Skip to main content

MCP Gateway

STOA's MCP Gateway is a purpose-built MCP-native API Gateway, enabling AI agents like Claude, GPT, and custom LLM applications to securely consume enterprise APIs through the Model Context Protocol.

Overview​

The MCP Gateway acts as the bridge between AI agents and your API ecosystem. It handles authentication, rate limiting, subscription validation, and multi-tenant isolation—all while speaking the native MCP protocol.

Current Implementation​

The MCP Gateway is built with Python and FastAPI for rapid development and flexibility.

AspectDetails
LanguagePython 3.12+
FrameworkFastAPI (async)
Policy EngineOPA (Open Policy Agent)
ProtocolMCP 2024-11-05
Future Roadmap

A high-performance Rust + Tokio + Hyper implementation is planned for Q4 2026, bringing:

  • Kernel-level eBPF acceleration
  • Sub-millisecond latency overhead
  • Significantly reduced memory footprint

See our Roadmap for details.

Key Features​

🔐 Enterprise Security​

  • Keycloak OIDC integration with multi-realm per tenant
  • JWT token validation with audience mapping
  • API key management with automatic rotation

🏢 Multi-Tenant Isolation​

  • Kubernetes namespace per tenant (tenant-{name})
  • Network policies preventing cross-tenant communication
  • Per-tenant rate limiting and quotas

📊 Full Observability​

  • Prometheus metrics on port 9090
  • Request tracing with correlation IDs
  • Usage analytics per subscription

⚡ Production Ready​

  • Async request handling with FastAPI
  • Kafka/Redpanda-based metering pipeline
  • Connection pooling and request batching
  • OPA-based policy enforcement

MCP Protocol Support​

STOA implements the full MCP specification (version 2024-11-05) with enterprise extensions.

Supported Methods​

MethodDescription
tools/listDiscover available tools
tools/callInvoke a tool
resources/listList available resources
resources/readRead resource content
prompts/listList available prompts
prompts/getGet prompt template

Transport Options​

  • HTTP/SSE: Server-Sent Events for streaming responses
  • WebSocket: Bidirectional communication (planned)

Authentication Flow​

Multi-Tenant Tool Visibility​

Each tenant only sees tools they're authorized to access:

TenantVisible Tools
Parzival (High Five)stoa_*, highfive:*
Sorrento (IOI)stoa_*, ioi:*
Halliday (Admin)All tools (cross-tenant)

Configuration​

Environment Variables​

# Server
MCP_GATEWAY_HOST=0.0.0.0
MCP_GATEWAY_PORT=3001

# Control Plane
CONTROL_PLANE_URL=http://control-plane:8080

# Keycloak
KEYCLOAK_URL=https://auth.<YOUR_DOMAIN>
KEYCLOAK_REALM=stoa

# OPA (for policies)
OPA_URL=http://opa:8181

Kubernetes Deployment​

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mcp-gateway
  namespace: stoa-system
spec:
  replicas: 3
  template:
    spec:
      containers:
        - name: mcp-gateway
          image: stoaplatform/mcp-gateway:latest
          ports:
            - containerPort: 3001
          resources:
            requests:
              cpu: 500m
              memory: 512Mi
            limits:
              cpu: 2000m
              memory: 2Gi

Integration with Claude.ai​

STOA MCP Gateway integrates directly with Claude.ai through the MCP connector:

  1. Configure MCP Server in Claude.ai settings
  2. Authenticate with your STOA API key
  3. Discover tools automatically via tools/list
  4. Invoke tools through natural conversation

Example Tool Invocation​

{
  "method": "tools/call",
  "params": {
    "name": "stoa_catalog",
    "arguments": {
      "action": "list",
      "status": "active"
    }
  }
}

Metrics & Monitoring​

Prometheus Metrics​

MetricTypeDescription
mcp_requests_totalCounterTotal MCP requests
mcp_request_duration_secondsHistogramRequest latency
mcp_tool_invocations_totalCounterTool invocations by name
mcp_errors_totalCounterErrors by type

Grafana Dashboard​

Pre-built dashboards available for:

  • Request throughput and latency
  • Tool invocation patterns
  • Error rates by tenant
  • Rate limiting events

Next Steps​