{"id":"enkryptai-secure-mcp-gateway","name":"secure-mcp-gateway","homepage":"https://www.enkryptai.com/","repo_url":"https://github.com/enkryptai/secure-mcp-gateway","category":"infrastructure","subcategories":[],"tags":["mcp","gateway","guardrails","authentication","tool-discovery","caching","logging","python"],"what_it_does":"secure-mcp-gateway is a Python-based gateway that sits between an MCP client and one or more MCP servers. It authenticates MCP client connections, discovers and caches tools exposed by MCP servers, optionally restricts which tools may be invoked, and can enforce input/output “guardrails” (e.g., injection/toxicity/PII handling) before forwarding requests and after returning responses. It also provides an administrative REST API secured by a generated admin API key (described in README).","use_cases":["Proxying MCP servers through a single gateway endpoint for added security controls","Restricting tool exposure to an MCP client based on allowlists in gateway configuration","Applying guardrails to MCP tool inputs and outputs (PII redaction, injection/toxicity checks, policy checks)","Centralized logging and auditability of tool calls through the gateway","Caching discovered MCP tools and configuration to reduce repeated discovery overhead"],"not_for":["Environments that cannot operate a long-running gateway process/service","Organizations requiring a fully offline setup with no external vendor dependencies (the guardrails flow references Enkrypt services)","Use cases needing a standardized REST/GraphQL API for business functionality beyond the described administrative endpoints"],"best_when":"You want to mitigate common security issues from using MCP tools by adding authentication, tool allowlisting, guardrails, and caching at a single choke point between MCP clients and MCP servers.","avoid_when":"You need guaranteed, documented support for complex failure recovery, idempotency guarantees, or you cannot tolerate potential latency added by guardrail checks and tool discovery/caching.","alternatives":["Using an MCP client with server-side policies/guardrails implemented directly in each MCP server (custom MCP server middleware)","Running an API gateway/reverse proxy pattern (if applicable) plus separate application-layer guardrail middleware around MCP calls","Other MCP gateways or security middleware solutions (if available in your ecosystem)"],"af_score":50.2,"security_score":60.2,"reliability_score":22.5,"package_type":"mcp_server","discovery_source":["github"],"priority":"high","status":"evaluated","version_evaluated":null,"last_evaluated":"2026-03-30T15:21:50.596555+00:00","interface":{"has_rest_api":true,"has_graphql":false,"has_grpc":false,"has_mcp_server":true,"mcp_server_url":null,"has_sdk":false,"sdk_languages":[],"openapi_spec_url":null,"webhooks":false},"auth":{"methods":["API key authentication for MCP client connections (\"Unique Key\")","Admin API operations protected by generated admin_apikey (256-character random string)","Optional Enkrypt API key usage for Enkrypt Guardrails integration"],"oauth":false,"scopes":false,"notes":"The README describes a unique gateway key for authenticating MCP client connections and a separately generated long admin API key for administrative REST API operations. It does not describe OAuth or explicit scope granularity for API keys."},"pricing":{"model":null,"free_tier_exists":false,"free_tier_limits":null,"paid_tiers":[],"requires_credit_card":false,"estimated_workload_costs":null,"notes":"README suggests Enkrypt account creation for guardrails is free and no credit card is required; however, the README does not provide concrete pricing tiers/limits for guardrails usage within this package."},"requirements":{"requires_signup":true,"requires_credit_card":false,"domain_verification":false,"data_residency":[],"compliance":[],"min_contract":null},"agent_readiness":{"af_score":50.2,"security_score":60.2,"reliability_score":22.5,"mcp_server_quality":75.0,"documentation_accuracy":55.0,"error_message_quality":0.0,"error_message_notes":"README provides at least one sample CLI/initialization error message (e.g., \"Gateway key is required\"), but it does not document a complete error model/codes for the MCP and REST interfaces.","auth_complexity":70.0,"rate_limit_clarity":10.0,"tls_enforcement":70.0,"auth_strength":75.0,"scope_granularity":40.0,"dependency_hygiene":50.0,"secret_handling":60.0,"security_notes":"Strengths claimed/described include authentication for MCP client connections, admin_apikey generation, tool invocation restriction via allowlists, and input/output guardrails (including injection/toxicity/PII redaction and adherence/relevancy checks). The README does not provide detailed information about TLS enforcement details, key storage practices, scope granularity for API keys, rate limiting, or dependency vulnerability status.","uptime_documented":0.0,"version_stability":30.0,"breaking_changes_history":30.0,"error_recovery":30.0,"idempotency_support":"false","idempotency_notes":"No idempotency semantics for tool calls or administrative operations are described in the provided README content.","pagination_style":"none","retry_guidance_documented":false,"known_agent_gotchas":["Tool discovery is dynamic and may involve caching; agents should be prepared for tool list changes when cache expires.","Guardrails can block requests/responses; agents may need to handle policy-block outcomes.","Gateway configuration and allowed-tools allowlisting must be correct; otherwise tool invocation may be restricted or fail."]}}