MCP Gateway

\n A single, authless public MCP endpoint that tunnels to multiple upstream MCP providers\n (each of which may require its own token). Secrets live server-side as env vars — nothing\n is exposed to callers.\n

\n\n

\n MCP endpoint: POST /mcp\n

\n Add this as a \"Streamable HTTP\" remote MCP server in any MCP client. No auth headers\n needed.\n

\n\n

Providers

\n
{p.name}
\n
{p.description}
\n
\n {p.url} {p.authEnvVar ? `(token via ${p.authEnvVar})` : \"(no token required)\"}\n
\n

\n\n

\n Aggregated tools {toolsError ? \"\" : `(${tools.length})`}\n

\n {toolsError\n ?

Failed to load tools: {toolsError}

\n : (\n

\n {t.name}\n — {t.description}\n

\n )}\n ,\n );\n});\n\n// The public, authless MCP endpoint. Clients POST JSON-RPC 2.0 messages here.\napp.post(\"/mcp\", async (c) => {\n let body: unknown;\n try {\n body = await c.req.json();\n } catch {\n return c.json(\n { jsonrpc: \"2.0\", id: null, error: { code: -32700, message: \"Parse error\" } },\n 400,\n );\n }\n\n const result = await handleMcpRequest(body);\n\n // Notifications (e.g. `notifications/initialized`) produce no response body.\n if (result === null) return new Response(null, { status: 202 });\n\n return c.json(result);\n});\n\n// This server doesn't push server-initiated events, so it doesn't support the\n// optional GET-for-SSE-stream half of the Streamable HTTP spec.\napp.get(\"/mcp\", (c) => c.text(\"Method Not Allowed: this endpoint only accepts POST\", 405));\n\n// Serve static files\napp.get(\"/public/*\", (c) => serveFile(c.req.path));\n\n// View source on Val Town\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n",[],[125],"fccd7a94-13e7-4d14-9098-56d24c15eac1","README.md","019fbb4c-435a-77b6-a1db-ea2d40b85af2",8,["D",1785553868841],"# mcp-gateway\n\nAn **authless, public MCP server** that tunnels to multiple upstream MCP\nproviders — each of which may require its own token (like [Context7](https://context7.com)).\nCallers hit one endpoint with no auth; the gateway injects each provider's\nsecret server-side.\n\n```mermaid\nflowchart LR\n client[MCP Client
Claude, Cursor, etc.] -- \"POST /mcp
(no auth)\" --> gw[mcp-gateway]\n gw -- \"CONTEXT7_API_KEY\" --> c7[Context7 MCP]\n gw -- \"your token\" --> other[Any other MCP provider]\n```\n\n## Try it\n\nAdd this val's live `/mcp` endpoint as a remote **Streamable HTTP** MCP server\nin any MCP-compatible client (Claude Code, Cursor, etc.). No headers or API\nkeys required on the client side.\n\nVisit the homepage (`/`) to see configured providers and the live aggregated\ntool list.\n\n## How it works\n\n| File | Responsibility |\n| --- | --- |\n| `providers.ts` | Config for each upstream provider: URL + which env var holds its secret |\n| `mcpClient.ts` | A minimal MCP **client** — speaks the Streamable HTTP handshake (`initialize` → `notifications/initialized` → `tools/list`/`tools/call`) to upstream providers |\n| `registry.ts` | Aggregates tools from all providers into one namespace (prefixed `__`), caches `tools/list` briefly, and dispatches `tools/call` to the right upstream |\n| `mcpServer.ts` | The public-facing MCP **server** — JSON-RPC 2.0 method handling for `initialize`, `tools/list`, `tools/call` |\n| `index.tsx` | Hono app: `POST /mcp` (the protocol endpoint) + a homepage documenting providers/tools |\n\nTools are namespaced so multiple providers can coexist without collisions,\ne.g. `context7__resolve-library-id` and `context7__query-docs`.\n\n## Adding another provider\n\n1. Add an entry to the `providers` array in `providers.ts`:\n ```ts\n {\n id: \"firecrawl\",\n name: \"Firecrawl\",\n url: \"https://mcp.firecrawl.dev/mcp\",\n authEnvVar: \"FIRECRAWL_API_KEY\",\n authHeader: \"Authorization\",\n authPrefix: \"Bearer \",\n }\n ```\n2. Add the corresponding env var to this val (see below).\n3. That's it — its tools show up automatically in `tools/list`, prefixed\n `firecrawl__...`.\n\n## Env vars\n\nOnly needed for providers that require a token. Context7 works without one at\nlower rate limits; set `CONTEXT7_API_KEY` for higher limits.\n\n👉 Add CONTEXT7_API_KEY here: https://www.val.town/x/thevt1/mcp-gateway/environment-variables?key=CONTEXT7_API_KEY\n\n## Notes / limitations\n\n- Each `tools/call` re-runs the upstream `initialize` handshake (stateless,\n simple, robust — no session expiry bugs). `tools/list` results are cached\n in-memory for 5 minutes per warm instance.\n- This server doesn't push server-initiated events, so `GET /mcp` (the\n optional SSE-stream half of the Streamable HTTP spec) returns 405.\n- Because the gateway itself is authless, treat it as semi-public: anyone who\n can reach `/mcp` can spend your upstream providers' rate limits/quota. Put\n it behind Val Town's [restricted HTTP privacy](https://docs.val.town) or a\n bypass token if you need to lock it down.\n",[],[134],["D",1785553765138],[144],[19],{"_36":60,"_13":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_38":145,"_17":34,"_73":24,"_74":75,"_76":51,"_77":-5,"_97":146,"_18":147},["D",1785553765138],[],[19,61],"87c02ff4-ba2e-4342-9fae-eee645b2363d",["D",1785553765138],"legacyEnvVars","httpPrivacy","description","Authless public MCP gateway to token-gated providers","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/c0239427-e00f-4148-05e5-9ae43f5d9900/square512?exp=1789559999&sig=ac15908b55963bdc2b1c51efd5664ee3a1be0a912eebad832c982d20663e4c76","userId","c94f26a6-095b-410f-9863-932d0daf4df4","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019fbafd-5266-716c-969f-f171ce67672a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_192":-5},"org",{"_11":12,"_186":187,"_188":-5,"_156":157,"_189":190,"_191":51},"branch",{"_17":136,"_13":16,"_36":67,"_42":148,"_45":37,"_46":44,"_183":19,"_184":43,"_185":56,"_57":14,"_53":12},"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","displayName","VTklgy","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":148,"_13":14,"_38":255,"_49":-5,"_150":51,"_52":19,"_151":19,"_152":153,"_154":155,"_156":157,"_158":126,"_159":71,"_160":-5,"_161":-5,"_162":34,"_55":163,"_164":-5,"_165":-5,"_166":-5,"_167":-5,"_168":169,"_170":169,"_171":172,"_173":172,"_174":172,"_175":169,"_176":169,"_177":256,"_179":257,"_181":258,"_50":51},[231,233,234,235,236,237,238],"files",[231,232,233,234,235,236,237,238],"counts",{"_222":34,"_223":69,"_224":34,"_35":225,"_226":227},[220],{"_36":79,"_13":19,"_62":65,"_64":-5,"_66":67,"_68":69,"_70":71,"_38":80,"_17":34,"_73":81,"_74":-5,"_76":51,"_77":-5,"_18":219},"upstreamProject",{"_36":43,"_13":58,"_152":216,"_154":155,"_52":19,"_177":217},"upstreamBranch",{"_36":37,"_38":214,"_40":215,"_13":16,"_42":43,"_17":44,"_45":-5,"_46":-5,"_47":48,"_49":-5,"_50":51,"_52":19,"_53":54,"_55":56,"_57":58},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1779832014660],["D",1779896135471],"Minimal Hono JSX starter for Val Town",{"_11":54,"_192":218},"https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/129cab32-3bd7-4c3e-f39b-f12900c76100/square512?exp=1789559999&sig=5c07b77d973a9a7831cc1779f4bd4ec152796753863d0aeae4088e1e0ae03921",[19],{"_36":60,"_13":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_38":72,"_17":34,"_73":24,"_74":75,"_76":51,"_77":-5,"_18":221},[19,61],"pulls","branches","forks",{"_228":34,"_230":34},"connections",{"_228":34,"_229":34},"count","unfilledCount","emptyCount",{"_36":79,"_13":19,"_62":65,"_64":-5,"_66":67,"_68":69,"_70":71,"_38":141,"_17":34,"_73":81,"_74":-5,"_76":51,"_77":-5,"_97":253,"_18":254},{"_36":60,"_13":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_38":145,"_17":34,"_73":24,"_74":75,"_76":51,"_77":-5,"_97":251,"_18":252},{"_36":133,"_13":134,"_62":135,"_64":-5,"_66":67,"_68":136,"_70":71,"_38":137,"_17":69,"_73":24,"_74":138,"_76":51,"_77":-5,"_97":249,"_18":250},{"_36":124,"_13":125,"_62":126,"_64":-5,"_66":67,"_68":127,"_70":71,"_38":128,"_17":69,"_73":129,"_74":130,"_76":51,"_77":-5,"_97":247,"_18":248},{"_36":116,"_13":117,"_62":118,"_64":-5,"_66":67,"_68":119,"_70":71,"_38":120,"_17":34,"_73":95,"_74":121,"_76":51,"_77":-5,"_97":245,"_18":246},{"_36":108,"_13":109,"_62":110,"_64":-5,"_66":67,"_68":111,"_70":71,"_38":112,"_17":34,"_73":95,"_74":113,"_76":51,"_77":-5,"_97":243,"_18":244},{"_36":100,"_13":101,"_62":102,"_64":-5,"_66":67,"_68":103,"_70":71,"_38":104,"_17":34,"_73":95,"_74":105,"_76":51,"_77":-5,"_97":241,"_18":242},{"_36":90,"_13":91,"_62":92,"_64":-5,"_66":67,"_68":93,"_70":71,"_38":94,"_17":34,"_73":95,"_74":96,"_76":51,"_77":-5,"_97":239,"_18":240},[],[91],[],[101],[],[109],[],[117],[],[125],[],[134],[],[19,61],[232],[19],["D",1785553765138],{"_11":12,"_192":-5},{"_11":12,"_186":187,"_188":-5,"_156":157,"_189":190,"_191":51},{"_17":136,"_13":16,"_36":67,"_42":148,"_45":37,"_46":44,"_183":19,"_184":43,"_185":56,"_57":14,"_53":12},"ctx",{"_177":-5,"_211":292,"_293":294,"_295":296,"_297":51,"_298":51,"_299":51,"_300":71,"_301":-5,"_302":-7,"_303":-7,"_304":34,"_305":51,"_306":51,"_307":-5,"_308":51,"_309":51,"_310":51,"_311":-5},"ENV",{"_263":264,"_265":266,"_267":16,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]