Apache 2.0 CLI and protocol
The CLI and the tunnel protocol are open source. The production relay is run by Fetch Hive; point the CLI at your own relay with MCP_GATEWAY_RELAY_URL.
Open source, by Fetch Hive
Develop locally.
Connect anywhere.
Turn an OpenAPI spec, or any local MCP server, into an MCP URL with the open-source CLI. Your process stays on loopback and remote clients call https://<name>.mcp.fetchhive.com/mcp. Deploy a hosted gateway when you need the URL online without your machine.
No account for a temporary URL · Log in to keep the name · Apache 2.0
0
Accounts needed for a temporary URL
1
Outbound connection, no inbound port
1
Persistent name on the free plan
mcp-gateway · stripe-dev
$ mcp-gateway serve demo --tunnel --name stripe-dev
✓ reserved stripe-dev for account Developer (1/1 endpoints used)
Status
online
Local
http://127.0.0.1:8787/mcp
Remote
https://stripe-dev.mcp.fetchhive.com/mcp
Auth
bearer required
Lease
persistent, stays reserved while offline
Requests
in-flight 0 · total 3 · reconnects 0
POST 200 12ms
# no login? drop --name for an anonymous URL
Remote
https://acrpzzs3.mcp.fetchhive.com/mcp
Lease
anonymous, released 30 minutes after disconnect
Connects to the agents and editors you already use
Run it yourself, or let us host it.
Same compiler, same tools. Most people start with the open-source CLI while they build, and move to a hosted endpoint once other people depend on the URL.
I WANT TO
Use my API or MCP server while developing.
Install the CLI, compile a spec or point it at a server you already run, and your coding agent gets each endpoint as a tool. Add --tunnel when a remote client needs a URL. No account needed.
Localhost, plain HTTP, and private networks with an explicit opt-in
Streamable HTTP and stdio for Cursor, Claude Code, and Codex
--tunnel for a public HTTPS URL, with no inbound port
Log in once to keep the same name; the free plan includes 1
Homebrew, npx, curl, or Docker
I WANT TO
Publish an endpoint that stays online.
Paste a spec for a free readiness report, no sign-in needed. Then deploy it hosted at mcp.fetchhive.com/g/<slug>, so nothing has to keep running on your machine.
Scored report and provider checks before you sign up
Automatic schema fixes, with the diff shown before publish
Access tokens, rate limits, and daily quotas
Tool policy, request logs, and a playground
No card required
Install the CLI
macOS, Linux, and Windows · Apache 2.0
Homebrew
brew install Fetch-Hive/tap/mcp-gateway
Docker
docker run --rm -p 127.0.0.1:8787:8787 ghcr.io/fetch-hive/mcp-gateway:0.10.1 version
npx
npx --yes @fetch-hive/mcp-gateway version
curl | sh
curl -LsSf …/releases/latest/download/mcp-gateway-cli-installer.sh | sh
The Docker image runs inside a container. To tunnel an API running on your host, install with Homebrew, the installer script, or npx instead.
Then publish your first tunnel
first run · petstore
# 1. one-time setup; prints the bearer token once
$ mcp-gateway init
# 2. compile a public spec
$ mcp-gateway add-spec --name petstore --url https://petstore3.swagger.io/api/v3/openapi.json
# 3. serve it with a public HTTPS URL
$ export MCP_GATEWAY_TOKEN=… # the value init printed
$ mcp-gateway serve petstore --tunnel
Remote
https://acrpzzs3.mcp.fetchhive.com/mcp
Auth
bearer required
WHO CAN CALL THAT URL
Only clients that send your bearer token. The Fetch Hive relay turns away any request with no Authorization header, and mcp-gateway on your machine checks the token before anything reaches your API or MCP server, even one with no auth of its own.
The header is removed before your server sees the request
mcp-gateway tunnel generates a token if MCP_GATEWAY_TOKEN is unset
An open URL needs --tunnel-auth public, and the CLI warns you
Your process stays on loopback. Remote clients get HTTPS.
Start on your own machine, add a public URL when a remote client needs one, and keep the same name once you log in. One CLI covers all three.
01 · LOCAL API, LOCAL EDITOR
Your editor is on the same laptop.
Compile your spec and serve it on loopback. Cursor, Claude Code, or Codex on the same machine connect straight to it. Nothing leaves your laptop.
http://127.0.0.1:8787/mcp
02 · LOCAL PROCESS, REMOTE CLIENT
A remote client needs a URL.
Add --tunnel and get a random HTTPS URL with no signup. mcp-gateway checks the bearer token on every request before it reaches your process.
mcp-gateway serve demo --tunnel
03 · A URL THAT STAYS
Keep the same URL tomorrow.
Run mcp-gateway login once, then add --name stripe-dev. The hostname stays reserved while you are offline. The free plan includes 1 persistent name.
mcp-gateway serve demo --tunnel --name stripe-dev
How it works
STEP 1
Compile or point
Compile an OpenAPI spec with add-spec, or point tunnel at an MCP server you already run over Streamable HTTP or stdio.
STEP 2
Publish
--tunnel opens one outbound WebSocket to the relay. Remote clients reach you over HTTPS on *.mcp.fetchhive.com.
STEP 3
Paste
Paste the URL into the OpenAI Responses API, Claude Code, Cursor, or Codex. Local clients keep using 127.0.0.1:8787.
One URL. Clients send the bearer token mcp-gateway prints.
OpenAI Responses API
Claude Code
Cursor
Codex
VS Code
Open source · mcp-gateway
Your local API, inside your coding agent, in five commands.
The same compiler that powers the hosted report ships as a single Rust binary under Apache 2.0. Point it at localhost:3000, a WIP branch, or a Docker Compose stack, and Claude Code, Codex, or Cursor can call the exact tools you are about to ship.
local branch → cursor
# 1. one-time setup; the bearer token is printed once
$ mcp-gateway init --allow-private-networks
# 2. compile the spec that lives in this checkout
$ mcp-gateway add-spec --name demo --file ./openapi.yaml --base-url http://127.0.0.1:3000 --insecure-http
# 3. call a tool before wiring any editor
$ mcp-gateway test demo list_pets --args ‘{}’
# 4. serve over Streamable HTTP or stdio
$ mcp-gateway serve demo
# 5. print the snippet for your client
$ mcp-gateway inspect demo --client cursor # codex | claude-code | vscode | claude
Built for the API that isn’t live yet.
Most MCP tooling assumes a public HTTPS API. mcp-gateway assumes the opposite: your server is running on this machine, on plain HTTP, behind a private network, and you want your agent to exercise it while you write the code. Loopback and RFC1918 are opt-in, the default bind is loopback, and nothing leaves your laptop unless you say so.
Same compiler as the hosted report: OpenAPI 3.0 and 3.1 to a versioned IR
Streamable HTTP and stdio transports, plus --tunnel for a public URL
Upstream credentials injected from env or file references, never stored in config
SSRF-hardened outbound dialer; binding 0.0.0.0 requires an explicit --expose
Swap --file for --url and the same flow proxies any live API
Or self-host it with one click
One public URL, from a spec or a server you already run.
Compile an OpenAPI spec and publish it, or put a tunnel in front of any local MCP server. Both print a random https://<slug>.mcp.fetchhive.com/mcp URL and require a bearer token by default.
serve · OpenAPI spec
# serve the spec you added with add-spec
$ mcp-gateway serve demo --tunnel
Remote
https://acrpzzs3.mcp.fetchhive.com/mcp
Auth
bearer required
Lease
anonymous, released 30 minutes after disconnect
tunnel · any MCP server
# a Streamable HTTP server on loopback
$ mcp-gateway tunnel http://127.0.0.1:8000/mcp
# or a stdio server
$ mcp-gateway tunnel --stdio -- npx -y @modelcontextprotocol/server-filesystem /tmp
Remote
https://k3v9x2qa.mcp.fetchhive.com/mcp
Auth
bearer 6Jq…Xw (generated for this session)
NO ACCOUNT REQUIRED
Anonymous URL. No signup.
The URL is released 30 minutes after the CLI exits. Free includes 1 persistent endpoint when you want to keep it.
Want the same URL tomorrow?
A name that stays.
Log in once from the CLI and reserve a hostname. It stays reserved while your laptop is off, so the URL you pasted into a client yesterday still works when you start the tunnel again.
persistent name
$ mcp-gateway login
# approve the code in your browser, no password
$ mcp-gateway serve demo --tunnel --name stripe-dev
✓ reserved stripe-dev for account Developer (1/1 endpoints used)
$ mcp-gateway tunnels list
stripe-dev https://stripe-dev.mcp.fetchhive.com/mcp offline
# done with it? release the name
$ mcp-gateway tunnels delete stripe-dev --yes
released stripe-dev; a running tunnel using it will disconnect.
PERSISTENT NAMES BY PLAN
Compare plans
1
Developer
3
Growth
10
Pro
Unlimited
Enterprise
Reserve it once. Keep it while offline.
--name turns the tunnel on and claims the hostname for your account. Stop the CLI and the name stays yours. Start it again with the same name and the same URL comes back.
The free plan includes 1 persistent name
Release it with mcp-gateway tunnels delete stripe-dev --yes, or the Release action in the app
After release the hostname stops working and the name can be claimed again
mcp-gateway login needs no password: approve a code at app.fetchhive.com/cli/authorize
app.fetchhive.com/mcp/tunnels
Local tunnels
Expose a local mcp-gateway serve as a public MCP endpoint. Anonymous tunnels need no account; log in from the CLI to keep a fixed name.
Persistent endpoints
NAME
STATUS
stripe-dev
Offline · last seen 2h ago
Anonymous tunnels don’t appear here. They’re released 30 minutes after the CLI disconnects.
CLI tokens
Created by mcp-gateway login
NAME
TOKEN
MacBook Pro
fh_cli_••••••••
What the tunnel does, and what it doesn’t.
The CLI and the wire protocol are open source. The relay only carries MCP traffic, and the token check runs in mcp-gateway on your machine.
Hosted gateway · How the report is built
Six stages, one live audit trail.
Paste a URL or upload JSON or YAML. The compiler walks your document stage by stage and shows its work, so you can see exactly why a tool passed, warned, or blocked.
1
PARSE
Read and map the document.
We resolve the URL or file, check the format and encoding, parse JSON or YAML, and detect the OpenAPI version. Operations, schema surfaces, auth methods, and server groups are identified before any tool is built.
OpenAPI 3.0 and 3.1, JSON or YAML
Recognized structure: operations, schemas, auth, tool groups
Reads from a public URL or a local upload
2
BUILD TOOLS
Compile every operation into a callable tool.
Each operation becomes a named MCP tool with a clear route, an input surface, and an agent-safety hint. Names come from operationId where it exists and are derived from method and path where it doesn’t.
Grouped by tag so agents can browse
Read only vs. Writes data derived from the HTTP method
Input count and route shown per tool
3
AUDIT SCHEMAS
Test whether agents can call every tool safely.
Input shape, parameter guidance, response contracts, and schema complexity are inspected tool by tool. Anything that would make a model guess, overflow, or send a payload your API rejects becomes a finding.
Validates every input schema and measures depth and breadth
Checks tool descriptions for agent legibility
Audits parameter documentation and required sets
4
VALIDATE MCP
Prove the output is protocol-correct.
Compiled tools are checked against MCP and JSON-RPC 2.0 before you ever connect a client: single-message framing, tool-name rules, name uniqueness, reserved method names, and object input schemas.
readOnly, destructive, and idempotent hints derived from HTTP
Generated tool preview shown as JSON-RPC 2.0
Zero protocol issues before publish
Findings
Every finding tells you what breaks, why, and how to fix it.
Findings are graded Blocker, Warning, or Improvement and list the exact operations affected. Most schema issues are deterministic and can be fixed automatically after you sign up, with the diff shown before it is applied.
Blocker
1 operation
Binary request body
Binary bodies cannot be expressed as MCP JSON arguments.
Expose a JSON alternative, or keep the binary upload off this gateway.
Warning
Automatic fix
6 operations
Schemas leave additionalProperties open
OpenAI strict mode and several hosts reject object schemas that still allow unknown keys.
Set additionalProperties to false on every object schema and list every allowed key.
Warning
Automatic fix
16 operations
Parameters lack descriptions
Agents guess required arguments when properties have no description, which produces invalid calls.
Document every required property: type, allowed values, and what happens if it is omitted.
Warning
Automatic fix
4 operations
Arrays have no maxItems
Unbounded arrays let an agent send huge payloads that time out or blow the token budget.
Set maxItems to a realistic ceiling and document the pagination or batching contract.
Warning
3 operations
Tool descriptions are too weak to be useful
Descriptions shorter than 24 characters, or equal to the tool name, do not tell a model when to call the tool.
Expand each description with the resource, the side effects, and a concrete example of a good call.
Improvement
2 operations
Too many required parameters
Tools that demand a long required list are hard to call correctly on the first try.
Move optional filters out of required, provide defaults, and keep required to the identifiers the call cannot work without.
Stage 5 · Check providers
Know it works in OpenAI, Anthropic, and Gemini before you ship.
Each provider enforces its own tool-naming rules, schema subset, and payload caps. We compare your compiled tool surface against all three so an agent never sees a tool it can’t load.
OpenAI
Strict mode is the strictest of the three. Names and nesting are checked against the published function-calling limits.
Function names match ^[a-zA-Z0-9_-]{1,64}$
Dots are legal in MCP but rejected here
10-level nesting cap, 5000-property cap
1000 enum values per schema
Anthropic
Claude accepts most of JSON Schema, but recursive references and sprawling optional sets hurt call accuracy.
Function names: letters, digits, underscore, or hyphen
No recursive $ref chains
Tight optional-parameter limits
Required-field coverage checked
Gemini
Gemini supports a smaller JSON Schema subset and shorter names, so unions and references get flagged early.
Shorter tool-name ceiling
Smaller JSON Schema subset
anyOf and oneOf flagged for review
Reference depth checked
Your specification stays private during this check. Compatibility is evaluated against deterministic provider requirements; nothing is sent to OpenAI, Anthropic, or Gemini.
Stage 6 · Token cost
Stop paying for every schema on every turn.
A raw tools/list call ships every input schema to the model each time the agent thinks. The gateway sends compact, searchable metadata by default and resolves the full schema only for the tool the agent actually picks.
Smaller tool context on every request, without dropping tools
Resolve full schemas by ID: the agent expands only the selected tool
Token cost is one of the six scored categories in every report
Oversized-schema findings tell you exactly which tools to split
Tool context per request
Example: Petstore, 18 compiled tools
72% SMALLER
Raw tools/list · every full schema
18 schemas · 100%
Fetch Hive metadata · schema on demand
18 tools · 28%
Resolve full schemas by ID. When an agent picks update_pet, only that schema is expanded, instead of re-reading all 18 on every turn.
Hosted gateway
Everything a production MCP endpoint needs, already wired.
Publishing is one click. What you get is a dedicated endpoint with the operational controls you would otherwise build yourself: tokens, limits, tool policy, upstream auth, and logs.
Access tokens
Mint named tokens for each client or teammate. Shown once, revocable instantly, with an optional daily cap and per-minute rate on every token.
Rate limits and quotas
Per-gateway requests-per-minute and daily request limits, with a 60/min default. Pause a gateway and it keeps its URL but rejects new calls.
Tool policy
Enable or disable individual tools, rename them for clarity, or apply a Read-only, Balanced, or Full-access preset. Destructive operations need an explicit confirmation.
Upstream authentication
Bearer, Basic, API-key header, or custom headers to your API, stored separately from gateway tokens and tested before you deploy.
Request logs
Every call recorded with tool, status, duration, origin, and a payload excerpt, searchable by tool and linked from the overview.
MCP playground
Chat with an agent that can call the enabled tools on your gateway, so you can test it the way a customer's agent will before you share the URL.
Connect snippets
Ready-to-paste config for Claude, Claude Code, ChatGPT connectors, Cursor, VS Code, and any generic Streamable HTTP client with a bearer token.
Re-import and redeploy
Point at a new spec version to recompile, review the fresh report, and publish the enabled tools and auth to the same endpoint.
PART OF THE FETCH HIVE PLATFORM
Your gateway is the front door. The rest of the platform is behind it.
Hosted MCP starts on the free Developer plan with no card. The same account gives you agents that can call your tools, workflows that run them on a schedule, and one place to manage usage across all of it.
Questions engineers ask before they paste a spec.
Everything else is in the docs, the CLI reference, and the GitHub README.
No. Paste a public OpenAPI URL or upload a JSON or YAML file at app.fetchhive.com/mcp-onboarding and the full report, findings, and provider checks run before any sign-in. You only create a free account when you want to apply automatic fixes or publish a hosted endpoint.
Start on yoour laptop.
Host it when it nneeds to stay up.
$ brew install Fetch-Hive/tap/mcp-gateway