Secure MCP Gateway

A secure gateway for proxying and managing access to Model Context Protocol (MCP) servers with JWT authentication, RBAC policy enforcement, and comprehensive auditing capabilities.

Overview

The Secure MCP Gateway acts as a security and governance layer between AI agents and MCP servers. It does not manage or execute tools itself - instead, it provides:

• Authentication - JWT/Keycloak token validation with JWKS
• Authorization - YAML-based RBAC policies with Casbin
• Proxying - Secure forwarding of requests to pre-built MCP servers
• Auditing - Structured JSON logs of all operations

Architecture

AI Agent (with JWT) → Gateway (Auth + Policy + Audit) → Pre-built MCP Server → Tools

The gateway is a pure proxy - MCP servers are pre-built and registered with the gateway for secure access.

Features

• 🔐 JWT Authentication - Keycloak integration with JWKS validation and token caching
• 🛡️ RBAC Policy Engine - Flexible, YAML-based policies using Casbin
• 🔄 MCP Server Proxy - Forward requests to configured MCP servers
• 📝 Structured Audit Logging - JSON-formatted logs to file and/or stdout
• 🐳 Container Ready - Docker and docker-compose support
• 🛠️ CLI Tool - Easy management with datacline command

Project Structure

secure-mcp-gateway/
├── server/
│   ├── main.py                 # FastAPI application entry point
│   ├── models.py               # Pydantic data models
│   ├── config.py               # Configuration management
│   ├── auth.py                 # JWT authentication & validation
│   ├── mcp_proxy.py            # MCP server proxy engine
│   ├── routes/
│   │   └── mcp.py              # MCP proxy API endpoints
│   ├── policies/
│   │   └── policy_engine.py    # Casbin RBAC engine
│   ├── sandbox/
│   │   └── runner.py           # Tool execution (legacy)
│   ├── audit/
│   │   └── logger.py           # Structured audit logging
│   └── db.py                   # Database layer (SQLAlchemy)
├── cli/
│   └── datacline.py            # CLI management tool
├── policies/
│   └── policy.yaml             # RBAC policy configuration
├── examples/                   # Example configurations
├── tests/
├── Dockerfile
├── docker-compose.yml
├── mcp_servers.yaml            # MCP server registry
├── .env.example
├── requirements.txt
└── README.md

Installation

Option 1: Docker (Recommended)

# Clone the repository
git clone https://github.com/yourusername/secure-mcp-gateway.git
cd secure-mcp-gateway

# Start the entire stack (Gateway + Keycloak + PostgreSQL + Mock MCP Server)
docker-compose up

The gateway will be available at http://localhost:8000 Keycloak admin console at http://localhost:8080 (admin/admin)

Option 2: Local Development

# Clone the repository
git clone https://github.com/yourusername/secure-mcp-gateway.git
cd secure-mcp-gateway

# Install dependencies
pip install -r requirements.txt