Governed Gateway MCP server
HTTP MCP gateway: principal on tools/call + SSE, allowlists, vault rotate, CHP gates.
0 stars15 downloads/wk
Reviews
Write oneNobody has reviewed Governed Gateway yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Governed Gateway tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-11-01 · same rubric, same numbers if you re-run it
- Code scan19 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancerepository not readable: repo not found3/15
- Maintainer identityno repository or website to verify2/10
How Governed Gateway compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 65/100
- higher than 20% of 48,255 servers
- Downloads a week
- 15
- more than 4% of 12,191 servers with a package
Install Governed Gateway in Claude Code, Cursor or VS Code
Runs npx -y @cubiczan/governed-mcp-gateway on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add governed-mcp-gateway -- npx -y @cubiczan/governed-mcp-gateway
What the publisher says
From the Governed Gateway repository's README, as published. We do not edit it. Read it on GitHub
Cubiczan Agent Platform
Identity, money, and evidence for agents that actually ship.
Three SKUs, one workspace. MCP clients keep a Bearer principal through tools/call and SSE. Spend cannot settle without a mandate and, over cap, a human second key. Board claims cannot seal without an agent, a CHP lock, and a hashed document.
Shared primitives (packages/shared): CHP gate, HMAC ledger, HTTP/SSE helpers. Zero runtime npm dependencies. Stripe and x402 are rails — tests never call live networks.
Quickstart
npm install
npm test
npm run gateway # :7474
npm run spend # :7475
npm run cfo # :7476Demo Bearer keys (also in .env.example):
Regenerate the README cards from live local APIs:
npm run shots1. Governed MCP Gateway
Production MCP drops identity. listTools runs on the request thread; tools/call and SSE run somewhere else. This gateway resolves a Bearer credential to a Principal, injects it on every JSON-RPC call, and repeats it on every SSE frame. Named vault inputs rotate in place — githubtoken stays githubtoken.
curl -sS -H "Authorization: Bearer mcp_agt_payops_demo" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"echo.ping","arguments":{"hello":"world"}}}' \
http://127.0.0.1:7474/mcpGlama remote connector
Glama can health-check a stateless Streamable HTTP remote at https://$VERCEL_URL/mcp with Bearer auth. This is the hosted HTTPS path. Stdio (npm run mcp / Dockerfile CMD) remains the Glama Docker build path.
Vercel project settings (import this GitHub repo; do not invent a hostname):
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Grade history
- 2026-11-01downgradeA → Cscore 65
Governed Gateway: common questions
- Is Governed Gateway MCP server safe?
- With care: it is graded C, so read the findings first (65/100). Read the Governed Gateway safety report
- How do I install Governed Gateway?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Governed Gateway need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Governed Gateway maintained?
- The last commit was 57 days ago (2026-09-08). The latest release is v0.1.0.
- How does Governed Gateway compare with other MCP servers?
- safety score 65/100 (higher than 20% of 48,255 servers); downloads a week 15 (more than 4% of 12,191 servers with a package). Full comparison.