remote mcp gateway

One control plane for every MCP your agents need.

Connect provider tools once, keep credentials vaulted, route every agent through one Streamable HTTP endpoint, and make email login, approvals, billing, and audit evidence production-visible.

bun install -g @hasna/mcps && mcps auth login

Start setup Open catalog

CodexClaudeGeminiCursorOpenCodeAny MCP host

production gatewayready

providers

NotionOAuth ready

content + search

LinearVerified

issues + teams

SlackCataloged

messages

PostgresPolicy gated

queries

request path

Email OTP

confirm sign-in

Vault

store provider refs

Approvals

gate sensitive calls

MCP

one HTTP endpoint

POST /api/mcp
Authorization: Bearer ak_...
tool: provider_notion_search

provider control

Real tools, one gateway boundary.

mcps.md keeps direct provider installs out of agent clients. Agents talk to the platform, the platform handles OAuth or API credentials, and operators can see, approve, revoke, and audit the path.

Email confirmation

Users sign in with an email OTP and receive the same confirmation flow production uses.

Scoped API keys

Each agent uses one platform key. Provider credentials stay behind the gateway.

Approval gates

Sensitive or paid provider calls pause for policy checks before execution.

Credit accounting

Plans handle access. Dollar balance covers premium or externally metered runs.

install path

Local install stays simple.

The SaaS wrapper remains private. Local install uses the upstream `@hasna/mcps` package, then points every client at the hosted gateway.

Install the CLI

Use the upstream local package for development and client setup.

bun install -g @hasna/mcps

Confirm email login

Request a one-time code, confirm the mailbox, and issue a platform session.

mcps auth login

Generate one config

Write Codex, Claude, Gemini, Cursor, or generic Streamable HTTP config from the same gateway.

mcps client-config generate --client codex

Client config is generated, not hand-maintained.

The config generator writes one platform MCP server entry and rejects direct provider MCP installs beside it. That keeps Codex, Claude, Gemini, Cursor, and generic MCP hosts on the same security model.

contract

Bearer tokens are read from environment variables, never inlined.

Provider tool calls carry tenant-bound organization context.

Sensitive requests require explicit approval records.

Smoke tests cover generated configs and Streamable HTTP transport.

pricing

Access plan plus metered runs.

Platform access and dollar balance stay separate, matching the production billing contract and making premium provider work auditable.

OSS

Local development and public gateway smoke checks.

Local stdio configs
Public provider metadata
Community support

Team

$10

Hosted gateway access for real agents and provider connections.

Email OTP login
API keys
Provider OAuth
Approval logs

Enterprise

Custom

Controlled rollout for internal tools and compliance needs.

SSO planning
Custom policies
Dedicated runbooks
Private support

Capability	OSS	Team	Enterprise
One MCP gateway	Yes	Yes	Yes
Provider OAuth vault	Local only	Hosted	Hosted
Approval policy	Manual	Team	Custom
Audit trail	Local logs	Production logs	Exportable