Enkrypt AI Secure MCP Gateway

Discover real-world attack scenarios, security best practices, and how our gateway protects your AI applications.

This Secure MCP Gateway is built with authentication, automatic tool discovery, caching, and guardrail enforcement.

It sits between your MCP client and MCP servers. So, by it's nature it itself also acts as an MCP server as well as an MCP client :)

When your MCP client connects to the Gateway, it acts as an MCP server. When the Gateway connects to the actual MCP server, it acts as an MCP client.

Below are the list of features Enkrypt AI Secure MCP Gateway provides:
-

Ease of use: You can configure all your MCP servers either locally inenkrypt_mcp_config.jsonor — better yet for teams and production — inEnkrypt cloud(runsecure-mcp-gateway generate-config --provider enkrypt). The cloud owns the server list, guardrail policies, andcommon_overrides, and the gateway pulls them at request time with a 5-minute TTL.

Dynamic Tool Discovery: The Gateway discovers tools from the MCP servers dynamically and makes them available to the MCP client

Restrict Tool Invocation: If you don't want all tools to be accessible of a an MCP server, you can restrict them by explicitly mentioning the tools in the Gateway config so that only the allowed tools are accessible to the MCP client

Caching: We cache the user gateway config and tools discovered from various MCP servers locally or in an external cache server like KeyDB if configured to improve performance

Guardrails: You can configure guardrails for each MCP server in Enkrypt both on input side (before sending the request to the MCP server) and output side (after receiving the response from the MCP server)

Logging: We log every request and response from the Gateway locally in your MCP logs and also forward them to Enkrypt(Coming soon)for monitoring. This enables you to see all the calls made in your account, servers used, tools invoked, requests blocked, etc.

Sandbox Isolation: MCP servers can be launched inside isolated sandbox environments (Docker, Podman, or microVMs) so that a compromised or malicious server cannot access the host filesystem, network, or other resources. Each sandbox is ephemeral — created per session and destroyed when done.

Input Protection:Topic detection, NSFW filtering, toxicity detection, injection attack prevention, keyword detection, policy violation detection, bias detection, and PII redaction (More coming soon like system prompt protection, copyright protection, etc.)

Output Protection:All input protections plus adherence checking and relevancy validation (More coming soon like hallucination detection, etc.) We also auto unredact the response if it was redacted on input.

-

MCP Config is an array of MCP servers likemcp_server_1,mcp_server_2,mcp_server_3etc.

User is a user of the gateway with unique email and ID

A project is a collection of users that share an MCP Config

- Project has a name and unique ID
- The MCP Config can be updated or can be pointed to a different config by the Admin
- Users can be added to multiple projects

An API Key is created for a user and project combination

- A user can have different API Keys for different projects
- This API Key is used to authenticate the user and identify the right project and MCP Config

2. High level steps of how the MCP Gateway works

Your MCP client connects to the Secure MCP Gateway server with API Key (handled bysrc/secure_mcp_gateway/gateway.py).

- It caches the config locally or in an external cache server like KeyDB if configured to improve performance.

If input guardrails are enabled, request is validated before the tool call (handled bysrc/secure_mcp_gateway/guardrail.py).

- Request is blocked if it violates any of the configured guardrails and the specific detector is configured to block.

Requests are forwarded to the Gateway Client (handled bysrc/secure_mcp_gateway/client.py).

The Gateway client forwards the request to the appropriate MCP server (handled bysrc/secure_mcp_gateway/client.py).

The MCP server processes the request and returns the response to the Gateway client.

If it was a discover tools call, the Gateway client caches the tools locally or in an external cache server like KeyDB if configured. It then forwards the response to the Gateway server.

The Gateway server receives the response from the Gateway client and if output guardrails are enabled, it validates the response against the configured guardrails (handled bysrc/secure_mcp_gateway/guardrail.py).

- Response is blocked if it violates any of the configured guardrails and the specific detector is configured to block.

The Gateway server forwards the response back to the MCP client if everything is fine.

Python 3.11or higher installed on your system and is accessible from the command line using eitherpythonorpython3command

pip 25.0.1or higher is installed on your system and is accessible from the command line using eitherpiporpython -m pipcommand

uv 0.7.9or higher is installed on your system and is accessible from the command line using eitheruvorpython -m uvcommand

-

Check if Python, pip and uv are installed

If any of the below commands fail, please refer the respective documentation to install them properly

# ------------------ # Python # ------------------ python --version # Example output Python 3.13.3 # If not, install python from their website and run the version check again # ------------------ # pip # ------------------ pip --version # Example output pip 25.0.1 from C:\Users\PC\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.13_qbz5n2kfra8p0\LocalCache\local-packages\Python313\site-packages\pip (python 3.13) # If not, try the following and run the version check again python -m ensurepip # ------------------ # uv # ------------------ uv --version # Or run with "python -m" if uv is not found directly # If this works, use "python -m" before all uv commands from now on python -m uv --version # Example output uv 0.7.9 (13a86a23b 2025-05-30) # If not, try the following and run the version check again python -m pip install uv

-

Any other dependencies required for the MCP servers we want to proxy requests to

-

Follow the instructions of the respective MCP server to install its dependencies

(Optional) A cache server like KeyDB installed and running (If you want to cache externally and not locally)

If you want to protect your MCPs with Enkrypt Guardrails, you need to do the following:

-

Create a new account if you don't have one. It's free! 🆓 No credit card required 💳🚫

To protect your MCPs with Guardrails, you can use the default sample GuardrailSample Airline Guardrailto get started or you can create your own custom Guardrail

To configure custom Guardrails, you need to either login to Enkrypt AI App or use the APIs/SDK

-

python -m venv .secure-mcp-gateway-venv # Activate the virtual environment # On Windows .secure-mcp-gateway-venv\Scripts\activate # On Linux/macOS source .secure-mcp-gateway-venv/bin/activate # Run the below to exit the virtual environment later if needed deactivate

-

This generates the config file at~/.enkrypt/enkrypt_mcp_config.jsonon macOS and%USERPROFILE%\.enkrypt\enkrypt_mcp_config.jsonon Windows

⚠️ Re-running on an existing config?generate-configrefuses to clobber an existing file by default — it exits withINFO: Config file already exists at <path>. ... use --overwrite flag.Add--overwriteto regenerate (a timestamped.bkp.<YYYYMMDD_HHMMSS>backup is written next to the original first). The flag also works with--provider enkryptbelow.

secure-mcp-gateway generate-config --overwrite

The default command emits the fulllocal-apikeyschema — a sample echo server, a default project, a user, and an auto-generated gateway API key — everything you need to boot offline. If you instead want the gateway to source its servers/projects/users fromEnkrypt cloud, generate the minimal cloud-backed config:

secure-mcp-gateway generate-config --provider enkrypt

This writes a much shorter file containing only:

- enkrypt_config.api_keyandbase_url(you fill in the apikey)
- plugins.auth.provider = "enkrypt"with agateway_nameplaceholder
- plugins.guardrails.provider = "enkrypt"
- plugins.telemetry.provider = "opentelemetry"(OTLP gRPC tolocalhost:4317, matching the local-apikey default and the bundled Prometheus/Grafana/Jaeger/Loki stack — setconfig.enabled: falseif you don't have a collector running)
- Two commonly-tweaked entries undercommon_mcp_gateway_config(enkrypt_log_level,enkrypt_gateway_cache_expiration_minutes)

No localmcp_configs/projects/users/apikeysblocks — the cloud owns those. After generation, edit the file and set:
- enkrypt_config.api_key→ your Enkrypt cloud apikey
- plugins.auth.config.gateway_name→ thesaved_nameof the gateway you created in the Enkrypt console

The shipped reference file issrc/secure_mcp_gateway/example_enkrypt_cloud_config.json— same shape the CLI generates. Use it as a template for hand-written configs.