# mcp-host-gateway

A hosted MCP edge: bearer auth, per-plan tool grants and rate limits in front of Streamable HTTP MCP servers.

A gateway in front of Streamable HTTP MCP servers. It verifies bearer tokens, maps callers to plans, checks grants for tools, prompts and resources, applies per-identity rate limits and forwards permitted calls. The current version includes a shared rate store, streaming SSE relay and a single-VPS deployment recipe. It has no product logic of its own and fails closed when auth or upstream configuration is incomplete.

Source: https://github.com/SarutobiSasuke8/mcp-host-gateway
Docs: https://github.com/SarutobiSasuke8/mcp-host-gateway#readme
Listing: https://mcprack.dev/servers/mcp-host-gateway/
Status: alpha
Transport: Streamable HTTP
License: MIT
Review: not yet recorded
Package: Source only

## Highlights

- Bearer JWT verification against the issuer's JWKS, or static tokens for development
- Plan-based grants for tools, prompts and resources, with list responses filtered to the caller's access
- Per-identity rate limits backed by a shared store, with clear 401, 403 and 429 errors
- Streaming SSE relay, a container build and body-free audit records

## Current limitations

- Version 0.1.0 on main. Deploy-only: not published to npm, not tagged, and no public service has been verified.
- Its deployment recipe targets one VPS. A separate issuer and upstream service are still required.

## Setup

No install command recorded; consult the repository.

Check prerequisites, permissions and current versions. Inclusion is not an independent security audit.