map_readLABSCO SUMMARY
A gateway that is also a gate — routing plus policy, PII handling and shared context.
Routing many services through one MCP endpoint is the crowded part of this space; what is harder to assemble yourself is the rest of the stack here — pseudonymisation that survives write-flows, per-user hooks a person can edit from their own client, and a served corpus of company knowledge that the gateway keeps fresh. The trade-off is licence shape and self-hosting: you run the containers, you keep the encrypted mapping, and a hosted commercial offering needs a separate licence.
What it is
A self-hosted MCP gateway you run with Docker Compose. Clients connect to a single MCP URL; the gateway authenticates the user, runs your policy hooks, executes the action against the real service with that user's OAuth token, and runs post-hooks on the way back.
What you get
- One URL for every client, with a one-line setup for Claude, ChatGPT, Codex and Gemini CLI
- Built-in integrations across Google Workspace, Microsoft 365, Slack, Notion, Confluence, Jira, GitLab, GitHub, Jenkins, Sentry, Grafana, BigQuery and more, plus OpenAPI import for anything else
- PII pseudonymization with rehydration: emails, names and phone numbers become stable pseudonyms before the model sees them, and are restored when the agent calls a tool — the mapping stays on-prem, encrypted, with a 24h TTL
- Policy, enrichment and post-processing hooks in config/tool_hooks.yaml, hot-reloaded without a restart
- A Context Map of your company's wiring served to every client, with
map_readfor BM25 search over it andmap_writeso agents can correct stale pages - Write-safety defaults: destructive actions need an explicit
confirmed=trueorforce=true, and responses are size-capped
Requirements
Docker Compose, then docker compose up -d and the setup wizard at http://localhost:8642 — no .env file needed, secrets are generated on first start. Sign-in is broker login by default, with OIDC SSO or magic links available. Licensed BSL 1.1: personal and internal business use is permitted including production, free up to 5 users; offering it as a hosted service needs a commercial licence.
Setup effort
Build from source — git clone https://gitlab.com/mcpgate/mcpgate.git && cd mcpgate
USE CASES
01
Giving a whole team one connector instead of twenty
Configure the gateway URL once company-wide, then enable only the services you have credentials for.
02
Keeping customer data out of the model
Leave pseudonymisation on: the agent reasons over stable placeholders and the real values are restored only when a tool call goes out.
03
Stopping an agent from overwriting a ticket
Put the guard in a policy hook, reload it with the admin endpoint, and let the pre-hook block the call rather than relying on the prompt.
04
Answering "where does this live and who owns it"
Anchor the Context Map at a git repo and let clients search it, instead of having each person re-explain the wiring.
3 tools
Listed in project docs. Your client may show a different list.
map_writejira_write_actionsBEFORE YOU INSTALL
What to know first
Tools you get
3 tools named in the project's documentation. The tool set is whatever services the operator configures. With no services connected, admins see only map_read and map_write, and viewer or external roles see none.
INSTALLATION
Connect your client
Server setup
TERMINAL
git clone https://gitlab.com/mcpgate/mcpgate.git && cd mcpgate
docker compose up -d
open http://localhost:8642MCP Clients
Claude Desktop — company-wide
Configure once at claude.ai/admin-settings/connectors with Name: mcpgate and URL: https://<YOUR_GATEWAY_URL>/mcp — the README marks this one "(recommended)".
https://<YOUR_GATEWAY_URL>/mcp is your own gateway's address with /mcp on the end — the project has no shared URL. After the setup wizard at http://localhost:8642, the dashboard shows how to connect your client; Claude.ai and ChatGPT can only reach a gateway on a public HTTPS address.
Claude Code
CLAUDE CODE · TERMINAL
claude mcp add mcpgate https://<YOUR_GATEWAY_URL>/mcp -s user -t httphttps://<YOUR_GATEWAY_URL>/mcp is your own gateway's address with /mcp on the end — the project has no shared URL. After the setup wizard at http://localhost:8642, the dashboard shows how to connect your client; Claude.ai and ChatGPT can only reach a gateway on a public HTTPS address.
ChatGPT
Settings → Apps → Add App → OAuth → enter your MCP URL.
https://<YOUR_GATEWAY_URL>/mcp is your own gateway's address with /mcp on the end — the project has no shared URL. After the setup wizard at http://localhost:8642, the dashboard shows how to connect your client; Claude.ai and ChatGPT can only reach a gateway on a public HTTPS address.
Codex
CODEX · TERMINAL
codex mcp add mcpgate --url https://<YOUR_GATEWAY_URL>/mcphttps://<YOUR_GATEWAY_URL>/mcp is your own gateway's address with /mcp on the end — the project has no shared URL. After the setup wizard at http://localhost:8642, the dashboard shows how to connect your client; Claude.ai and ChatGPT can only reach a gateway on a public HTTPS address.
Gemini CLI
GEMINI CLI · TERMINAL
gemini mcp add --transport http mcpgate https://<YOUR_GATEWAY_URL>/mcphttps://<YOUR_GATEWAY_URL>/mcp is your own gateway's address with /mcp on the end — the project has no shared URL. After the setup wizard at http://localhost:8642, the dashboard shows how to connect your client; Claude.ai and ChatGPT can only reach a gateway on a public HTTPS address.
