A hackable MCP gateway

Apache 2.0 licensed

Gatekit is a Model Context Protocol gateway that controls traffic between your LLM and MCP tools for better visibility, security, and control.

It ships with plugins for tool management, content security, and audit logging.

Need custom behavior? Extend with plugins, not forks. Your customizations stay separate, so you can keep getting Gatekit updates without merge conflicts.

Built-in plugins handle:

Tool management — expose only the tools you want, rename and modify descriptions for cleaner context and better discoverability
Content security — catch PII and secrets before they leave your machine, defend against basic prompt injection attacks (regex-based)
Audit logging — debug failures, track usage, inspect full request and response bodies
Token usage tracking — estimate token consumption per server and tool, with CSV export
Stdio server sandboxing — restrict what local MCP servers can access on your machine using OS-native isolation (macOS Seatbelt, Linux bubblewrap)

uv tool install gatekit

Get started View source

Gatekit configuration editor (Terminal UI)

How It Works

Gatekit proxies traffic between Model Context Protocol (MCP) clients and servers. Config files define which servers to proxy and which plugins to run.

gatekit The TUI. Detects your MCP clients, discovers servers, and generates YAML config files.

gatekit.yaml Your config. Defines upstream servers and plugins.

gatekit-gateway The runtime. Your MCP client points here. Applies your plugins to all traffic.

Plugins intercept traffic between client and servers, allowing you to modify, block, or log messages:

Security — Block or redact sensitive content (PII, secrets)
Middleware — Transform requests/responses (filter tools, rename, modify)
Auditing — Log all MCP traffic for debugging or compliance

Built-in Plugins

Plugins intercept traffic between client and servers, allowing you to modify, block, or log messages.

Tool Manager plugin configuration

Middleware

Transform requests and responses

Tool Manager — Filter, rename, and customize tool descriptions
Call Trace — Append diagnostic info to tool responses

Security

Regex-based pattern matching. Not a substitute for dedicated security tooling.

PII Filter — Detect and redact personally identifiable information
Secrets Filter — Detect API keys, tokens, and other secrets
Prompt Injection Filter — Detect common prompt injection patterns

Auditing

Log all MCP traffic for debugging or compliance

JSON Lines — Structured logs for processing
CSV — Spreadsheet-compatible logs
Human Readable — Plain text logs for quick review
Token Usage Estimator — Estimate token consumption per server and tool

Stdio Server Sandboxing

Stdio MCP servers run third-party code on your machine. Gatekit can sandbox them so they only access the files and network you allow.

macOS — Seatbelt (sandbox-exec)
Linux — bubblewrap (bwrap)
Home directory denied by default — only explicitly allowed paths are accessible
Sensitive directories always hidden (~/.ssh, ~/.aws, ~/.gnupg, and more)
Network access configurable per server
Fail-closed — refuses to start if no sandbox engine is available

upstreams:
  - name: filesystem
    command: ["npx", "@modelcontextprotocol/server-filesystem", "~/docs"]
    sandbox:
      enabled: true
      paths: ["~/docs"]

Custom Plugins

When the built-in plugins aren't enough, write your own. Plugins intercept and modify tool calls and responses, enabling:

Pruning responses to avoid context bloat
Injecting credentials into tool calls without exposing them to the LLM
Joining additional information from other data sources
Human-in-the-loop approval for dangerous actions
Response caching and deduplication

from gatekit.plugins.interfaces import MiddlewarePlugin, PluginResult

class MyPlugin(MiddlewarePlugin):
    async def process_request(self, request, server_name):
        # Your logic here
        return PluginResult()

    async def process_response(self, request, response, server_name):
        # Your logic here
        return PluginResult()

HANDLERS = {"my_plugin": MyPlugin}

Guided Setup

Run gatekit to launch the terminal UI. The guided setup wizard handles configuration for supported clients.

Auto-detects MCP clients on your system (Claude Desktop, Codex, Claude Code, Cursor, Windsurf)
Discovers all configured MCP servers from each client
Generates a complete Gatekit configuration
Provides client-specific setup instructions with copy buttons
Creates restore scripts in case you want to revert

Installation

Requires Python 3.10+. Works on macOS, Linux, and Windows.

uv (recommended)

uv tool install gatekit

pipx

pipx install gatekit

pip

pip install gatekit

Roadmap and Limitations

Security plugins use regex-based pattern matching, not production-grade ML/NLP.

Planned features include:

Enhanced detection — Support for best-in-class third-party security and privacy solutions like Microsoft Presidio, Yelp Secrets, etc.
Response pruning — Built-in response trimming functionality to help reduce context bloat