Access tokens
Mint named tokens for each client or teammate. Shown once, revocable instantly, with an optional daily cap and per-minute rate on every token.
MCP Gateway
One spec. Every agent.
Zero glue code.
Turn your OpenAPI document into MCP tools that Claude Code, Codex, Cursor, and your own products can call. Get a scored readiness report before you sign in, fix what would break, then run it locally with the open source CLI or publish a hosted endpoint.
No account needed to analyze · OpenAPI 3.0 and 3.1 · JSON or YAML
6
Audit stages, parse to score
3
Providers checked: OpenAI, Anthropic, Gemini
1
Rust binary, Apache 2.0 licensed
Connects to the agents and editors you already use
Two ways to run it
Built for your laptop and for your production traffic.
The same compiler produces the same tool surface either way. Run it yourself next to the code you’re writing, or let Fetch Hive host it for the people who call your API.
Open source · Apache 2.0
FOR THE API YOU’RE BUILDING
Run the gateway beside your code.
mcp-gateway is a single Rust binary. Point it at the service on your laptop or a live API you depend on, and your coding agent gets every endpoint as a tool while you work. No SDK, no hand-written MCP server.
Localhost and private networks with an explicit opt-in
Streamable HTTP and stdio, so every MCP client connects
Bearer token printed once; secrets stay in env vars, never in config
One-click deploy templates for Render, Heroku, and DigitalOcean
Hosted · Free forever plan
FOR THE API OTHER PEOPLE CALL
Publish an endpoint any agent can use.
Paste a spec and get a scored readiness report without signing in. Create a free account to apply deterministic fixes, curate the tool list, and publish a dedicated MCP endpoint your customers and teammates can add to any agent.
Full report, findings, and provider checks before signup
Automatic schema fixes with the exact diff shown before publish
Scoped access tokens, rate limits, and daily quotas
Enable or disable tools; redacted request logs
How the report is built
Six stages, one live audit trail.
Paste a URL or upload JSON or YAML. The compiler walks your document stage by stage and shows its work, so you can see exactly why a tool passed, warned, or blocked.
1
PARSE
Read and map the document.
We resolve the URL or file, check the format and encoding, parse JSON or YAML, and detect the OpenAPI version. Operations, schema surfaces, auth methods, and server groups are identified before any tool is built.
OpenAPI 3.0 and 3.1, JSON or YAML
Recognized structure: operations, schemas, auth, tool groups
Reads from a public URL or a local upload
2
BUILD TOOLS
Compile every operation into a callable tool.
Each operation becomes a named MCP tool with a clear route, an input surface, and an agent-safety hint. Names come from operationId where it exists and are derived from method and path where it doesn’t.
Grouped by tag so agents can browse
Read only vs. Writes data derived from the HTTP method
Input count and route shown per tool
3
AUDIT SCHEMAS
Test whether agents can call every tool safely.
Input shape, parameter guidance, response contracts, and schema complexity are inspected tool by tool. Anything that would make a model guess, overflow, or send a payload your API rejects becomes a finding.
Validates every input schema and measures depth and breadth
Checks tool descriptions for agent legibility
Audits parameter documentation and required sets
4
VALIDATE MCP
Prove the output is protocol-correct.
Compiled tools are checked against MCP and JSON-RPC 2.0 before you ever connect a client: single-message framing, tool-name rules, name uniqueness, reserved method names, and object input schemas.
readOnly, destructive, and idempotent hints derived from HTTP
Generated tool preview shown as JSON-RPC 2.0
Zero protocol issues before publish
Findings
Every finding tells you what breaks, why, and how to fix it.
Findings are graded Blocker, Warning, or Improvement and list the exact operations affected. Most schema issues are deterministic and can be fixed automatically after you sign up, with the diff shown before it is applied.
Blocker
1 operation
Binary request body
Binary bodies cannot be expressed as MCP JSON arguments.
Expose a JSON alternative, or keep the binary upload off this gateway.
Warning
Automatic fix
6 operations
Schemas leave additionalProperties open
OpenAI strict mode and several hosts reject object schemas that still allow unknown keys.
Set additionalProperties to false on every object schema and list every allowed key.
Warning
Automatic fix
16 operations
Parameters lack descriptions
Agents guess required arguments when properties have no description, which produces invalid calls.
Document every required property: type, allowed values, and what happens if it is omitted.
Warning
Automatic fix
4 operations
Arrays have no maxItems
Unbounded arrays let an agent send huge payloads that time out or blow the token budget.
Set maxItems to a realistic ceiling and document the pagination or batching contract.
Warning
3 operations
Tool descriptions are too weak to be useful
Descriptions shorter than 24 characters, or equal to the tool name, do not tell a model when to call the tool.
Expand each description with the resource, the side effects, and a concrete example of a good call.
Improvement
2 operations
Too many required parameters
Tools that demand a long required list are hard to call correctly on the first try.
Move optional filters out of required, provide defaults, and keep required to the identifiers the call cannot work without.
Stage 5 · Check providers
Know it works in OpenAI, Anthropic, and Gemini before you ship.
Each provider enforces its own tool-naming rules, schema subset, and payload caps. We compare your compiled tool surface against all three so an agent never sees a tool it can’t load.
OpenAI
Strict mode is the strictest of the three. Names and nesting are checked against the published function-calling limits.
Function names match ^[a-zA-Z0-9_-]{1,64}$
Dots are legal in MCP but rejected here
10-level nesting cap, 5000-property cap
1000 enum values per schema
Anthropic
Claude accepts most of JSON Schema, but recursive references and sprawling optional sets hurt call accuracy.
Function names: letters, digits, underscore, or hyphen
No recursive $ref chains
Tight optional-parameter limits
Required-field coverage checked
Gemini
Gemini supports a smaller JSON Schema subset and shorter names, so unions and references get flagged early.
Shorter tool-name ceiling
Smaller JSON Schema subset
anyOf and oneOf flagged for review
Reference depth checked
Your specification stays private during this check. Compatibility is evaluated against deterministic provider requirements; nothing is sent to OpenAI, Anthropic, or Gemini.
Stage 6 · Token cost
Stop paying for every schema on every turn.
A raw tools/list call ships every input schema to the model each time the agent thinks. The gateway sends compact, searchable metadata by default and resolves the full schema only for the tool the agent actually picks.
Smaller tool context on every request, without dropping tools
Resolve full schemas by ID: the agent expands only the selected tool
Token cost is one of the six scored categories in every report
Oversized-schema findings tell you exactly which tools to split
Tool context per request
Example: Petstore, 18 compiled tools
72% SMALLER
Raw tools/list · every full schema
18 schemas · 100%
Fetch Hive metadata · schema on demand
18 tools · 28%
Resolve full schemas by ID. When an agent picks update_pet, only that schema is expanded, instead of re-reading all 18 on every turn.
Open source · mcp-gateway
Your local API, inside your coding agent, in five commands.
The same compiler that powers the hosted report ships as a single Rust binary under Apache 2.0. Point it at localhost:3000, a WIP branch, or a Docker Compose stack, and Claude Code, Codex, or Cursor can call the exact tools you are about to ship.
local branch → cursor
# 1. one-time setup; the bearer token is printed once
$ mcp-gateway init --allow-private-networks
# 2. compile the spec that lives in this checkout
$ mcp-gateway add-spec --name demo --file ./openapi.yaml --base-url http://127.0.0.1:3000 --insecure-http
# 3. call a tool before wiring any editor
$ mcp-gateway test demo list_pets --args ‘{}’
# 4. serve over Streamable HTTP or stdio
$ mcp-gateway serve demo
# 5. print the snippet for your client
$ mcp-gateway inspect demo --client cursor # codex | claude-code | vscode | claude
Built for the API that isn’t live yet.
Most MCP tooling assumes a public HTTPS API. mcp-gateway assumes the opposite: your server is running on this machine, on plain HTTP, behind a private network, and you want your agent to exercise it while you write the code. Loopback and RFC1918 are opt-in, the default bind is loopback, and nothing leaves your laptop unless you say so.
Same compiler as the hosted report: OpenAPI 3.0 and 3.1 to a versioned IR
Streamable HTTP and stdio transports; works with every MCP client
Upstream credentials injected from env or file references, never stored in config
SSRF-hardened outbound dialer; binding 0.0.0.0 requires an explicit --expose
Swap --file for --url and the same flow proxies any live API
Install it your way
Homebrew
brew install Fetch-Hive/tap/mcp-gateway
Docker
docker run ghcr.io/fetch-hive/mcp-gateway
npx
npx --yes @fetch-hive/mcp-gateway
curl | sh
curl -LsSf …/mcp-gateway-installer.sh | sh
cargo
cargo install --path crates/mcp-gateway-cli
Or self-host it with one click
Hosted gateway
Everything a production MCP endpoint needs, already wired.
Publishing is one click. What you get is a dedicated endpoint with the operational controls you would otherwise build yourself: tokens, limits, tool policy, upstream auth, and logs.
Rate limits and quotas
Per-gateway requests-per-minute and daily request limits, with a 60/min default. Pause a gateway and it keeps its URL but rejects new calls.
Tool policy
Enable or disable individual tools, rename them for clarity, or apply a Read-only, Balanced, or Full-access preset. Destructive operations need an explicit confirmation.
Upstream authentication
Bearer, Basic, API-key header, or custom headers to your API, stored separately from gateway tokens and tested before you deploy.
Request logs
Every call recorded with tool, status, duration, origin, and a payload excerpt, searchable by tool and linked from the overview.
MCP playground
Chat with an agent that can call the enabled tools on your gateway, so you can test it the way a customer's agent will before you share the URL.
Connect snippets
Ready-to-paste config for Claude, Claude Code, ChatGPT connectors, Cursor, VS Code, and any generic Streamable HTTP client with a bearer token.
Re-import and redeploy
Point at a new spec version to recompile, review the fresh report, and publish the enabled tools and auth to the same endpoint.
PART OF THE FETCH HIVE PLATFORM
Your gateway is the front door. The rest of the platform is behind it.
Hosted MCP starts on the free Developer plan with no card. The same account gives you agents that can call your tools, workflows that run them on a schedule, and one place to manage usage across all of it.
Questions engineers ask before they paste a spec.
Everything else is in the docs, the CLI reference, and the GitHub README.
No. Paste a public OpenAPI URL or upload a JSON or YAML file at app.fetchhive.com/mcp-onboarding and the full report, findings, and provider checks run before any sign-in. You only create a free account when you want to apply automatic fixes or publish a hosted endpoint.
