A hackable MCP gateway

Apache 2.0 licensed

Gatekit is a Model Context Protocol gateway that controls traffic between your LLM and MCP tools for better visibility, security, and control.

Extend it with plugins, not forks. Your customizations stay separate, so you can keep getting Gatekit updates without merge conflicts.

Built-in plugins handle:

Tool management — expose only the tools you want, rename and modify descriptions for cleaner context and better discoverability
Content security — catch PII and secrets before they leave your machine, defend against basic prompt injection attacks (regex-based)
Audit logging — debug failures, track usage, inspect full request and response bodies

uv tool install gatekit

Get started View source

Gatekit configuration editor (Terminal UI)

How It Works

Gatekit proxies traffic between Model Context Protocol (MCP) clients and servers. Config files define which servers to proxy and which plugins to run.

gatekit The TUI. Detects your MCP clients, discovers servers, and generates YAML config files.

gatekit.yaml Your config. Defines upstream servers and plugins.

gatekit-gateway The runtime. Your MCP client points here. Applies your plugins to all traffic.

Plugins intercept traffic between client and servers, allowing you to modify, block, or log messages:

Security — Block or redact sensitive content (PII, secrets)
Middleware — Transform requests/responses (filter tools, rename, modify)
Auditing — Log all MCP traffic for debugging or compliance

Built-in Plugins

Plugins intercept traffic between client and servers, allowing you to modify, block, or log messages.

Tool Manager plugin configuration

Middleware

Transform requests and responses

Tool Manager — Filter, rename, and customize tool descriptions
Call Trace — Append diagnostic info to tool responses

Security

Regex-based pattern matching. Not a substitute for dedicated security tooling.

PII Filter — Detect and redact personally identifiable information
Secrets Filter — Detect API keys, tokens, and other secrets
Prompt Injection Filter — Detect common prompt injection patterns

Auditing

Log all MCP traffic for debugging or compliance

JSON Lines — Structured logs for processing
CSV — Spreadsheet-compatible logs
Human Readable — Plain text logs for quick review

Custom Plugins

When the built-in plugins aren't enough, write your own. Plugins intercept and modify tool calls and responses, enabling:

Pruning responses to avoid context bloat
Injecting credentials into tool calls without exposing them to the LLM
Joining additional information from other data sources
Human-in-the-loop approval for dangerous actions
Response caching and deduplication

from gatekit.plugins.interfaces import MiddlewarePlugin, PluginResult

class MyPlugin(MiddlewarePlugin):
    async def process_request(self, request, server_name):
        # Your logic here
        return PluginResult()

    async def process_response(self, request, response, server_name):
        # Your logic here
        return PluginResult()

HANDLERS = {"my_plugin": MyPlugin}

Guided Setup

Run gatekit to launch the terminal UI. The guided setup wizard handles configuration for supported clients.

Auto-detects MCP clients on your system (Claude Desktop, Codex, Claude Code, Cursor, Windsurf)
Discovers all configured MCP servers from each client
Generates a complete Gatekit configuration
Provides client-specific setup instructions with copy buttons
Creates restore scripts in case you want to revert

Installation

Requires Python 3.10+.

uv (recommended)

uv tool install gatekit

pipx

pipx install gatekit

pip

pip install gatekit

Roadmap and Limitations

Gatekit currently only supports local stdio servers and regex pattern matching based security and privacy filters.

Planned features include:

HTTP transport — Connect to remote MCP servers
Hot-reload — Change config without restarting the gateway
Enhanced detection — Support for best-in-class third-party security and privacy solutions like Microsoft Presidio, Yelp Secrets, etc.
Token usage estimation — Track token consumption by server and tool
Response pruning — Built-in response trimming functionality to help reduce context bloat