metatool-ai/metamcp

git clone https://github.com/metatool-ai/metamcp.git && cd metamcp && cp example.env .env
docker compose up -d
pnpm install && pnpm dev  (local development)

Usage

• •Create a namespace, add MCP servers (STDIO or HTTP) to it, then create an endpoint assigned to that namespace
• •Connect Cursor via mcp.json with `{"url": "http://localhost:12008/metamcp/<ENDPOINT>/sse"}`
• •Connect stdio-only clients like Claude Desktop via `uvx mcp-proxy --transport streamablehttp http://localhost:12008/metamcp/<ENDPOINT>/mcp` with API_ACCESS_TOKEN env (mcp-remote does not work with API-key auth)
• •Open a namespace > Tools tab to override tool names/titles/descriptions and attach annotations per namespace

Key features

• ✓Group MCP servers into namespaces; expose as SSE, streamable HTTP, or OpenAPI endpoints (for Open WebUI)
• ✓Middleware at namespace level (built-in example: filter inactive tools to optimize tool context)
• ✓Tool overrides & annotations merged with upstream metadata
• ✓Auth: Better Auth, session cookies, API keys (Bearer), MCP OAuth (Spec 2025-06-18), OIDC/SSO (Auth0, Keycloak, Azure AD, Google, Okta), multi-tenancy with private/public scopes
• ✓MCP rate limiting (endpoint-level and per-user), registration controls for enterprise, built-in Inspector with saved server configs

Best for

Teams that want to host dynamically composed MCP endpoints as infrastructure with auth, rate limiting, and per-namespace tool governance.

Caveats

• ⚠Author acknowledges maintenance delay but is still merging PRs
• ⚠Requires Postgres (docker compose starts one; volume name may collide with other pg dockers)
• ⚠Endpoints are remote-only (SSE/streamable HTTP/OpenAPI) — stdio-only clients need the local `mcp-proxy` bridge; mcp-remote is explicitly not recommended for API-key auth
• ⚠`?api_key=` param auth only works for streamable HTTP and OpenAPI, not SSE; use the Authorization: Bearer header
• ⚠MCP servers needing dependencies beyond uvx/npx require customizing the Dockerfile
• ⚠Requires 2GB-4GB memory for online/VPS deployment; CORS enforced on APP_URL only