A gateway that sits in front of your MCP server
The AdminKit MCP & Agent Gateway is a proxy that Netbase deploys and runs in front of your MCP server as a custom engagement: it verifies OAuth tokens, enforces a tool allowlist and per-caller rate limits, filters known prompt-injection patterns from tool responses, and logs every call, so you get authorization and an audit trail without building either.
Updated
At a glance
adminkit-mcp server is on PyPI (see connect an AI agent to AdminKit’s MCP server).What problem does the MCP & Agent Gateway solve?
Model Context Protocol servers give AI agents the ability to call real tools: reading files, querying databases, hitting internal APIs. That’s useful, but it also means anyone who can reach the server, and anything the server is told to trust, inherits whatever access those tools provide.
Many MCP servers are stood up quickly during prototyping and never get a proper authorization layer added before they’re exposed. Even once auth is in place, there’s often no record of which tools were called, by whom, or what came back, which makes it hard to notice misuse or debug a problem after the fact.
Tool responses themselves are a second risk: if a tool returns content from an untrusted source, that content can contain instructions aimed at manipulating the agent reading it, a pattern commonly referred to as prompt injection.
Who is the MCP & Agent Gateway for?
Teams publishing an MCP server
Authorization and logging in front of your server without building either yourself.
See the solution →
AI agency builders
One controlled entry point for agent workflows that call several MCP servers.
See the solution →
Security and compliance reviewers
An audit trail of what an agent actually did, not just what it was asked to do.
See the solution →
How does the MCP & Agent Gateway work?
The gateway sits between the agent and your MCP server. Every call first goes through an OAuth check, the tool allowlist and a per-caller rate limit; calls that pass are forwarded to your server, and calls that don’t are refused. Tool responses coming back are screened against known prompt-injection patterns, and matching text is redacted before it reaches the agent. Every call — allowed, filtered or blocked — is written to the audit log with the caller, tool, decision and time.
The agent calls the gateway
An AI agent sends its tool call, with its OAuth token, to the gateway instead of straight to your MCP server.
Token and allowlist checked
The token must be issued for the gateway itself, the tool must be on the allowlist, and the caller must be within its rate limit.
Forwarded with the gateway's own credential
Allowed calls reach your server without the caller's token. Everything else is refused before it gets there.
Response screened and logged
Known prompt-injection patterns are redacted from the response, and the decision is written to the audit log.
What do you get with the MCP & Agent Gateway?
OAuth without token passthrough
Each caller's token is verified by the gateway, and never forwarded to your server.
Audience must match the gateway, per the MCP authorization spec
Tool allowlist
Only the tools you agree are listed or callable; anything else is refused before it reaches your server.
Applies to tools/list and tools/call
Per-caller rate limits
One misbehaving agent can't exhaust your server for everyone else.
Keyed to the verified caller identity
Prompt-injection filtering
Tool-response text matching a documented list of known injection patterns is redacted before the agent reads it.
Every match recorded as allowed_filtered
An audit log of every call
Caller, tool, decision and time for each call, allowed or blocked, ready for review.
Append-only JSON Lines
In front of your existing server
Your MCP server keeps running as it is; the gateway is a proxy in front of it.
Built on FastMCP
What does an engagement include?
| Part of the engagement | What Netbase does |
|---|---|
| Review | Check your MCP server’s exposure and auth, starting with mcp-check |
| OAuth | Connect the gateway to your identity provider; tokens must be issued for the gateway, never passed through |
| Tool allowlist | Agree which tools each deployment may list and call |
| Rate limits | Per-caller limits keyed to the verified identity |
| Response filtering | Redact known prompt-injection patterns from tool responses |
| Audit log | Append-only record of every call and its decision |
The gateway can only act on what passes through it. A server that’s also reachable directly, outside the gateway, still carries whatever risk existed before the gateway was added — closing that path is part of the engagement. For a lighter review without a gateway, see MCP / agent hardening, or talk to our team.
Which attack does audience binding prevent?
See the MCP confused-deputy problem and token passthrough, explained for the specific attack pattern audience binding is meant to prevent, the glossary entry for the confused deputy problem, and hosted MCP gateway options compared for how a DIY setup compares to a gateway Netbase runs for you.
What does the MCP & Agent Gateway work with?
Standards it speaks
- Model Context Protocol
- MCP authorization (OAuth)
- JWT bearer tokens
Using and able to integrate
- FastMCP
- Your OAuth identity provider
- Your existing MCP server
Who builds and supports the MCP & Agent Gateway?
AdminKit is a product of Netbase JSC, a software company founded in 2012 that delivers its projects remotely. The same team that wrote the MCP & Agent Gateway scopes, builds and operates it for you. Read more about Netbase JSC and AdminKit.
What Netbase JSC's clients say
Reviews of Netbase JSC's project work, not of AdminKit — AdminKit is a newer product from the same company.
"They had nice and good solutions for all of our requests."
Daniel Popescu
Owner, Digital Art Studio · Romania
Source: Clutch"They’re good listeners, are understanding, and they remember things very well."
Syed Ali
Partner, Oriental Overseas Exports · India
Source: Clutch"Their Quick response in every step was impressive."
Olof Christensson
CEO, Skelderwikens Brygghus AB · Sweden
Source: ClutchHow does Netbase deliver the MCP & Agent Gateway?
The MCP & Agent Gateway is delivered by Netbase as a scoped engagement, quoted per project. Every engagement follows the same four steps.
Review
We check your MCP server's exposure and authentication, starting with the free mcp-check tool.
Design
We connect your identity provider and agree the tool allowlist and rate limits for each client.
Deploy
Netbase puts the gateway in front of your server and closes the direct path to it.
Operate
We run the gateway afterwards and review the audit log with you.
Netbase expert service
MCP / agent hardening
A lighter option without a gateway: a Netbase review of your MCP server's authentication, tool allowlists and prompt-injection exposure.
Does the MCP & Agent Gateway fit a larger organisation?
- An append-only audit log of every call, for security review and incident work.
- Allowlists and rate limits keyed to identities from your own identity provider.
- The direct path to your server closed as part of the engagement, so the gateway is the only way in.
Talk to an expert
Huy Nguyen (David), Founder & CEO, Netbase JSC
Ask about the MCP & Agent Gateway for your organisation: scope, timeline or a quote.
What do people ask about the MCP & Agent Gateway?
How do I get the MCP & Agent Gateway?
Talk to our team at /contact/. Netbase scopes the engagement with you — which MCP servers, which identity provider issues your OAuth tokens, which tools each client may call — then deploys and operates the gateway for you. Every deployment is quoted per engagement.
What does the gateway actually see?
Only the traffic that passes through it. If a client bypasses the gateway and connects straight to your MCP server, the gateway has no visibility into that call.
Does the gateway replace authentication on my MCP server?
The gateway verifies each caller's OAuth token per the MCP authorization spec, checking that the token was issued for the gateway itself. It never forwards the caller's token to your server (no token passthrough); if your server needs a credential, the gateway uses its own. Your server can still run its own checks underneath.
What does 'tool allowlist' mean here?
A list of which tools exposed by your MCP server may be listed or called through the gateway. Calls to anything not on the list are refused before they reach your server, and the refusal is recorded in the audit log.
Will it stop every prompt-injection attempt?
No single filter can guarantee that. The gateway redacts tool-response text that matches a documented list of known prompt-injection patterns and records each match, as one layer of defense alongside the allowlist and audit log, not a complete solution on its own.
Where should you go next?
All AdminKit products →Product
Agent Trust API: Score MCP Servers Before Calling
AdminKit's Agent Trust API scores an MCP endpoint before an AI agent connects, returning a 0-100 score, a verdict and the evidence behind it.
Solution
Check what your AI agents and MCP servers expose, before you ship
Check if your MCP server is reachable and needs auth for free with AdminKit. Score endpoints with the Agent Trust API, or have Netbase run a gateway.
Guide
How to secure an MCP server: auth, tool allowlists and prompt injection
Secure an MCP server with OAuth per spec, a tool allowlist, and filtering for prompt injection in tool responses. A practical checklist with sources.
Talk to our team about the MCP & Agent Gateway
Tell us what you run. Our team scopes the work with you and sends a quote, answered by a person.
How AdminKit works with you
- Delivered remotely — Netbase JSC, the company behind AdminKit, has worked with clients in 80 countries.
- Contracts and invoices are issued by Netbase JSC; payment goes to the company by bank transfer to Netbase JSC's company account or PayPal Business.
- Talk to the CEO, Huy Nguyen (David), directly on WhatsApp or by email at [email protected].