Labsco
MCP SERVER

mcpgate

by Mcpgate-de ↗

One self-hosted gateway between your agents and the tools your team already uses, with personal data pseudonymised before it reaches the model.

Agent Guardrails, Content Safety & Audit
Summary
A gateway that is also a gate — routing plus policy, PII handling and shared context.

Routing many services through one MCP endpoint is the crowded part of this space; what is harder to assemble yourself is the rest of the stack here — pseudonymisation that survives write-flows, per-user hooks a person can edit from their own client, and a served corpus of company knowledge that the gateway keeps fresh. The trade-off is licence shape and self-hosting: you run the containers, you keep the encrypted mapping, and a hosted commercial offering needs a separate licence.

What it is

A self-hosted MCP gateway you run with Docker Compose. Clients connect to a single MCP URL; the gateway authenticates the user, runs your policy hooks, executes the action against the real service with that user's OAuth token, and runs post-hooks on the way back.

What you get
  • One URL for every client, with a one-line setup for Claude, ChatGPT, Codex and Gemini CLI
  • Built-in integrations across Google Workspace, Microsoft 365, Slack, Notion, Confluence, Jira, GitLab, GitHub, Jenkins, Sentry, Grafana, BigQuery and more, plus OpenAPI import for anything else
  • PII pseudonymization with rehydration: emails, names and phone numbers become stable pseudonyms before the model sees them, and are restored when the agent calls a tool — the mapping stays on-prem, encrypted, with a 24h TTL
  • Policy, enrichment and post-processing hooks in config/tool_hooks.yaml, hot-reloaded without a restart
  • A Context Map of your company's wiring served to every client, with `map_read` for BM25 search over it and `map_write` so agents can correct stale pages
  • Write-safety defaults: destructive actions need an explicit `confirmed=true` or `force=true`, and responses are size-capped
Requirements

Docker Compose, then `docker compose up -d` and the setup wizard at http://localhost:8642 — no .env file needed, secrets are generated on first start. Sign-in is broker login by default, with OIDC SSO or magic links available. Licensed BSL 1.1: personal and internal business use is permitted including production, free up to 5 users; offering it as a hosted service needs a commercial licence.

Setup effort

One command — claude mcp add mcpgate https://your-gateway-url/mcp -s user -t http