reduces host exposure, but Docker Engine or Docker socket access is still highly privileged and should be limited to trusted users. The gateway supports tool allowlists, CPU limits, memory limits, network blocking, secret blocking, image signature verification, and interceptors; review defaults before production use. Catalog, profile, local-file, and registry references can change which servers run behind the gateway, especially when watch mode or shared profiles are enabled. Tool-call logging is enabled by default in the documented flags, so avoid routing secrets or sensitive payloads unless logging and retention are controlled.
Privacy notes✓MetaMCP can receive prompts, tool names, tool arguments, resource data, downstream MCP responses, endpoint metadata, API keys, OAuth tokens, user identifiers, and logs. Downstream stdio server environment variables may include secrets that are resolved from the MetaMCP container environment. Postgres persistence, file logs, bootstrap configuration, API keys, namespace definitions, and endpoint settings may retain sensitive operational data. Do not commit real `.env` files, bootstrap passwords, API keys, OIDC secrets, downstream service credentials, or exported gateway configs.✓Bifrost may process provider prompts, model responses, MCP tool names, tool arguments, tool results, headers, virtual keys, OAuth tokens, per-user credentials, logs, traces, metrics, and downstream server metadata. Per-user auth stores credentials against a signed-in user, virtual key, or session identity; review credential lifecycle, revocation, and orphaned-session behavior. Logs, config stores, provider settings, MCP sessions, and gateway analytics can contain sensitive operational or user data. Keep real provider keys, virtual keys, OAuth secrets, MCP endpoint URLs, and upstream service credentials in environment variables or secret stores, not committed config.✓The proxy may process downstream server commands, environment variables, headers, auth tokens, remote config URLs, tool names, tool arguments, tool outputs, prompts, resources, logs, and route keys. Stdio subprocesses inherit configured environment variables and can access whatever local paths, network services, or credentials those commands can reach. Remote config files can reveal internal MCP server names, endpoint URLs, auth headers, tool filters, and secret placeholders. Keep config files, tokens, `.env` values, logs, and Docker volume mounts out of public repositories and shared support output.✓Docker MCP Gateway may process MCP server definitions, catalog entries, profile exports, local server files, secrets, OAuth tokens, tool names, tool arguments, tool outputs, logs, container metadata, and Docker Engine metadata. Secrets may come from Docker Desktop secrets or `.env` fallback files; keep those stores out of version control and restrict filesystem permissions. Tool outputs can include local files, API responses, credentials, account data, or infrastructure details depending on the enabled downstream MCP servers. Exported profiles and catalogs can reveal internal server names, image references, allowed tools, configuration values, and service endpoints.
Prerequisites
  • Docker and Docker Compose available for the recommended deployment.
  • Postgres storage, app URL, CORS, bootstrap users, API keys, and registration settings reviewed before first start.
  • Downstream MCP server commands, environment variables, and secrets prepared for the MetaMCP container runtime.
  • [object Object]
  • Node.js with `npx`, Docker, or another supported Bifrost Gateway deployment path.
  • Bifrost Gateway version `v1.4.0-prerelease1` or newer for MCP gateway mode.
  • Downstream MCP server commands or HTTP/SSE endpoint URLs prepared before registering clients.
  • Provider API keys, virtual keys, gateway auth settings, and governance policies reviewed before sharing the endpoint.
  • Go toolchain for source install, or Docker for the GHCR image deployment path.
  • A v2 JSON configuration file defining `mcpProxy` and downstream `mcpServers`.
  • Downstream MCP server commands, URLs, headers, environment variables, and secrets prepared before proxy startup.
  • Public base URL, bind address, route type, auth token policy, logging policy, and tool filters reviewed before exposing the proxy beyond localhost.
  • Docker Desktop `4.59+` with the MCP Toolkit feature enabled, or the Docker MCP CLI plugin built and installed independently.
  • Docker Engine access for running containerized MCP servers and the gateway.
  • MCP server sources prepared from Docker MCP Catalog entries, OCI images, MCP Registry entries, or local YAML/JSON server files.
  • Profiles feature enabled when using `docker mcp profile` and profile-based gateway runs outside Docker Desktop.
Install
git clone https://github.com/metatool-ai/metamcp.git && cd metamcp && cp example.env .env && ${EDITOR:-vi} .env
npx -y @maximhq/bifrost
go install github.com/tbxark/mcp-proxy@latest
docker mcp gateway run
Config
{
  "mcpServers": {
    "metamcp": {
      "command": "uvx",
      "args": [
        "mcp-proxy",
        "--transport",
        "streamablehttp",
        "METAMCP_ENDPOINT_MCP_URL"
      ],
      "env": {
        "API_ACCESS_TOKEN": "${METAMCP_API_KEY}"
      }
    }
  }
}
{
  "mcpServers": {
    "bifrost": {
      "url": "BIFROST_MCP_URL",
      "headers": {
        "Authorization": "Bearer ${BIFROST_VIRTUAL_KEY}"
      },
      "type": "http"
    }
  }
}
{
  "mcpProxy": {
    "baseURL": "MCP_PROXY_BASE_URL",
    "addr": ":9090",
    "name": "MCP Proxy",
    "version": "1.0.0",
    "type": "streamable-http",
    "options": {
      "authTokens": [
        "REPLACE_WITH_PROXY_TOKEN"
      ]
    }
  },
  "mcpServers": {
    "fetch": {
      "command": "uvx",
      "args": [
        "mcp-server-fetch"
      ],
      "options": {
        "toolFilter": {
          "mode": "allow",
          "list": [
            "fetch"
          ]
        }
      }
    }
  }
}
{
  "mcpServers": {
    "MCP_DOCKER": {
      "command": "docker",
      "args": [
        "mcp",
        "gateway",
        "run"
      ]
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Source-backed guides for putting this to work.

Auditing MCP Client Configuration Before Team Rollout

Audit MCP client configuration before sharing it with a team.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by YB0y

Auto Mode Hard-Deny Policies For Safe Automation

Set autoMode.hard_deny rules to block risky actions in auto mode.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by kiannidev

Dynamic Workflows For Large Codebase Audits

Use dynamic workflows to orchestrate large codebase audit runs.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by kiannidev

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.