I built an open-source security gateway for MCP servers — auth, RBAC, audit logging, and policy enforcement through a single endpoint

After the OpenClaw report from Trail of Bits highlighted how MCP servers have zero trust boundaries, I decided to build something to fix it.

MCP Gateway sits between your AI clients (Claude, Cursor, VS Code, etc.) and your MCP servers. Instead of each client connecting to each server directly with no oversight, everything goes through the gateway.

What it does:

• Single endpoint — all your MCP servers aggregated behind one URL. Configure your AI client once, get access to everything.
• Authentication — JWT + API keys (scoped per-application, so Claude Desktop and Cursor get separate keys)
• RBAC — owner/operator/viewer roles with tool-level permissions
• Policy engine — priority-ordered allow/deny rules with glob patterns. Block destructive tools for non-admins, restrict by risk category, match per-application.
• Audit logging — every tool call recorded with timestamps, user, tool, backend, duration, status, and configurable payload redaction
• Risk classification — tools auto-categorized as read/write/admin/external-api
• Remote agent — run MCP servers on your laptop, expose them to the gateway over a single WebSocket. TUI dashboard included.
• Admin dashboard — React UI for managing everything

Tech: Rust/Axum server, React/TypeScript dashboard, PostgreSQL. Deploys with docker compose up.

GitHub: https://github.com/SidPad03/unified-mcp-gateway

Likes, reposts, or any engagement with my LinkedIn Post would be greatly appreciated: https://www.linkedin.com/posts/sidpad03_github-sidpad03unified-mcp-gateway-activity-7441278660763869184-L8eJ?utm_source=share&utm_medium=member_desktop&rcm=ACoAADFjQFgBxxS1uYsQCACtPZnQUhavIxsGi2Y

Happy to answer questions or take feedback. :)