Summary

Tool-level selection is the reason to put a proxy in front of your servers.

Five servers behind one endpoint is convenient; picking which of their tools reach the model is what stops the context window filling with tools nobody calls, and the shipped filter middleware exists for exactly that. Environment variable references are the other detail worth noting — secrets resolve from the container's environment at runtime, so they never land in a config file or a git repository.

What it is

An MCP proxy that composes several servers into a single one. You define servers, group them into namespaces, apply middleware, and publish each namespace as an endpoint. Because the result is itself an MCP server, any client can consume it — and MetaMCP is itself a Docker deployment you run.

What you get

Namespaces that group servers, with servers enabled or disabled individually and at tool level, so you can remix a large surface into just the tools a client needs
Endpoints assigned to a namespace and served over SSE, Streamable HTTP, or OpenAPI for clients like Open WebUI — one click to switch which namespace an endpoint points at
Authentication per endpoint: API key in a header or query parameter, or standard OAuth in MCP Spec 2025-06-18
Middleware that intercepts and transforms requests and responses at namespace level, shipping with a filter-inactive-tools example that trims tool context for the model
Tool overrides per namespace: rename, retitle or re-describe a tool and attach custom MCP annotations such as `{ "annotations": { "readOnlyHint": false } }`, merged with what the upstream server returns
A built-in inspector with your saved server configs, so you can debug your own endpoints without a separate tool
Secret handling for STDIO servers: raw values, `${ENV_VAR_NAME}` references resolved from the container's environment at runtime, or auto-matching by name so nothing goes in the config at all

Requirements

Docker. Clone the repository, copy `example.env` to `.env`, and `docker compose up -d`; CORS is enforced against `APP_URL`, so access it only from that address. Local development with pnpm and a Postgres container is supported, as are Dev Containers in VSCode or Cursor. Tools, resources and prompts are all supported, and OAuth-enabled upstream servers have been tested. MIT licensed.

Setup effort

Run a container — pull the image and point your client at it