| MCP Gateway | One endpoint per profile: routing, tool names, circuit breakers |
| Per-Agent Profiles | Profile schema, modes, minifying, roles, multi-agent setup |
| Operator Profile | The agent that installs and runs the gateway |
| Configuration | Every environment variable |
| Authentication | Static bearer, OAuth proxy with DCR or a provisioned client, delegated issuers |
| Backend OAuth | Each profile signs in to OAuth-only backends with its own grant |
| Defense Pipeline | L1/L2/L3, modes, coverage and known gaps |
| Benchmark | Detection rates per layer and per L3 provider |
| Corpora | Every attack and benign set the defense is measured on |
| Prompt Packs | The judge's prompts tuned per model |
| Content Tools | fetch, read, dir, content, search, with an egress guard and file confinement |
| Blocklist | A refused source stays refused |
| Tool Filtering | Allowlists, denylists, glob patterns |
| Tool Pinning | A new or changed tool is held until approved |
| Tool Discovery | Find/call or per-session loading for clients without tool search |
| Description Compression | Description compression and schema compaction |
| Token Routing | Response minifying (implemented); delegation (proposed) |
| Semantic Request Guards | A judge reads calls to listed tools against a policy in plain English |
| Semantic Response Guards | A judge reads listed tools' responses against a policy before delivery |
| Literal Request Guards | Per-tool argument validation |
| Literal Response Guards | Per-tool result validation |
| Audit Log | Call recording, stats, monitoring |
| LLM Key Proxying | Provider keys kept inside the gateway |
| Matrix Bridge | E2EE termination and two-way judging |
| Channel Bridges | More than one upstream per agent (RCS, ...) and the bridge wire contract |
| Matrix Reverse Proxy | Matrix for agents on an isolated network |
| Client Egress | A CONNECT tunnel to listed hosts for the agent's own client |
| Git Transport | Clone, fetch and push to listed repositories and branches |
| Federation | A second gateway's tools mounted over a trusted edge, scanned once |
| HTTP(S) Egress | An agent's outbound request judged and re-originated to a named destination |
| Deployment Hardening | Container flags, secrets, egress, the startup check |
| Plugins | Write, test, install and name your own transform plugins |
| Cockpit Plugin | Live defense pipeline dashboard |
| Internal: Gateway Design | Original design document, for contributors |
