Authmcp Gateway

What loglux/authmcp-gateway MCP server does

The loglux/authmcp-gateway MCP server acts as an authenticated proxy and aggregation layer for MCP backends. It presents a single MCP endpoint while forwarding requests to configured servers. The gateway can aggregate tool, resource, prompt, and completion results from multiple backends, then route calls, reads, and gets to the backend that owns the selected item.

Authentication options include OAuth 2.0 Authorization Code flow, Dynamic Client Registration, and JWT-based access tokens. The gateway supports multiple users and role-based access. It can also store backend credentials securely, refresh backend tokens, apply per-user request limits, and record security events.

An administration interface is provided for creating users, configuring backend MCP servers, checking token health, reviewing security events, and running MCP security audits. Monitoring includes request activity, response times, success rates, request volume, and backend health checks.

How it works

After startup, the gateway initializes its database and serves a setup interface for creating an administrator. Administrators add backend MCP servers through the dashboard or the administrative API, providing a name, URL, and optional backend token.

Authenticated clients send MCP JSON-RPC requests to the gateway endpoint. During initialization, the gateway queries connected backends and advertises the capabilities they support. List operations combine results across configured servers, while operations such as reading a resource, retrieving a prompt, completing a request, or calling a tool are routed to the relevant backend.

The gateway targets MCP protocol version 2025-03-26. Authentication and MCP request activity can be logged as JSON files with rotation, while security events remain in SQLite for auditing and queries. CORS protection and request validation are also included.

Setup and configuration

The loglux/authmcp-gateway MCP server can be installed from PyPI with pip install authmcp-gateway. Start it with authmcp-gateway start; the default bind address is 0.0.0.0:8000. The command can accept a custom port, host, or environment file. Additional commands initialize the database, create an administrator, and print the version.

On first run, the application creates a .env file with a JWT signing key when needed, creates its data directory, and initializes the database. The browser setup wizard is available at the local root URL. Docker Compose is also documented; that path uses the repository’s .env.example, starts the container with docker-compose up -d, and exposes the configured host port.

Configuration includes the gateway port, JWT_SECRET_KEY, whether authentication is required, and initial administrator credentials. Backend servers can be added from the dashboard or through the administrative API.

Tools and capabilities

The proxy covers these MCP method groups when supported by connected backends:

• Tools: listing and calling, with prefix, mapping, and automatic-discovery routing.
• Resources: listing, reading, and resource-template listing.
• Prompts: listing and retrieval.
• Completions: completion requests with reference-based routing.
• Dynamic capability discovery during initialization.
• Aggregation across multiple MCP servers.
• OAuth 2.0, Dynamic Client Registration, JWTs, RBAC, and refresh tokens.
• Rate limiting, health checks, activity metrics, and security-event monitoring.

Limitations and notes

The gateway does not provide backend MCP functionality by itself. Its useful operations depend on the servers configured by an administrator and the capabilities those servers advertise. Backend URLs and any required backend tokens must be supplied during configuration.

Authentication is enabled by default in the documented configuration. Operators should set an appropriate JWT signing key and administrator password, or use the generated setup flow. The documented client self-registration behavior is associated with OAuth and DCR; no specific compatibility claim is provided here for Claude Desktop, Cursor, Windsurf, or Cline.

The loglux/authmcp-gateway MCP server is distributed under the MIT license and requires Python 3.11 or newer when installed from PyPI.