mcpmu (μ)

One secure, context-efficient MCP gateway for all your agents.

mcpmu lets you configure MCP servers once and expose them through a single stdio or Streamable HTTP endpoint. Claude Code, Codex, Cursor, Windsurf, and other MCP clients can share the same servers without duplicating configuration.

• Control tools at the gateway — Allowlist tools by namespace and globally block dangerous operations, regardless of which agent connects.
• Reduce tool-schema context costs — Replace a large tools/list response with three discovery and invocation tools, configurable per namespace.
• Create focused namespaces — Give work, personal, and project agents only the servers and tools they need.
• Connect any upstream — Manage local stdio processes and remote Streamable HTTP/SSE servers.
• Serve any client — Use local stdio shims or one persistent Streamable HTTP endpoint with a URL for each namespace.
• Manage everything visually — Use the terminal UI or browser UI to add, test, monitor, and configure servers.
• Keep MCP metadata intact — Tool annotations, output schemas, icons, and structured results survive the proxy hop.

Terminal UI

Web UI

Installation

Homebrew (macOS/Linux)

brew tap Bigsy/tap
brew install mcpmu

From source

go install github.com/Bigsy/mcpmu/cmd/mcpmu@latest

Quick start

Add an MCP server:

# Local stdio server
mcpmu add context7 -- npx -y @upstash/context7-mcp

# Remote HTTP server with OAuth
mcpmu add atlassian https://mcp.atlassian.com/mcp --scopes read,write

Then register mcpmu with a local agent:

claude mcp add mcpmu -- mcpmu serve --stdio
# or
codex mcp add mcpmu -- mcpmu serve --stdio

The equivalent MCP configuration is:

{
  "mcpmu": {
    "command": "mcpmu",
    "args": ["serve", "--stdio"]
  }
}

Run mcpmu for the terminal UI or mcpmu web for the browser UI.

Alternatively, let your coding agent perform the setup. Install the bundled agent skill, then ask it to import your existing MCP configuration:

mcpmu skill install

Give each agent the right tools

Namespaces create separate tool profiles from the same server configuration:

mcpmu namespace add work --description "Work tools"
mcpmu namespace assign work atlassian
mcpmu namespace assign work context7

claude mcp add work -- mcpmu serve --stdio --namespace work

Permissions are enforced inside mcpmu, not delegated to the connecting client. You can deny dangerous tools everywhere, create an allowlist for a namespace, or choose defaults for one particularly broad server:

# This cannot be overridden by a namespace
mcpmu server deny-tool filesystem delete_file

# Expose only selected tools in this namespace
mcpmu namespace set-deny-default work true
mcpmu permission set work context7 resolve allow

The precedence is: server global deny > explicit tool rule > server default > namespace default > allow. See Tool permissions for recipes, the full resolution model, and the interaction with compression.

Reduce tool-schema context costs

Large MCP setups can send thousands of tokens of tool schemas when a session starts. Compression replaces that surface with list_tools, get_tool_schema, and invoke_tool, allowing an agent to fetch full schemas only when it needs them:

# Recommended starting point for a large namespace
mcpmu namespace set-compression work medium

Compression is opt-in and works with stdio and HTTP. Denied tools stay out of the compact listing, and calls through invoke_tool still use the real target tool for mcpmu permissions and metrics.

See Tool-surface compression for level selection, flag overrides, client-side permission caveats, and operational details.

Choose a client transport

For HTTP clients, start the endpoint and point the client at the namespace URL:

mcpmu serve --http

{
  "mcpmu": {
    "url": "http://127.0.0.1:8081/mcp/work"
  }
}

/mcp selects the default namespace; /mcp/{namespace} selects a named one. A non-loopback bind requires a bearer token:

mcpmu serve --http --addr 0.0.0.0:8081 --token "$MCPMU_TOKEN"

Servers are shared by default. For stateful servers such as browser automation or REPLs, set "shared": false in that server's configuration to give each client session a private instance. The CLI reference covers daemon controls, HTTP security, OAuth, custom headers, and all serve flags.

More features

• Search and install servers from the official MCP registry.
• Authenticate remote servers with OAuth 2.1, PKCE, dynamic client registration, bearer tokens, or custom headers.
• Hot-reload configuration without restarting serve mode.
• Start servers lazily or pre-start them with --eager.
• Pass through upstream resources and prompts.
• Track per-tool call counts, error rates, latency, and unused tools without recording arguments or results.
• Share upstream processes across concurrent stdio clients while allowing private instances per server.
• Negotiate MCP protocol revisions through 2025-11-25 and relay cancellation and progress in both directions.

Documentation

• Tool permissions — access rules, precedence, and practical allowlist and denylist patterns
• Tool-surface compression — reduce tool-schema context while preserving gateway enforcement
• CLI reference — commands, flags, configuration fields, HTTP, and shared-daemon operation
• Shell completions — zsh, bash, fish, and PowerShell
• Architecture — implementation and protocol details

Building and testing

git clone https://github.com/Bigsy/mcpmu.git
cd mcpmu
go build -o mcpmu ./cmd/mcpmu
./mcpmu

go test ./...
make check
make test-integration