← Back to directory
M

MCPProxy

Community
Gateway / proxy
Local-first MCP proxy with BM25 tool discovery, security scanning, quarantine & ~99% token savings

This gateway aggregates or proxies other MCP servers; it only becomes useful once you connect real servers behind it.

Category
Dev Tools #95 of 438
Stars
★ 405 Very popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Prebuilt binary
Credentials
No credential needed
License
MIT
Last commit
Tools
5
62FMRS · C

MCPProxy is a local-first MCP proxy written in Go whose purpose is to provide one safe endpoint in front of all upstream MCP servers. Its standout capabilities are BM25 tool discovery (retrieve_tools) for large context savings, quarantine of new servers to block Tool Poisoning Attacks, pluggable Docker-based security scanners, and a local, auditable Activity Log. The core is a single binary with an embedded web UI, cross-platform for macOS, Linux and Windows, with an optional macOS menu-bar app. Note that it is a third-party proxy, not an official protocol implementation; it runs locally, inspects tool arguments and results, and executes commands from your config, so config trust and local permission boundaries are the key risks. Best suited to teams with many tools that care about security and token cost.

Strongest · Documentation 16/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
12/20
Maintenance
13/20
Documentation
16/20
Setup experience
13/20
Why each score
Reliability 8/20
Static review only, based on the supplied README and server.json. Evidence shows a single binary for macOS/Linux/Windows, a unit-tests.yml build badge, and documented targets (make test, make test-e2e, make lint), implying CI and test presence; the core flow (serve → mcpServers config → client connect → retrieve_tools discovery → call_tool_* with intent) is described coherently, with diagnosable exit codes (0/10/11/12) and --log-level=debug. However, no actual workflow files, no committed test files, no schema/migration versioning, and an empty packages array in the manifest are provided, so tool-vs-behavior conformance and edge cases (OAuth expiry, upstream startup failure) cannot be verified. Per static calibration, missing evidence is a deduction, not a best-case assumption. Score 8.
Security and permissions 12/20
The documentation states strong security intent: default bind 127.0.0.1:8080, local-first design, HTTP default with optional HTTPS, automatic quarantine for new servers against tool poisoning, pluggable Docker scanners (Snyk/Semgrep/Trivy) normalized to SARIF, intent-declared calls validated against annotations (read/write/destructive), sensitive-data detection, keyring integration, agent tokens, and an Activity Log for audit. No real tokens or secrets appear in install examples, and no evidence of malware, credential theft, or covert exfiltration was found, so no red line is triggered. Deductions: plaintext HTTP is the documented default and explicitly recommended for most users; examples pull npx mcp-remote without version pinning; mcpproxy trust-cert installs a self-signed CA into the system keychain (side effect) with no documented removal path; running third-party Docker scanner images has an undeclared trust boundary; no least-privilege matrix or explicit confirmation detail for destructive operations. Score 12.
Maintenance 13/20
Evidence includes an MIT license, OpenSSF Scorecard badge, semantic versioning (server.json 0.33.1, suggesting frequent iteration), broad release channels (DMG, Windows installer, Homebrew cask/formula, apt/dnf repos with a published signing key fingerprint, AUR, go install), and contributor docs (make dev-setup, prek pre-commit/pre-push hooks with stated duties). Activity signals are favorable, but commit cadence, issue response time, dependency-update automation, security-response channel (SECURITY.md), and governance/ownership cannot be confirmed from the material; 24 open issues with no response evidence. Score 13.
Documentation 16/20
Documentation is layered: multi-platform/multi-method install, quick start, config example (mcp_config.json with stdio and http upstreams), client setup examples (Cursor one-click and manual, Claude Desktop HTTP and HTTPS with NODE_EXTRA_CA_CERTS), HTTPS certificate management and troubleshooting, CLI commands, REST/MCP protocol links, and feature pages (search/discovery, quarantine, scanner plugins, Docker isolation, keyring, OAuth, activity log, preflight, agent tokens, sensitive-data detection). Some limits are disclosed (TLS optional, prerelease instability, preflight exit semantics). Gaps: no parameter-level tool schemas, no rate/cost guidance, no uninstall or CA-removal steps, no consolidated known-limitations list, and heavy reliance on an external site rather than reviewable files. Score 16.
Setup experience 13/20
The path is clear: single-binary install (DMG/installer/brew/apt/dnf/AUR/go install), mcpproxy serve on :8080, edit ~/.mcpproxy/mcp_config.json to add upstreams, one-click and manual JSON for Cursor, and an npx mcp-remote config for Claude Desktop, with coverage of macOS/Linux/Windows on x64/ARM64. Deductions: many distribution variants (tray app + embedded web UI) create choice overhead; apt/dnf require manual repo and keyring setup; the signing key fingerprint must be compared by hand; no execution evidence validates the one-click installer; and the Go 1.26+ prerequisite is high. Capped at 15 by static calibration; score 13.

Static review · not runListed 2026-09-18

Read the FMRS scoring method →

Fit and risk

What it can accessRuns commands or codeUses the network

Best for

  • Developers and teams that need a unified, secure entry point in front of many MCP servers
  • Security-conscious users worried about Tool Poisoning Attacks who want new servers quarantined by default
  • AI agent users limited by context windows or client tool caps who want large token savings

Not for

  • Users who want a fully cloud-hosted setup and will not run a local proxy
  • Lightweight setups connecting only one or two simple MCP servers where discovery, quarantine and auditing add no value
  • Environments where running a Go binary or local service is not possible

Required permissions

  • Read and write the local config directory ~/.mcpproxy/ (mcp_config.json, certificates, activity logs)
  • Listen on a local HTTP port (127.0.0.1:8080 by default)
  • Spawn local stdio upstream MCP servers using the commands in your configuration
  • Connect to remote HTTP upstream servers as configured, potentially including OAuth login
  • If HTTPS is enabled, add a self-signed CA certificate to the system keychain via mcpproxy trust-cert
  • If third-party scanners are enabled, a working Docker environment is required

Risks and side effects

  • The proxy becomes the single channel for all upstream tools, so a misconfiguration could expose tools the agent should not reach
  • The proxy inspects tool arguments and responses for sensitive data, and sensitive content may end up in the local activity log
  • Quarantine blocks new servers, but an already-approved server that later changes still requires re-approval (the README notes tool changes trigger blocking)
  • Spawning stdio upstreams means the proxy can execute the commands in your config, so the config source must be trusted
  • HTTPS uses self-signed certificates that must be manually trusted, otherwise clients fail to connect

Setup

Before you start

Runtime:Prebuilt binary

Other optional settings (2)
MCPPROXY_TLS_ENABLED optional Set to true to enable HTTPS, via env var or in ~/.mcpproxy/mcp_config.; optional.
NODE_EXTRA_CA_CERTS optional For Claude Desktop over HTTPS, points to ~/.mcpproxy/certs/ca.pem to trust the local CA; only needed for the HTTPS setup.

1) Install: on macOS download the DMG or use Homebrew (brew install --cask smart-mcp-proxy/mcpproxy/mcpproxy for the menu-bar app, brew install smart-mcp-proxy/mcpproxy/mcpproxy for the CLI only); on Windows download the installer; on Linux use the apt or dnf repository, the AUR package mcpproxy-bin, or a tarball. With Go 1.26+ you can run go install github.com/smart-mcp-proxy/mcpproxy-go/cmd/mcpproxy@latest. 2) Run mcpproxy serve, which starts an HTTP server on :8080. 3) Edit ~/.mcpproxy/mcp_config.json and add upstream servers under mcpServers (local stdio or remote http). 4) Connect your IDE/client as an MCP server: in Cursor add an MCP server with type http and url http://localhost:8080/mcp/; for Claude Desktop use npx -y mcp-remote http://localhost:8080/mcp. Optional: enable HTTPS (MCPPROXY_TLS_ENABLED=true or tls.enabled in config) and trust the certificate with mcpproxy trust-cert.

.cursor/mcp.json
{
  "mcpServers": {
    "MCPProxy": {
      "type": "http",
      "url": "http://localhost:8080/mcp/"
    }
  }
}

Shown for Cursor. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "MCPProxy": {
      "type": "http",
      "url": "http://localhost:8080/mcp/"
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add --transport http MCPProxy http://localhost:8080/mcp/

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

Run mcpproxy serve, point your client at http://localhost:8080/mcp/, and confirm the built-in tools such as retrieve_tools and describe_tool appear in the tool list; alternatively check mcpproxy activity list for logged calls.

Troubleshooting

  1. Client cannot connect: confirm mcpproxy serve is running, port 8080 is free, and check the service with curl http://localhost:8080/api/v1/status
  2. HTTPS connection fails: enable TLS (MCPPROXY_TLS_ENABLED=true or tls.enabled), re-trust with mcpproxy trust-cert --force, and verify ca.pem, server.pem and server-key.pem exist under ~/.mcpproxy/certs/
  3. Claude Desktop certificate errors: make sure NODE_EXTRA_CA_CERTS points to the correct ca.pem and restart Claude Desktop afterwards
  4. Tools are missing: new servers are quarantined by default and must be approved in the web UI or via security commands; also check that enabled is true in mcp_config.json
  5. Automations fail: run mcpproxy tools preflight; exit code 10 means a transient issue (server starting), 11 means blocked and needing a human, 12 means an unknown or mistyped tool id
  6. Debugging proxy behavior: raise the log level with mcpproxy serve --log-level=debug and correlate a single workflow with mcpproxy activity list --request-id <id>

Things to try

Once connected, you can ask your AI assistant things like:

  • Find tools for creating a GitHub issue, top 5 results
  • Use describe_tool to show the full schema of github:create_issue
  • Use call_tool_write to file an issue titled Bug report in repo acme/api
  • Show the recent activity log of which tools the agent called

Tools 5

retrieve_tools read-only
Run a BM25 search across every connected server using plain keywords, returning only the top-ranked matching tools with a call_with hint.
describe_tool read-only
Load the full schema of a tool on demand, batching up to 5 ids per call.
call_tool_read read-only
Execute a tool call with read intent; it cannot reach tools annotated as destructive.
call_tool_write writes
Execute a tool call with write intent, used for operations that modify data.
call_tool_destructive destructive
Execute a tool call with destructive intent for high-risk operations, subject to annotation and quarantine/approval checks.

Use cases

Expose hundreds of MCP tools to an AI agent without blowing the context window or hitting client tool limits
Quarantine, scan and manually approve upstream MCP servers before letting agents use them
Preflight required tools for unattended cron/CI automations via mcpproxy tools preflight
Audit every agent tool call by request ID through the local Activity Log

Supported clients

Cursor
Claude Desktop
VS Code
Goose

Listed from the project's documentation, not tested by this site.

Overview

MCPProxy is a local-first MCP proxy written in Go that puts one safe endpoint in front of every upstream MCP server. Instead of loading hundreds of tool schemas, agents call a single retrieve_tools function that runs BM25 keyword search across all connected servers — the README cites research showing ~99% token reduction with a 43% accuracy improvement. It federates many MCP servers (the README says it bypasses Cursor's 40-tool limit and OpenAI's 128-function cap), automatically quarantines new servers to block Tool Poisoning Attacks until manually approved, and can run pluggable Docker-based scanners (Snyk, Semgrep, Trivy, Cisco and others) whose findings are normalized to SARIF with a composite risk score. Every call is recorded in a local Activity Log with a request ID for auditing. The core is a single binary with an embedded web UI for macOS, Linux and Windows; macOS also offers an optional menu-bar app.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 64.1k · Tools 2 Compare with this →

Source revision 62401d54cfd1 Data synced 2026-11-02 Read the FMRS scoring method