Self-hostable hub that wraps stdio MCP servers as streamable HTTP endpoints via supergateway, so a fleet of Model Context Protocol servers can run on one machine and be reached from any MCP client over the network.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
78
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Required evidence gates are covered (5/6 signals complete).
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
5/6 steps complete with no blocking gaps for this preset.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
No required blockers for this timeline preset.
Prerequisite readiness
3 prerequisites to line up before setup. Have accounts and credentials ready first.
Safety & privacy surface
2 safety and 2 privacy notes across 4 risk areas. Review closely: credentials & tokens, permissions & scopes, network access, third-party handling.
Disclosure: editorial
node index.js --only github,git,memory,fetchMCP Supergateway Hub is relevant to HeyClaude users who self-host MCP infrastructure. It uses supergateway to bridge stdio MCP servers to streamable HTTP endpoints (one sequential port per server, starting at 3170), so a large set of Model Context Protocol servers — 62 are included across tiers like core dev, databases, cloud/infra, and AI bridges — can run on a dedicated machine and be reached from any MCP client. It ships a systemd unit for always-on operation and pairs well with Claude Code's Tool Search, which keeps the cost of many configured servers low.
Editorial listing submitted by the project author (the repository owner). No paid placement or affiliate link is used.
Show that MCP Supergateway Hub is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/tools/mcp-supergateway-hub)MCP Supergateway Hub side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
| Field | Self-hostable hub that wraps stdio MCP servers as streamable HTTP endpoints via supergateway, so a fleet of Model Context Protocol servers can run on one machine and be reached from any MCP client over the network. Open dossier | MIT-licensed Go implementation of the Model Context Protocol for building MCP servers and clients with tools, resources, prompts, stdio, SSE, Streamable HTTP, hooks, session management, validation, sampling, roots, and tracing. Open dossier | Official Java SDK for Model Context Protocol clients and servers, maintained in collaboration with Spring AI, with Java 17+ support, Maven artifacts, synchronous and asynchronous APIs, Reactive Streams, Project Reactor, JDK HttpClient, Servlet transport, JSON binding modules, and conformance tests. Open dossier | Official Python SDK for Model Context Protocol clients and servers, published as the `mcp` package on PyPI, with FastMCP server helpers, client support, tools, resources, prompts, stdio, SSE, Streamable HTTP, authentication, elicitation, sampling, logging, and standalone development tools. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| SubmitterDiffers | dpdanpittman | — | — | — |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | |
| Category | tools | tools | tools | tools |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | dpdanpittman | mark3labs | Model Context Protocol | Model Context Protocol |
| Added | 2026-06-02 | 2026-06-18 | 2026-06-18 | 2026-06-18 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓Bridges stdio MCP servers to HTTP and exposes them on your network, so each wrapped server's tools become reachable over HTTP — run it on a trusted network or behind authentication, not on a public interface. Running dozens of servers behind one host broadens the tool surface available to any connected client; use the --only/--exclude flags to scope what is exposed. | ✓mcp-go is a library for exposing application behavior through MCP; the risk depends on the tools, resources, prompts, and transports built with it. Treat tool handlers like API endpoints: validate inputs, enforce authorization, bound side effects, and return safe errors. Use stdio for local-only workflows when possible; add authentication, TLS, rate limits, request logging, and origin controls for HTTP or SSE deployments. Session, hook, task, sampling, roots, and tracing features can affect control flow or expose extra context, so review them before production use. | ✓The official Java SDK is a protocol library; production risk comes from your MCP tools, resources, prompts, transports, authorization hooks, and framework integration. Validate tool inputs, enforce caller permissions, bound side effects, and avoid returning raw Java exceptions or internal stack details to MCP clients. Servlet, Spring, and remote transport deployments need authentication, TLS, request limits, observability policy, cancellation behavior, and abuse protection. Spring AI MCP security and annotation support may simplify integration, but application owners still need to review authorization, tenant boundaries, and data retention. | ✓The official Python SDK is a protocol library; risk comes from the tools, resources, prompts, transports, auth flows, and server process you build with it. Validate all tool inputs, enforce caller permissions, bound file and network access, and sanitize errors before returning them to an MCP client. HTTP, SSE, and ASGI deployments need authentication, TLS, CORS review, host/path routing controls, request limits, logging policy, and abuse protection. The upstream README says v2 is alpha; production projects should stay on the stable v1 line unless they intentionally pin and test a pre-release. |
| Privacy notes | ✓The gateway process and its .env hold API keys and see traffic passing between MCP clients and the wrapped servers. Fully self-hosted, so data stays on your own infrastructure rather than a third-party service. | ✓MCP servers built with mcp-go may expose resource contents, tool arguments, prompt templates, request metadata, session state, traces, logs, and application errors to MCP clients and model providers. Do not include secrets, internal identifiers, customer data, or privileged paths in tool descriptions, validation errors, logs, traces, or examples. Network transports can expose MCP traffic beyond the local machine; document data retention, authentication, and observability behavior for each deployment. | ✓Java MCP clients and servers may expose tool arguments, tool results, resource contents, prompt templates, request metadata, correlation IDs, logs, traces, and authorization context. Avoid leaking secrets, customer data, private resources, internal identifiers, stack traces, privileged paths, or token values through schemas, responses, errors, or logs. Document which MCP client, server process, Java framework, model provider, transport, and observability system can observe each request. | ✓MCP Python servers may expose local files, application data, tool arguments, tool results, resource contents, prompt templates, authentication state, logs, traces, and errors. Do not leak secrets, customer data, private paths, internal identifiers, token values, or privileged resource contents through schemas, examples, responses, or logs. Document which MCP client, model provider, server process, transport, ASGI layer, and observability system can observe each request. |
| Prerequisites |
|
|
|
|
| Install | | | | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Build MCP servers and clients in Go with a high-level SDK covering tools, resources, prompts, transports, sessions, hooks, validation, and tracing.
Build MCP clients and servers in Java with the official Java SDK, Maven artifacts, Java 17+, Reactive Streams, JDK HttpClient, Servlet transport, and Spring AI integration guidance.
Source-backed guides for putting this to work.
Define in-process MCP tools for the Claude Agent SDK with createSdkMcpServer and the tool helper, then wire them into query.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.