mcp-gateway

Overview ¶

Command mcp-gateway is a runnable, self-contained demonstration of Legant's MCP auth-gateway: an AI agent calls an MCP server *through* Legant, which enforces per-tool delegation and mints a fresh, narrowly-scoped downstream token (confused-deputy protection) rather than forwarding the agent's token.

No database, no Docker. Run it with:

go run ./examples/mcp-gateway

It runs three roles in one process: the agent (holds a delegated token), the Legant gateway (verifies + authorizes per tool + re-mints downstream), and an upstream MCP "weather" server (independently verifies the downstream token).

The production gateway (internal/mcpgw) adds DB-backed revocation and audit; this demo shows the core verify -> authorize -> re-mint -> proxy flow.