sagemcp

Sage MCP is a multi-tenant platform for hosting and managing MCP (Model Context Protocol) servers with connector plugins, tenant isolation, and built-in OAuth 2.0 / API-key authentication. It provides a web UI and CLI to configure tenants/connectors and exposes MCP transport via HTTP/WebSocket/SSE with session management and rate limiting.

Evaluated Mar 30, 2026 (21d ago)

Repo ↗ API Gateway mcp multi-tenant fastapi oauth api-key-auth rate-limiting observability websocket sse stdio-subprocess

⚙ Agent Friendliness

/ 100

Can an agent use this?

🔒 Security

/ 100

Is it safe for agents?

⚡ Reliability

/ 100

Does it work consistently?

Score Breakdown

⚙ Agent Friendliness

MCP Quality

Documentation

Error Messages

Auth Simplicity

Rate Limits

🔒 Security

TLS Enforcement

Auth Strength

Scope Granularity

Dep. Hygiene

Secret Handling

Claims include encryption at rest for OAuth tokens/API keys/connector credentials (Fernet/AES with key derived from SECRET_KEY), API-key auth with bcrypt-hashed storage and scope tiers, and transport security controls (CORS origin validation, Content-Type enforcement, per-tenant token-bucket rate limiting). The provided content does not document TLS-infrastructure details (e.g., whether HTTPS is enforced by default) or provide evidence of dependency audit/CVE status.

⚡ Reliability

Uptime/SLA

Version Stability

Breaking Changes

Error Recovery

Best When

You need a self-hosted, multi-tenant MCP gateway with connector management, OAuth/API-key security controls, and operational tooling.

Avoid When

You only need a single simple MCP server without tenant isolation or centralized connector management.

Use Cases

• Running MCP servers for Claude Desktop across multiple tenants with isolation
• Connecting MCP tools to external SaaS APIs (e.g., GitHub, Slack, Jira) via OAuth
• Hosting external MCP servers via stdio (subprocess connectors)
• Centralized management of connector enable/disable policies and tool access
• Adding observability (Prometheus metrics, structured JSON logs) and operational health probes

Not For

• End-user SaaS where managed hosting is required (appears self-hosted/infra-focused)
• Environments that require strict, independently verifiable compliance/security attestations not documented here
• Teams that cannot operate Docker/PostgreSQL and manage OAuth credentials

Interface

REST API

Yes

GraphQL

gRPC

MCP Server

Yes

SDK

Webhooks

OpenAPI Spec ↗

Authentication

Methods: OAuth 2.0 (tenant-level and user-level tokens) API key authentication (scope tiers: platform_admin, tenant_admin, tenant_user)

OAuth: Yes Scopes: Yes

Authentication is described as feature-flagged via SAGEMCP_ENABLE_AUTH and supports encrypted storage of OAuth tokens/API keys. Specific token lifetimes and refresh behavior are not described in the provided content.

Pricing

Free tier: No

Requires CC: No

No hosted pricing information is provided; repository appears self-hosted.

Agent Metadata

Pagination

none

Idempotent

False

Retry Guidance

Not documented

Known Gotchas

⚠ Auth appears feature-flagged (SAGEMCP_ENABLE_AUTH). If disabled, agent calls may fail or bypass intended protections.
⚠ Rate limiting is tenant-scoped (token-bucket RPM). Agents may need to throttle to avoid 429s (exact headers/format not shown).
⚠ Multiple MCP transports (HTTP/WS/SSE) and session replay (Mcp-Session-Id) may require correct handling of session IDs for long-running tool streams.

Alternatives

Direct self-hosting of individual MCP servers without a multi-tenant gateway Community MCP servers + custom reverse proxy/auth layer Other MCP gateway/proxy solutions (if available) that integrate auth and routing

Full Evaluation Report

Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for sagemcp.

AI-powered analysis · PDF + markdown · Delivered within 30 minutes

$99

Package Brief

Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.

Delivered within 10 minutes

Score Monitoring

Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.

Continuous monitoring

$3/mo

API endpoint ↗ Agent guide ↗ Report inaccuracy

Scores are editorial opinions as of 2026-03-30.