Self-hosted MCP gateway

Your AI, connected to every tool your company works with.

Ask once: it reads the Jira ticket, checks the logs in Grafana, and posts the answer to Slack. One secure endpoint for Claude, Codex, ChatGPT and Gemini.

  • PII pseudonymized before the model sees it
  • Grounded in your company’s context
  • 50+ connectors, plus your own APIs
  • Every tool call audited, with pseudonymized actors
  • Your keys: AES-256 encryption at rest, optional Cloud KMS
See how it works Install

Free for up to 5 users.

Confluence Jira M365 Notion Slack … +41 more Figma Workspace GitLab You + AIclient HubSpot Grafana

More productivity. Less copy & paste.

Your AI works across your company’s tools, knows your context and finishes the task — without switching tabs or moving information between systems by hand.

Context in: chains across your tool stack in one prompt

The AI knows which Jira ticket links to which MR links to which Slack thread. One prompt, no tab switching, no copy-paste.

# "What's blocking the Q2 release?"

jira: PBE-2674 → blocked by PBE-2701
gitlab: MR !891 awaiting review
slack: thread in #release, 14:32

# Answer assembled. No copy-paste.

Safe action: Markdown to ADF, project templates, link-back — automatic

Pre-hooks apply Jira project templates, convert Markdown to Atlassian Document Format, link the ticket back to the Slack thread. The AI writes prose; the gateway handles the schema.

mcpgate 14:32
Created PBE-2842 from your Slack thread. Markdown converted to Jira ADF, project template applied, linked back to #release.
Open in Jira

Reins & receipts: audit, sanitization, exfiltration alerts

PII pseudonymized before the model sees it, rehydrated for the real tool call. Every action — with its byte volume — lands in the audit log; a 50 MB spike at 3 am is visible, not invisible.

  • Role-based access — admin / internal / external / viewer, per-user audit
  • Whole-document release — sensitive terms stripped in the browser before the AI sees contracts or HR files
  • Destructive actions gated — admin approval the AI can’t self‑grant

Ever gotten a confident answer that was just wrong?

Confidence — how sure it sounds Actual quality — needs context the gap = overconfidence gap persists it often parks here — it doesn't feel the need to look things up Context / data the AI has → level (low → high)
An answer sounds just as sure whether it's grounded or guessing. Without your context the AI parks at high confidence, low quality — the gap is overconfidence, and it never fully closes.
shared (company) + personal context moves you right Confidence Actual quality Context / grounding →
Two layers close it: a shared, curated company map moves every answer right, and personal context moves it further — quality climbs toward confidence. The gap shrinks; it doesn't vanish, and we don't pretend it does.

An answer sounds just as sure whether it's grounded in your reality or guessing. Without context, the AI parks at high confidence, low quality — that gap is overconfidence.

A shared, curated company map moves every answer right; personal context moves it further — quality climbs toward confidence. The gap shrinks; it doesn't vanish, and we don't pretend it does.

Your AI knows what exists — not just what changed

Chaining tools answers what is the state of X right now. It cannot answer what even exists, where does it live, who owns it — that sits in nobody’s API, because it is spread across repos, wikis and the heads of the people who built it.

The Context Map is that answer: a small set of curated Markdown pages in a git repo, served to every connected AI client. Each repo can carry its own page, so the map grows where the work happens. A human stands behind every page — it stays small on purpose, because a map that tries to be the documentation stops being a map.

Pages follow the Open Knowledge Format (OKF v0.2), so the same directory reads as a plain wiki for people and as structured context for agents. Point the gateway at any repository that ships an OKF bundle and its pages join your map. Why a map and not RAG →

# the index every client loads first

Domains: billing · platform · infra · support
Kinds:   Repository (20) · Reference (13)
         Playbook (2) · API (2)

# "who owns the billing service?"
# -> one page, not a similarity search

Automations run through the same door

Not just Windmill: whatever runs your automation connects as a service-account user and acts on your behalf through the same door — no credentials handed to the automation platform.

The same governed door — with or without you ANY TRIGGER You ask in your AI client It just runs on a schedule or event Windmill · n8n · cron · your agent mcpgate acts as you (OAuth) · policy · audit no tokens leave the gateway YOUR TOOLS …and the rest of your stack
An automation isn't a side door. Whatever triggers it — you, a schedule, another agent — it runs through the same harness: your identity by OAuth delegation, the same policy and audit, and not one service token ever leaves the gateway.

Works with Claude, ChatGPT, Codex, Gemini — any MCP client. One admin connects it once; the whole team gets it, with per-client consent.

Source-available — read what runs Self-hosted Stores nothing in transit No cookies, no analytics

Room for the right context

Fewer tokens per connected tool. Plus per-action audit, PII scrubbing and policy hooks raw MCP doesn’t give you. Drag to model your own stack:

How much context do your connected tools cost?
Direct MCP — curated tools resident
–
tokens, re-sent every turn
Via the gateway — resident
–
tokens — flat per service

Full calculator & method →

Speaking of the right context — only a lean set of tools stays resident. The rest — thousands of actions across every connected service — stay out of your window, discovered on demand via search when the AI needs them. That’s why each added service costs ~550 tokens here, not 11k.

Read first

All posts →
10 min read · Compliance

What flows through, what gets blocked, what gets logged

Audit, PII sanitization, throughput as a DLP lens, policy hooks — four layers stacked on the same audit trail. How they fit together, and the data-exfiltration signal you do not want to be missing.

Read →
9 min read · Engineering

Dynamic action discovery isn’t novel. Doing it safely is.

Anthropic shipped Tool Search in November 2025. mcpproxy-go has BM25. Stacklok benchmarks 94% retrieval. What the gateway market converged on, and what mcpgate chose differently.

Read →
8 min read · Comparison

mcpgate vs Obot: which self-hosted MCP gateway?

Side-by-side: where Obot is the better choice (maturity, MIT license, Kubernetes day one), where mcpgate is (PII pseudonymization, two-layer policy hooks).

Read →

Boringly simple to run

One command — a browser wizard does the rest: login, pick your services, connect your AI. That’s the whole setup — the harness is the part we already built. No .env file needed.

# one command — reviewable, runs on your infra
$ curl -fsSL https://mcpgate.de/install.sh | bash

# then open localhost:8642 — the wizard does the rest
Full quickstart →

Try mcpgate now

Explore the full gateway with demo data. No signup, no install, no credit card.

Try the Demo Install Self-Hosted