Cubiczan/governed-mcp-gateway

Overview

A TypeScript gateway for Model Context Protocol (MCP) that enforces governance on tool calls and SSE frames. It attaches a principal to each call, rotates credentials from a vault, and restricts tools via allowlists.

Best for

Best for
Teams needing governance and credential rotation for MCP deployments

Use cases

• Enforce per-user authorization on MCP tool calls
• Rotate credentials for MCP servers from a vault
• Restrict available tools to a defined allowlist

How to use

Tools exposed

• GATEWAY_AGENT_KEY
• GATEWAY_HUMAN_KEY
• GATEWAY_RESEARCH_KEY
• SPEND_PLANE_URL

Notes

A TypeScript gateway for Model Context Protocol (MCP) that enforces governance on tool calls and SSE frames. It attaches a principal to each call, rotates credentials from a vault, and restricts tools via allowlists.

0 stars on GitHub. Last updated 2026-09-08. Licensed MIT.

Use cases

• Enforce per-user authorization on MCP tool calls
• Rotate credentials for MCP servers from a vault
• Restrict available tools to a defined allowlist

Pros

• Explicit principal on every call aids auditability
• Vaulted credential rotation reduces long-lived secrets
• Tool allowlists provide a simple access control model

Cons

• No stars or community traction yet
• Requires running and maintaining a gateway component
• Limited information beyond the listed features

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.