Cursor's 40-tool limit and OpenAI's 128-function cap are the reason this exists, and the fix is a discovery step: the agent asks for what it needs in keywords and gets back a handful of matches. Splitting the call into read, write and destructive variants is the part that matters for review — the proxy knows which one an agent reached for, and the activity log records it. New servers land in quarantine until you approve them, which is the right default for a proxy that federates other people's code.
A federating proxy: one endpoint in front of every MCP server you use, with a search step so the agent loads only the tools it needs for the task at hand.
- retrieve_tools — BM25 search across every connected server, returning the top matches with a hint about which call variant to use
- call_tool_read, call_tool_write and call_tool_destructive — the three call variants, split by what the tool actually does
- upstream_servers for managing the connected servers, and code_execution for JavaScript orchestration
- Routing modes on separate paths: /mcp/call for search-then-call, /mcp/all to expose every upstream tool directly as serverName__toolName, and /mcp/code for the orchestration mode
- Automatic quarantine of newly added servers until you approve them, which blocks tool poisoning
- Pluggable Docker-based security scanners — Snyk, Semgrep, Trivy, Cisco — run against quarantined servers, with findings normalised to SARIF and a composite risk score
- An embedded web UI in the binary, with a server dashboard, activity log and sensitive-data detection
- An optional macOS menu-bar app for start/stop, health, quarantine and logs
A single binary for macOS, Windows and Linux — DMG and Windows installers, Homebrew cask or formula, apt and dnf repositories with a hardened systemd unit, or the AUR. Servers are listed in a JSON config with a name and either a command or a URL. Connect a client to http://localhost:8080/mcp/ over HTTP.
One command — go install github.com/smart-mcp-proxy/mcpproxy-go/cmd/mcpproxy@latest