alifanov/scopegate

docker compose --profile local up (no .env needed; admin login printed once in container logs)
Or clone + docker compose --profile local up, then browse to http://localhost:3000.
To connect real services, copy .env.example to .env and fill OAuth client id/secret for the providers you want.
Dev setup: pnpm install, cp .env.example .env, pnpm prisma migrate dev, pnpm dev.

Usage

• •Log in with the printed admin credentials; create a Project, connect a Service, and create an MCP endpoint with selected permissions.
• •Plug the endpoint URL into any MCP-compatible AI agent via Streamable HTTP — only allowed actions are exposed.
• •Monitor every request (who, which tool, outcome, duration) in the per-project exportable audit log.
• •Revoke/regenerate an endpoint key with one click without touching the service connection.

Key features

• ✓Per-action permission groups finer than any provider's OAuth scopes (e.g. gmail:read_emails without gmail:send_email).
• ✓AES-256-GCM token encryption at rest with automatic refresh — agents only ever see sg_… keys.
• ✓Provider registry (27 providers incl. Google Workspace, Google Ads & Search Console, Meta, LinkedIn, Twitter, Slack, Notion, Jira, HubSpot, Salesforce, Stripe, Airtable) is a single-editable file; SSRF-safe transport.
• ✓Next.js 16 (App Router) + Prisma 7 + Better Auth (DB-backed sessions) + Tailwind v4/shadcn; Streamable HTTP via @modelcontextprotocol/sdk.
• ✓Self-hosted has full feature parity with the hosted cloud version; permissions derived from the provider registry.

Best for

Developers/agencies who want to grant AI agents fine-grained, revocable access to client accounts without sharing full OAuth scopes or API keys.

Caveats

• ⚠Needs Docker (or Node 20.19+/22.12+/24+, pnpm, Postgres) — local mode provisions Postgres + BETTER_AUTH_SECRET automatically.
• ⚠The admin login/password is printed in container logs on first boot; treat those logs as secrets.
• ⚠Real service connections require you to provide each provider's OAuth client id/secret; missing credentials just hide that provider.
• ⚠Self-host only (MCP over Streamable HTTP); no hosted offering described in the README.