Secure MCP Gateway MCP Server

A secure, open-source OAuth gateway for MCP authentication. Exposed over MCP by the secure mcp gateway mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.

What it actually does

• Self-Hosted Gateway — Deploy within your own infrastructure for maximum control
• OAuth Authentication — Secure authentication with any OAuth provider via Auth.js
• TypeScript Support — Fully typed for robust development
• STDIO — Standard input/output MCP servers
• StreamableHTTP — HTTP-based streaming connections via http://localhost:3000/mcp (or https:///mcp for hosted deployments)

Adding it to your client

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

Its toolset

Everything the assistant can do here goes through one of these:

• Self — Hosted Gateway**: Deploy within your own infrastructure for maximum control
• STDIO — Standard input/output MCP servers
• StreamableHTTP — HTTP-based streaming connections via http://localhost:3000/mcp (or https:///mcp for hosted deployments)
• repo — Full access to repositories (public and private)
• public_repo — Access to public repositories only
• read — user - Read access to user profile information
• user — email - Access to user email addresses
• Enterprise — grade Security**: Advanced SSO authentication for all MCP interactions
• PORT — Server port
• BASE_URL — Base URL for the gateway
• AUTH_SECRET — Secret for signing/encrypting tokens (generate with openssl rand -base64 33)
• AUTH_PROVIDER — OAuth provider name

Configuration

You will need 8 environment variables: API_KEY, BASE_URL, AUTH_SECRET, AUTH_GOOGLE_ID, AUTH_GOOGLE_SECRET, AUTH_OKTA_ID, AUTH_OKTA_SECRET, AUTH_AZURE_AD_ID. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Caveats

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Secure MCP Gateway.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the secure mcp gateway mcp server does with a few real requests.

When to reach for it

This sits in the cloud and infrastructure group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Secure MCP Gateway's toolset — Self, STDIO, StreamableHTTP and 11 more — is a fair guide to whether it matches your workflow. It is maintained by mcp-s-ai; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.