MCP Gateway: A Plugin-Based Gateway for Secure AI Infrastructure Orchestration
MCP Gateway is an intermediary solution designed to centralize and enhance interactions between large language models (LLMs) and Model Context Protocol (MCP) servers. Developed by Lasso Security and released in 2025 under the MIT license, it serves as a critical layer for developers focused on testing and red teaming AI systems. Built in Python, MCP Gateway orchestrates multiple MCP servers, providing a unified interface while ensuring security and operational efficiency.
The gateway operates by reading server configurations from a structured mcp.json file located in the root directory. MCP Gateway then manages the lifecycle of these servers, intercepting and sanitizing requests and responses to prevent exposure of sensitive information. This approach ensures that developers can build upon a secure, enterprise-grade foundation for AI agents.
How MCP Gateway Works
MCP Gateway functions as a proxy between LLMs and MCP servers, enabling seamless integration while enforcing security protocols. Its core mechanism involves reading configurations from the mcp.json file, which specifies the MCP servers to be proxied. The gateway then loads these servers, monitors their interactions, and applies security measures such as request and response sanitization.
The gateway supports a plugin-based architecture, allowing developers to enable specific functionalities through command-line arguments. For example, the basic plugin provides token masking for secrets like Hugging Face tokens, AWS access keys, and GitHub OAuth tokens. Other plugins, such as presidio and lasso, offer advanced capabilities such as PII masking, custom policy enforcement, and protection against prompt injection and harmful content. These plugins can be combined or used individually based on the security requirements of the deployment.
It detects hidden instructions, sensitive file patterns, and malicious actions in tool descriptions, assigning a risk score to each server.
The runtool tool executes capabilities from any proxied MCP after sanitizing both the request and response, ensuring that sensitive data remains protected throughout the interaction. This design simplifies the development process by abstracting the complexity of managing multiple MCP servers while maintaining security and compliance.
Use Cases for MCP Gateway
MCP Gateway is primarily designed for developers and security teams engaged in testing and red teaming AI systems. Its ability to orchestrate multiple MCP servers and enforce security policies makes it particularly useful in environments where AI agents interact with sensitive data or external systems.
One key use case is in the development of enterprise-grade AI agents that require strict adherence to security and compliance standards.
Another use case is in red teaming exercises, where security teams simulate attacks to identify vulnerabilities in AI systems. MCP Gateway’s security scanner and plugin-based architecture allow red teams to test the resilience of their AI infrastructure against threats such as prompt injection, data exfiltration, and malicious tool usage. By intercepting and analyzing requests and responses, the gateway provides visibility into potential attack vectors, enabling teams to harden their systems proactively.
Developers working with multiple MCP servers can also benefit from MCP Gateway’s unified interface. Instead of managing separate connections to each server, developers can interact with all MCP servers through a single gateway endpoint.
Plugin-Based Security and Functionality
MCP Gateway’s plugin system is a cornerstone of its flexibility and security. Plugins are modular components that extend the gateway’s capabilities, allowing developers to enable specific features such as token masking, PII detection, or advanced threat protection. The gateway includes several built-in plugins, each addressing different security concerns:
- Basic Plugin: Provides token and secret masking for common credentials, including Azure client secrets, GitHub tokens, AWS access keys, and Hugging Face access tokens.
- Presidio Plugin: Leverages the Presidio library to detect and anonymize PII such as credit card numbers, IP addresses, emails, phone numbers, and Social Security numbers.
- Lasso Plugin: Integrates with Lasso Security’s API to enforce advanced AI safety guardrails, including protection against prompt injection, harmful content, and custom policy violations. The Lasso plugin checks content through Lasso’s API before processing requests and responses, ensuring real-time mitigation of GenAI-specific threats. To use this plugin, developers must obtain a Lasso API key and configure it in the mcp.json file or as an environment variable.
Security Scanner for Proactive Risk Mitigation
- Automatic Blocking: Servers that fail security analysis due to low reputation scores or detected risks are automatically blocked from being loaded. This proactive approach minimizes the risk of integrating compromised or malicious MCP servers into the AI infrastructure.
Dynamic Capability Registration and Unified Interface
MCP Gateway introduces dynamic capability registration, which automatically discovers and exposes all tools from proxied MCP servers as native gateway capabilities. This feature eliminates the need for developers to manually invoke generic proxy methods, simplifying interactions with MCP servers.
This approach improves discoverability and maintainability while ensuring that all proxied tools benefit from the gateway’s security and sanitization features.
The gateway also provides a unified interface for discovering and interacting with all proxied MCP servers. Meanwhile, the runtool tool executes capabilities from any proxied MCP after sanitizing requests and responses, ensuring that sensitive data remains protected throughout the interaction.
Tracing and Monitoring with Xetrack
MCP Gateway supports tracing and monitoring capabilities through the xetrack plugin, which provides lightweight tracking of ML experiments, benchmarks, and structured data. This plugin allows developers to debug and monitor tool calls by logging events to a SQLite database or flat files.
- Event Logging: All tool calls and responses are logged in an events table within the SQLite database, providing a structured record of interactions for audit and debugging purposes.
- Configuration Options: Developers can customize the logging behavior by specifying paths for the SQLite database (XETRACKDBPATH) and logs (XETRACKLOGSPATH). Additional options, such as FLATTENARGUMENTS and FLATTENRESPONSE, control whether arguments and responses are flattened for easier analysis.
The xetrack plugin is particularly useful for developers who need to monitor the behavior of AI agents and ensure that tool calls adhere to expected patterns. By providing visibility into the data flow between LLMs and MCP servers, the plugin helps identify anomalies or security issues in real time.
Version-Specific Improvements
- This release also included comprehensive logging for audit and debugging purposes.
Installation and Deployment
MCP Gateway can be installed and deployed using Python or Docker, depending on the requirements of the environment. The Python installation is recommended for most use cases and involves installing the package via pip:
To configure the gateway, developers must specify the path to the mcp.json file using the --mcp-json-path argument and enable the desired plugins with the -p or --plugin argument. For example, the following command starts the gateway with the basic and xetrack plugins enabled:
The Docker image supports optional dependencies for specific plugins, such as presidio or xetrack, which can be enabled during the build process using the INSTALLEXTRAS argument.
docker build -t mcp/gateway . --build-arg INSTALLEXTRAS=presidio,xetrack
Example Configurations
Below are examples of configuration files for different environments:
"command": "mcp-gateway",
"~/.cursor/mcp.json",
"-e", "LASSOAPIKEY= ",
The flexibility of the configuration system allows developers to tailor the gateway to their specific needs while maintaining security and compliance.