MCP Gateway

\n A single, authless public MCP endpoint that tunnels to multiple upstream MCP providers\n (each of which may require its own token). Secrets live server-side as env vars — nothing\n is exposed to callers.\n

\n\n

\n MCP endpoint: POST /mcp\n

\n Add this as a \"Streamable HTTP\" remote MCP server in any MCP client. No auth headers\n needed.\n

\n\n

Providers

\n
{p.name}
\n
{p.description}
\n
\n {p.url} {p.authEnvVar ? `(token via ${p.authEnvVar})` : \"(no token required)\"}\n
\n

\n\n

\n Aggregated tools {toolsError ? \"\" : `(${tools.length})`}\n

\n {toolsError\n ?

Failed to load tools: {toolsError}

\n : (\n

\n {t.name}\n — {t.description}\n

\n )}\n ,\n );\n});\n\n// The public, authless MCP endpoint. Clients POST JSON-RPC 2.0 messages here.\napp.post(\"/mcp\", async (c) => {\n let body: unknown;\n try {\n body = await c.req.json();\n } catch {\n return c.json(\n { jsonrpc: \"2.0\", id: null, error: { code: -32700, message: \"Parse error\" } },\n 400,\n );\n }\n\n const result = await handleMcpRequest(body);\n\n // Notifications (e.g. `notifications/initialized`) produce no response body.\n if (result === null) return new Response(null, { status: 202 });\n\n return c.json(result);\n});\n\n// This server doesn't push server-initiated events, so it doesn't support the\n// optional GET-for-SSE-stream half of the Streamable HTTP spec.\napp.get(\"/mcp\", (c) => c.text(\"Method Not Allowed: this endpoint only accepts POST\", 405));\n\n// Serve static files\napp.get(\"/public/*\", (c) => serveFile(c.req.path));\n\n// View source on Val Town\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n",[174],"fccd7a94-13e7-4d14-9098-56d24c15eac1","README.md","019fbb4c-435a-77b6-a1db-ea2d40b85af2",["D",1785553868841],"# mcp-gateway\n\nAn **authless, public MCP server** that tunnels to multiple upstream MCP\nproviders — each of which may require its own token (like [Context7](https://context7.com)).\nCallers hit one endpoint with no auth; the gateway injects each provider's\nsecret server-side.\n\n```mermaid\nflowchart LR\n client[MCP Client
Claude, Cursor, etc.] -- \"POST /mcp
(no auth)\" --> gw[mcp-gateway]\n gw -- \"CONTEXT7_API_KEY\" --> c7[Context7 MCP]\n gw -- \"your token\" --> other[Any other MCP provider]\n```\n\n## Try it\n\nAdd this val's live `/mcp` endpoint as a remote **Streamable HTTP** MCP server\nin any MCP-compatible client (Claude Code, Cursor, etc.). No headers or API\nkeys required on the client side.\n\nVisit the homepage (`/`) to see configured providers and the live aggregated\ntool list.\n\n## How it works\n\n| File | Responsibility |\n| --- | --- |\n| `providers.ts` | Config for each upstream provider: URL + which env var holds its secret |\n| `mcpClient.ts` | A minimal MCP **client** — speaks the Streamable HTTP handshake (`initialize` → `notifications/initialized` → `tools/list`/`tools/call`) to upstream providers |\n| `registry.ts` | Aggregates tools from all providers into one namespace (prefixed `__`), caches `tools/list` briefly, and dispatches `tools/call` to the right upstream |\n| `mcpServer.ts` | The public-facing MCP **server** — JSON-RPC 2.0 method handling for `initialize`, `tools/list`, `tools/call` |\n| `index.tsx` | Hono app: `POST /mcp` (the protocol endpoint) + a homepage documenting providers/tools |\n\nTools are namespaced so multiple providers can coexist without collisions,\ne.g. `context7__resolve-library-id` and `context7__query-docs`.\n\n## Adding another provider\n\n1. Add an entry to the `providers` array in `providers.ts`:\n ```ts\n {\n id: \"firecrawl\",\n name: \"Firecrawl\",\n url: \"https://mcp.firecrawl.dev/mcp\",\n authEnvVar: \"FIRECRAWL_API_KEY\",\n authHeader: \"Authorization\",\n authPrefix: \"Bearer \",\n }\n ```\n2. Add the corresponding env var to this val (see below).\n3. That's it — its tools show up automatically in `tools/list`, prefixed\n `firecrawl__...`.\n\n## Env vars\n\nOnly needed for providers that require a token. Context7 works without one at\nlower rate limits; set `CONTEXT7_API_KEY` for higher limits.\n\n👉 Add CONTEXT7_API_KEY here: https://www.val.town/x/thevt1/mcp-gateway/environment-variables?key=CONTEXT7_API_KEY\n\n## Notes / limitations\n\n- Each `tools/call` re-runs the upstream `initialize` handshake (stateless,\n simple, robust — no session expiry bugs). `tools/list` results are cached\n in-memory for 5 minutes per warm instance.\n- This server doesn't push server-initiated events, so `GET /mcp` (the\n optional SSE-stream half of the Streamable HTTP spec) returns 405.\n- Because the gateway itself is authless, treat it as semi-public: anyone who\n can reach `/mcp` can spend your upstream providers' rate limits/quota. Put\n it behind Val Town's [restricted HTTP privacy](https://docs.val.town) or a\n bypass token if you need to lock it down.\n",[182],"689d1099-96c5-46d7-885d-4ca03b08221d","019fbb4c-435a-77b6-a1db-e683a2b958dc",["D",1785553765138],"directory",[42],"pulls","forks","envVars",{"_198":57,"_200":57},"connections",{"_198":57,"_199":57},"count","unfilledCount","emptyCount",{"_20":187,"_13":42,"_137":188,"_139":-5,"_140":21,"_141":177,"_143":53,"_22":235,"_29":57,"_145":190,"_147":-5,"_149":40,"_150":-5,"_210":236,"_95":237},{"_20":228,"_13":229,"_137":230,"_139":188,"_140":21,"_141":177,"_143":53,"_22":231,"_29":57,"_145":107,"_147":232,"_149":40,"_150":-5,"_210":233,"_95":234},{"_20":181,"_13":182,"_137":183,"_139":-5,"_140":21,"_141":30,"_143":53,"_22":225,"_29":177,"_145":107,"_147":185,"_149":40,"_150":-5,"_210":226,"_95":227},{"_20":173,"_13":174,"_137":51,"_139":-5,"_140":21,"_141":175,"_143":53,"_22":222,"_29":177,"_145":178,"_147":179,"_149":40,"_150":-5,"_210":223,"_95":224},{"_20":166,"_13":167,"_137":168,"_139":-5,"_140":21,"_141":169,"_143":53,"_22":219,"_29":57,"_145":146,"_147":171,"_149":40,"_150":-5,"_210":220,"_95":221},{"_20":159,"_13":160,"_137":161,"_139":-5,"_140":21,"_141":162,"_143":53,"_22":216,"_29":57,"_145":146,"_147":164,"_149":40,"_150":-5,"_210":217,"_95":218},{"_20":152,"_13":153,"_137":154,"_139":-5,"_140":21,"_141":155,"_143":53,"_22":213,"_29":57,"_145":146,"_147":157,"_149":40,"_150":-5,"_210":214,"_95":215},{"_20":135,"_13":136,"_137":138,"_139":-5,"_140":21,"_141":142,"_143":53,"_22":209,"_29":57,"_145":146,"_147":148,"_149":40,"_150":-5,"_210":211,"_95":212},["D",1785553795986],"children",[],[136],["D",1785553774188],[],[153],["D",1785553806288],[],[160],["D",1785553786882],[],[167],["D",1785553824497],[],[174],["D",1785553868841],[],[182],"498df3ba-38c8-4c42-bf46-e487db1ee16c","favicon.svg","019fbb4c-435a-77b6-a1db-e187a3f98a28",["D",1785553765138],"\n",[],[42,229],["D",1785553765138],[202],[42],["D",1785553765138],{"_11":12,"_93":-5},{"_11":12,"_87":88,"_89":-5,"_48":49,"_90":91,"_92":40},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":32,"_33":34,"_80":42,"_81":82,"_83":84,"_85":14,"_86":12},"ctx",{"_73":-5,"_117":275,"_276":277,"_278":279,"_280":40,"_281":40,"_282":40,"_283":53,"_284":-5,"_285":-7,"_286":-7,"_287":57,"_288":40,"_289":40,"_290":-5,"_291":40,"_292":40,"_293":40,"_294":-5},"ENV",{"_246":247,"_248":249,"_250":26,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262,"_263":264,"_265":266,"_267":268,"_269":270,"_271":272,"_273":274},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1