mcp-gateway
An open-source project by Fetch Hive.
OpenAPI to MCP. Connect your API to Cursor, Codex, Claude Code, VS Code, ChatGPT, or any MCP client — in minutes.
That means a live API, and it also means the API on your laptop: a WIP
branch, localhost:3000, a Docker compose stack. Point the editor at the
gateway and call the same tools you will ship.
Prefer a hosted MCP Gateway with tokens, quotas, and a dashboard? https://fetchhive.com/mcp
Two equally important flows
1. Local / branch API → editor
Your server is already running on this machine. Compile the OpenAPI, proxy loopback, paste a snippet into Cursor / Codex / Claude Code.
mcp-gateway init --allow-private-networks
mcp-gateway add-spec --name demo --file ./openapi.yaml \
--base-url http://127.0.0.1:3000 --insecure-http
export MCP_GATEWAY_TOKEN=… # printed once by init
mcp-gateway test demo list_pets --args '{}'
mcp-gateway serve demo
mcp-gateway inspect demo --client cursor # or: codex | claude-code | vscode | claude
--allow-private-networks is required for loopback and RFC1918. --insecure-http
is required when the API speaks HTTP (typical on localhost). --base-url is the
origin of this checkout, not production.
2. Live API → editor or agent
Same compiler, public HTTPS OpenAPI, no private-network flag.
mcp-gateway init
mcp-gateway add-spec --name demo --url https://api.example.com/openapi.json
export MCP_GATEWAY_TOKEN=…
mcp-gateway serve demo
mcp-gateway inspect demo --client cursor
Or skip operating a process: hosted MCP Gateway. PaaS / VPS: deploy.
3. Local server, remote client
The process stays on loopback. An outbound tunnel gives you
https://<slug>.mcp.fetchhive.com/mcp for OpenAI, Claude, Cursor, and any
other client that can send a bearer header. No account. The URL is released
30 minutes after the CLI exits.
export MCP_GATEWAY_TOKEN=…
mcp-gateway serve demo --tunnel
Details: Tunnel.
Deploy
Guides: Render · Heroku · DigitalOcean · Hetzner. Vercel cannot run this server (why).
Set MCP_GATEWAY_TOKEN and MCP_GATEWAY_SPEC_URL (HTTPS OpenAPI). The image
reads PORT itself (distroless, no shell). After deploy, paste
mcp-gateway inspect demo --client cursor (replace the URL with your
https://…/mcp) into the editor.
Install
# Homebrew — use the fully qualified name (Homebrew 6 trusts only this formula).
# `brew tap` then `brew install mcp-gateway` is refused until you `brew trust`.
brew install Fetch-Hive/tap/mcp-gateway
# Docker (linux/amd64 and linux/arm64)
docker run --rm -p 127.0.0.1:8787:8787 ghcr.io/fetch-hive/mcp-gateway:0.7.1 version
# npm — wrapper plus the prebuilt binary for this machine
npx --yes @fetch-hive/mcp-gateway version
# GitHub Release installer
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Fetch-Hive/openapi-mcp/releases/latest/download/mcp-gateway-cli-installer.sh | sh
# From a checkout of this repo
cargo install --path crates/mcp-gateway-cli
mcp-gateway compiles OpenAPI 3.0/3.1 to a versioned IR, serves tools over
Streamable HTTP or stdio, and injects upstream credentials from env or file
references. Outbound HTTP uses an SSRF-hardened dialer.
Security
Default bind is loopback. Binding 0.0.0.0 requires --expose. Upstream
private networks and localhost require --allow-private-networks. Report
vulnerabilities to security@fetchhive.com — see SECURITY.md.
Docs
- Connect Cursor, Codex, Claude Code
- Tunnel (local server, public URL)
- CLI reference
- Config schema
- Deploy (PaaS + VPS)
- SSRF policy
- Private-network flag
- Tunnel protocol
Licence
Apache License 2.0. See LICENSE and NOTICE.